Bad data can cause ILVerify to throw NRE

[masonwheeler]

Description

While attempting to use ILVerify to diagnose a compiler output problem, it instead blew up in my face, dumping a NullReferenceException stack trace on me.

Reproduction Steps

1. Install .NET 5.
2. Install ILVerify.
3. Download this test case and unzip it to a new folder.
4. Open PowerShell and CD to that folder.
5. ilverify .\testcase.dll -r "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.13\*.dll" (Adjust .NET 5 path as needed)

Expected behavior

A correct program should not throw "boneheaded exceptions."

A diagnostic tool should provide helpful diagnostic information about the nature of errors encountered.

Actual behavior

Error: System.NullReferenceException: Object reference not set to an instance of an object.
at ILVerify.ILVerifyTypeSystemContext.VerifyModuleName(String simpleName, EcmaModule module)
at ILVerify.ILVerifyTypeSystemContext.ResolveAssemblyOrNetmodule(String simpleName, String verificationName, IAssemblyDesc containingAssembly, Boolean throwIfNotFound)
at ILVerify.ILVerifyTypeSystemContext.ResolveAssembly(AssemblyName name, Boolean throwIfNotFound)
at Internal.TypeSystem.Ecma.EcmaModule.ResolveAssemblyReference(AssemblyReferenceHandle handle)
at Internal.TypeSystem.Ecma.EcmaModule.EcmaObjectLookupHashtable.CreateValueFromKey(EntityHandle handle)
at Internal.TypeSystem.LockFreeReaderHashtable`2.CreateValueAndEnsureValueIsInTable(TKey key)
at Internal.TypeSystem.Ecma.EcmaModule.GetObject(EntityHandle handle, NotFoundBehavior notFoundBehavior)
at Internal.TypeSystem.Ecma.EcmaModule.ResolveTypeReference(TypeReferenceHandle handle)
at Internal.TypeSystem.Ecma.EcmaModule.EcmaObjectLookupHashtable.CreateValueFromKey(EntityHandle handle)
at Internal.TypeSystem.LockFreeReaderHashtable`2.CreateValueAndEnsureValueIsInTable(TKey key)
at Internal.TypeSystem.Ecma.EcmaModule.GetObject(EntityHandle handle, NotFoundBehavior notFoundBehavior)
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ResolveHandle(EntityHandle handle)
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseTypeImpl(SignatureTypeCode typeCode)
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseType(SignatureTypeCode typeCode)
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseTypeImpl()
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseType()
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseTypeImpl(SignatureTypeCode typeCode)
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseType(SignatureTypeCode typeCode)
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseTypeImpl()
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseType()
at Internal.TypeSystem.Ecma.EcmaModule.ResolveTypeSpecification(TypeSpecificationHandle handle)
at Internal.TypeSystem.Ecma.EcmaModule.EcmaObjectLookupHashtable.CreateValueFromKey(EntityHandle handle)
at Internal.TypeSystem.LockFreeReaderHashtable`2.CreateValueAndEnsureValueIsInTable(TKey key)
at Internal.TypeSystem.Ecma.EcmaModule.GetObject(EntityHandle handle, NotFoundBehavior notFoundBehavior)
at Internal.TypeSystem.Ecma.EcmaModule.GetType(EntityHandle handle)
at Internal.TypeSystem.Ecma.EcmaType.InitializeBaseType()
at Internal.TypeSystem.Ecma.EcmaType.get_BaseType()
at Internal.TypeSystem.TypeDesc.get_IsDelegate()
at Internal.IL.ILImporter.ImportCall(ILOpcode opcode, Int32 token)
at Internal.IL.ILImporter.ImportBasicBlock(BasicBlock basicBlock)
at Internal.IL.ILImporter.ImportBasicBlocks()
at Internal.IL.ILImporter.Verify()
at ILVerify.Verifier.VerifyMethod(EcmaModule module, MethodIL methodIL, MethodDefinitionHandle methodHandle)
at ILVerify.Verifier.VerifyMethods(EcmaModule module, IEnumerable`1 methodHandles)+MoveNext()
at ILVerify.Verifier.Verify(PEReader peReader, MethodDefinitionHandle methodHandle)+MoveNext()
at ILVerify.Program.VerifyMethods(PEReader peReader, EcmaModule module, String path, Int32& numErrors, Int32& verifiedMethodCounter, Int32& methodCounter)
at ILVerify.Program.VerifyAssembly(PEReader peReader, EcmaModule module, String path)
at ILVerify.Program.Run()
at ILVerify.Program.Run(Options options)

Configuration

.NET 5, Windows 10, x64

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[masonwheeler]

This is caused by ILVerifyTypeSystemContext.ResolveAssemblyOrNetmodule being called with throwIfNotFound: false coming from a few stack frames up. If it were true, the code would check the not-found module and report useful information. Which raises the question, why does this option even exist that guarantees the program will crash rather than report useful information?

Tagging subscribers to this area: @JulieLeeMSFT
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

While attempting to use ILVerify to diagnose a compiler output problem, it instead blew up in my face, dumping a NullReferenceException stack trace on me.

