Various Issues

Setup: `Ubuntu 24.04`
Release:
```bash
cmake -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -H. -Bout/release -DCMAKE_C_COMPILER=clang   -DCMAKE_CXX_COMPILER=clang++   -DWALRUS_ARCH=x64 -DWALRUS_HOST=linux   -DWALRUS_MODE=release -DWALRUS_OUTPUT=shell -GNinja
```
Fuzzing:
```bash
cmake -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -H. -Bout/release -DCMAKE_C_COMPILER=clang   -DCMAKE_CXX_COMPILER=clang++   -DWALRUS_ARCH=x64 -DWALRUS_HOST=linux   -DWALRUS_MODE=debug -DWALRUS_OUTPUT=shell -DWALRUS_ASAN=ON -GNinja
```

List:
- Assertion `isTypeFunc()' failed.`
- Assertion `ref->isValueType() || ref->isTypeLabels() || ref->isTypeResource() || ref->kind() == SubResourceKind' failed.`
- Assertion `IsValueType()' failed.`
- Assertion `hasValue()' failed.`
- Assertion `isComponentType()' failed.`
- Assertion `type != Enum::TypeIndex && type != Enum::TypeNone' failed.`
- Assertion in `Walrus::JITCompiler::allocateRegisters()`   (works only with --jit)
- SEGV in `Walrus::ComponentRefCounted::addRef()`
- SEGV in `Walrus::ComponentType::getType(unsigned long)`
- SEGV in `wabt::WASMComponentBinaryReader::OnExport(wabt::ComponentStringLoc const&, nonstd::sv_lite::basic_string_view<char, std::char_traits<char> >*, wabt::ComponentExternalInfo*, wabt::ComponentExportInfo*)`
- heap-buffer-overflow in `Walrus::ComponentType::getType(unsigned long)`
- heap-use-after-free in `Walrus::ComponentRefCounted::releaseRef()`

Assertions:
- Assertion `isTypeFunc()' failed.`
```cpp
walrus: /root/walrus/src/runtime/Component.h:195: ComponentTypeFunc *Walrus::ComponentRefCounted::asTypeFunc(): Assertion `isTypeFunc()' failed.
```

- Assertion `ref->isValueType() || ref->isTypeLabels() || ref->isTypeResource() || ref->kind() == SubResourceKind' failed.`
```cpp
walrus: /root/walrus/src/runtime/Component.cpp:77: static void Walrus::ComponentRefCounted::releaseAllRefs(ComponentRefCounted *): Assertion `ref->isValueType() || ref->isTypeLabels() || ref->isTypeResource() || ref->kind() == SubResourceKind' failed.
```

- Assertion `IsValueType()' failed.`
```cpp
walrus: /root/walrus/third_party/wabt/include/wabt/shared-validator.h:766: wabt::SharedComponentValidator::TypeListFixed::TypeListFixed(const TypeRef &, uint32_t): Assertion `IsValueType()' failed.
```

- Assertion `hasValue()' failed.`
```cpp
walrus: /root/walrus/src/util/Optional.h:127: T *Walrus::Optional<Walrus::Module *>::value() [T = Walrus::Module *]: Assertion `hasValue()' failed.
```

- Assertion `isComponentType()' failed.`
```cpp
walrus: /root/walrus/src/runtime/Component.h:229: ComponentType *Walrus::ComponentRefCounted::asComponentType(): Assertion `isComponentType()' failed.
```

- Assertion `type != Enum::TypeIndex && type != Enum::TypeNone' failed.`
```cpp
walrus: /root/walrus/third_party/wabt/include/wabt/type.h:347: wabt::ComponentType::ComponentType(Enum): Assertion `type != Enum::TypeIndex && type != Enum::TypeNone' failed.
```

- Assertion in `Walrus::JITCompiler::allocateRegisters()`
```cpp
walrus: /root/walrus/src/jit/RegisterAlloc.cpp:707: void Walrus::JITCompiler::allocateRegisters(): Assertion `instr->opcode() == ByteCode::EndOpcode || instr->opcode() == ByteCode::ThrowOpcode || instr->opcode() == ByteCode::CallOpcode || instr->opcode() == ByteCode::ReturnCallOpcode || instr->opcode() == ByteCode::CallIndirectOpcode || instr->opcode() == ByteCode::CallIndirectM64Opcode || instr->opcode() == ByteCode::CallRefOpcode || instr->opcode() == ByteCode::JumpOpcode || instr->opcode() == ByteCode::ElemDropOpcode || instr->opcode() == ByteCode::DataDropOpcode || instr->opcode() == ByteCode::StructNewOpcode || instr->opcode() == ByteCode::ArrayNewFixedOpcode || instr->opcode() == ByteCode::ArrayInitDataOpcode || instr->opcode() == ByteCode::ArrayInitElemOpcode || instr->opcode() == ByteCode::ArrayFillOpcode || instr->opcode() == ByteCode::ArrayCopyOpcode || instr->opcode() == ByteCode::UnreachableOpcode || instr->opcode() == ByteCode::NopOpcode' failed.
```
Due to:
```
pwndbg> print instr->opcode()
$5 = Walrus::ByteCode::AtomicFenceOpcode
```