Reproduction Steps

1. Install .NET 5.
2. Install ILVerify.
3. Download this test case and unzip it to a new folder.
4. Open PowerShell and CD to that folder.
5. ilverify .\testcase.dll -r "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\5.0.13\*.dll" (Adjust .NET 5 path as needed)

Expected behavior

A correct program should not throw "boneheaded exceptions."

A diagnostic tool should provide helpful diagnostic information about the nature of errors encountered.

Actual behavior

Error: System.NullReferenceException: Object reference not set to an instance of an object.
at ILVerify.ILVerifyTypeSystemContext.VerifyModuleName(String simpleName, EcmaModule module)
at ILVerify.ILVerifyTypeSystemContext.ResolveAssemblyOrNetmodule(String simpleName, String verificationName, IAssemblyDesc containingAssembly, Boolean throwIfNotFound)
at ILVerify.ILVerifyTypeSystemContext.ResolveAssembly(AssemblyName name, Boolean throwIfNotFound)
at Internal.TypeSystem.Ecma.EcmaModule.ResolveAssemblyReference(AssemblyReferenceHandle handle)
at Internal.TypeSystem.Ecma.EcmaModule.EcmaObjectLookupHashtable.CreateValueFromKey(EntityHandle handle)
at Internal.TypeSystem.LockFreeReaderHashtable`2.CreateValueAndEnsureValueIsInTable(TKey key)
at Internal.TypeSystem.Ecma.EcmaModule.GetObject(EntityHandle handle, NotFoundBehavior notFoundBehavior)
at Internal.TypeSystem.Ecma.EcmaModule.ResolveTypeReference(TypeReferenceHandle handle)
at Internal.TypeSystem.Ecma.EcmaModule.EcmaObjectLookupHashtable.CreateValueFromKey(EntityHandle handle)
at Internal.TypeSystem.LockFreeReaderHashtable`2.CreateValueAndEnsureValueIsInTable(TKey key)
at Internal.TypeSystem.Ecma.EcmaModule.GetObject(EntityHandle handle, NotFoundBehavior notFoundBehavior)
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ResolveHandle(EntityHandle handle)
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseTypeImpl(SignatureTypeCode typeCode)
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseType(SignatureTypeCode typeCode)
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseTypeImpl()
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseType()
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseTypeImpl(SignatureTypeCode typeCode)
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseType(SignatureTypeCode typeCode)
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseTypeImpl()
at Internal.TypeSystem.Ecma.EcmaSignatureParser.ParseType()
at Internal.TypeSystem.Ecma.EcmaModule.ResolveTypeSpecification(TypeSpecificationHandle handle)
at Internal.TypeSystem.Ecma.EcmaModule.EcmaObjectLookupHashtable.CreateValueFromKey(EntityHandle handle)
at Internal.TypeSystem.LockFreeReaderHashtable`2.CreateValueAndEnsureValueIsInTable(TKey key)
at Internal.TypeSystem.Ecma.EcmaModule.GetObject(EntityHandle handle, NotFoundBehavior notFoundBehavior)
at Internal.TypeSystem.Ecma.EcmaModule.GetType(EntityHandle handle)
at Internal.TypeSystem.Ecma.EcmaType.InitializeBaseType()
at Internal.TypeSystem.Ecma.EcmaType.get_BaseType()
at Internal.TypeSystem.TypeDesc.get_IsDelegate()
at Internal.IL.ILImporter.ImportCall(ILOpcode opcode, Int32 token)
at Internal.IL.ILImporter.ImportBasicBlock(BasicBlock basicBlock)
at Internal.IL.ILImporter.ImportBasicBlocks()
at Internal.IL.ILImporter.Verify()
at ILVerify.Verifier.VerifyMethod(EcmaModule module, MethodIL methodIL, MethodDefinitionHandle methodHandle)
at ILVerify.Verifier.VerifyMethods(EcmaModule module, IEnumerable`1 methodHandles)+MoveNext()
at ILVerify.Verifier.Verify(PEReader peReader, MethodDefinitionHandle methodHandle)+MoveNext()
at ILVerify.Program.VerifyMethods(PEReader peReader, EcmaModule module, String path, Int32& numErrors, Int32& verifiedMethodCounter, Int32& methodCounter)
at ILVerify.Program.VerifyAssembly(PEReader peReader, EcmaModule module, String path)
at ILVerify.Program.Run()
at ILVerify.Program.Run(Options options)

Configuration

.NET 5, Windows 10, x64

Author:	masonwheeler
Assignees:	-
Labels:	untriaged, area-ILVerification, in pr
Milestone:	-

[jkotas]

Duplicate of #62711

[MichalPetryka]

Is there some nightly feed with a fix for this issue available?

[jkotas]

Yes, it should be in the nightly dotnet7 feed.

• Feed url to add to nuget.config: https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet7/nuget/v3/index.json
• Url that can be used to browse the nightly dotnet7 feed: https://dev.azure.com/dnceng/public/_packaging?_a=feed&feed=dotnet7

It is prerelease package so you need to specify --prerelease to pick it up: dotnet tool install dotnet-ilverify --prerelease