StackTraces:
- SEGV in `Walrus::ComponentRefCounted::addRef()`
```cpp
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3799232==ERROR: AddressSanitizer: SEGV on unknown address 0x5fdd4f838270 (pc 0x5fdd4eee5a5e bp 0x7ffed7244b40 sp 0x7ffed7244b20 T0)
==3799232==The signal is caused by a WRITE memory access.
    #0 0x5fdd4eee5a5e in Walrus::ComponentRefCounted::addRef() /root/walrus/src/runtime/Component.h:97
    #1 0x5fdd4ef103bc in Walrus::ComponentCanonType::ComponentCanonType(Walrus::ComponentDeclaration::Kind, Walrus::ComponentRefCounted*) /root/walrus/src/runtime/Component.h:1002
    #2 0x5fdd4eecb00f in wabt::WASMComponentBinaryReader::OnCanonType(wabt::ComponentCanon, unsigned int) /root/walrus/src/parser/WASMComponentParser.cpp:850
    #3 0x5fdd4f30650d in wabt::ComponentBinaryReaderDelegateWalrus::OnCanonType(wabt::ComponentCanon, wabt::ComponentIndexLoc const&) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2042
    #4 0x5fdd4f25ecb1 in wabt::(anonymous namespace)::BinaryReader::ReadComponentCanon() /root/walrus/third_party/wabt/src/binary-reader.cc:4243
    #5 0x5fdd4f251b6c in wabt::(anonymous namespace)::BinaryReader::ReadComponent() /root/walrus/third_party/wabt/src/binary-reader.cc:4449
    #6 0x5fdd4f24d169 in wabt::(anonymous namespace)::BinaryReader::ReadModule(wabt::(anonymous namespace)::BinaryReader::ReadModuleOptions const&) /root/walrus/third_party/wabt/src/binary-reader.cc:4527
    #7 0x5fdd4f24d6bb in wabt::ReadBinaryComponent(nonstd::span_lite::span<unsigned char const, 18446744073709551615ul>, wabt::ComponentBinaryReaderDelegate*, wabt::ReadBinaryOptions const&) /root/walrus/third_party/wabt/src/binary-reader.cc:4565
    #8 0x5fdd4f2d9e28 in wabt::ReadWasmComponentBinary[abi:cxx11](unsigned char const*, unsigned long, wabt::WASMComponentBinaryReaderDelegate*) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2129
    #9 0x5fdd4eebcfd1 in Walrus::WASMComponentParser::parseBinary(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned char const*, unsigned long, unsigned int, unsigned int) /root/walrus/src/parser/WASMComponentParser.cpp:928
    #10 0x5fdd4f1b71b3 in executeWASMComponent(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<unsigned char, std::allocator<unsigned char> > const&) /root/walrus/src/shell/Shell.cpp:379
    #11 0x5fdd4f1b16c2 in main /root/walrus/src/shell/Shell.cpp:1403
    #12 0x783e08c2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #13 0x783e08c2a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #14 0x5fdd4ebea2c4 in _start (/root/walrus/out/fuzz-asan/walrus+0xd92c4) (BuildId: 09f7d9f95068fbdf40aefc725d851d7ca4375ed5)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/walrus/src/runtime/Component.h:97 in Walrus::ComponentRefCounted::addRef()
==3799232==ABORTING
```

- SEGV in `Walrus::ComponentType::getType(unsigned long)`
```cpp
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3799475==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000003a0 (pc 0x5b3a1d4aa343 bp 0x7ffe532c09d0 sp 0x7ffe532c09b0 T0)
==3799475==The signal is caused by a READ memory access.
==3799475==Hint: address points to the zero page.
    #0 0x5b3a1d4aa343 in Walrus::ComponentType::getType(unsigned long) /root/walrus/src/runtime/Component.h:598
    #1 0x5b3a1d4d5080 in wabt::WASMComponentBinaryReader::pushExternalType(wabt::ComponentExternalInfo const&) /root/walrus/src/parser/WASMComponentParser.cpp:299
    #2 0x5b3a1d48f51c in wabt::WASMComponentBinaryReader::OnImport(wabt::ComponentStringLoc const&, nonstd::sv_lite::basic_string_view<char, std::char_traits<char> >*, wabt::ComponentExternalInfo const&) /root/walrus/src/parser/WASMComponentParser.cpp:860
    #3 0x5b3a1d8ca702 in wabt::ComponentBinaryReaderDelegateWalrus::OnImport(wabt::ComponentStringLoc const&, nonstd::sv_lite::basic_string_view<char, std::char_traits<char> >*, wabt::ComponentExternalInfo const&) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2058
    #4 0x5b3a1d823b9b in wabt::(anonymous namespace)::BinaryReader::ReadComponentExternal(bool, bool) /root/walrus/third_party/wabt/src/binary-reader.cc:4337
    #5 0x5b3a1d8160ac in wabt::(anonymous namespace)::BinaryReader::ReadComponent() /root/walrus/third_party/wabt/src/binary-reader.cc:4461
    #6 0x5b3a1d811169 in wabt::(anonymous namespace)::BinaryReader::ReadModule(wabt::(anonymous namespace)::BinaryReader::ReadModuleOptions const&) /root/walrus/third_party/wabt/src/binary-reader.cc:4527
    #7 0x5b3a1d8116bb in wabt::ReadBinaryComponent(nonstd::span_lite::span<unsigned char const, 18446744073709551615ul>, wabt::ComponentBinaryReaderDelegate*, wabt::ReadBinaryOptions const&) /root/walrus/third_party/wabt/src/binary-reader.cc:4565
    #8 0x5b3a1d89de28 in wabt::ReadWasmComponentBinary[abi:cxx11](unsigned char const*, unsigned long, wabt::WASMComponentBinaryReaderDelegate*) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2129
    #9 0x5b3a1d480fd1 in Walrus::WASMComponentParser::parseBinary(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned char const*, unsigned long, unsigned int, unsigned int) /root/walrus/src/parser/WASMComponentParser.cpp:928
    #10 0x5b3a1d77b1b3 in executeWASMComponent(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<unsigned char, std::allocator<unsigned char> > const&) /root/walrus/src/shell/Shell.cpp:379
    #11 0x5b3a1d7756c2 in main /root/walrus/src/shell/Shell.cpp:1403
    #12 0x7c2a83a2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #13 0x7c2a83a2a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #14 0x5b3a1d1ae2c4 in _start (/root/walrus/out/fuzz-asan/walrus+0xd92c4) (BuildId: 09f7d9f95068fbdf40aefc725d851d7ca4375ed5)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/walrus/src/runtime/Component.h:598 in Walrus::ComponentType::getType(unsigned long)
==3799475==ABORTING
```

- SEGV in `wabt::WASMComponentBinaryReader::OnExport(wabt::ComponentStringLoc const&, nonstd::sv_lite::basic_string_view<char, std::char_traits<char> >*, wabt::ComponentExternalInfo*, wabt::ComponentExportInfo*)`
```cpp
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3799584==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x637e89ecc34e bp 0x7fff48d9e1c0 sp 0x7fff48d9de60 T0)
==3799584==The signal is caused by a READ memory access.
==3799584==Hint: address points to the zero page.
    #0 0x637e89ecc34e in wabt::WASMComponentBinaryReader::OnExport(wabt::ComponentStringLoc const&, nonstd::sv_lite::basic_string_view<char, std::char_traits<char> >*, wabt::ComponentExternalInfo*, wabt::ComponentExportInfo*) /root/walrus/src/parser/WASMComponentParser.cpp:879
    #1 0x637e8a3068fe in wabt::ComponentBinaryReaderDelegateWalrus::OnExport(wabt::ComponentStringLoc const&, nonstd::sv_lite::basic_string_view<char, std::char_traits<char> >*, wabt::ComponentExternalInfo*, wabt::ComponentExportInfo*) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2075
    #2 0x637e8a25fd79 in wabt::(anonymous namespace)::BinaryReader::ReadComponentExternal(bool, bool) /root/walrus/third_party/wabt/src/binary-reader.cc:4342
    #3 0x637e8a2525ec in wabt::(anonymous namespace)::BinaryReader::ReadComponent() /root/walrus/third_party/wabt/src/binary-reader.cc:4473
    #4 0x637e8a24d169 in wabt::(anonymous namespace)::BinaryReader::ReadModule(wabt::(anonymous namespace)::BinaryReader::ReadModuleOptions const&) /root/walrus/third_party/wabt/src/binary-reader.cc:4527
    #5 0x637e8a24d6bb in wabt::ReadBinaryComponent(nonstd::span_lite::span<unsigned char const, 18446744073709551615ul>, wabt::ComponentBinaryReaderDelegate*, wabt::ReadBinaryOptions const&) /root/walrus/third_party/wabt/src/binary-reader.cc:4565
    #6 0x637e8a2d9e28 in wabt::ReadWasmComponentBinary[abi:cxx11](unsigned char const*, unsigned long, wabt::WASMComponentBinaryReaderDelegate*) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2129
    #7 0x637e89ebcfd1 in Walrus::WASMComponentParser::parseBinary(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned char const*, unsigned long, unsigned int, unsigned int) /root/walrus/src/parser/WASMComponentParser.cpp:928
    #8 0x637e8a1b71b3 in executeWASMComponent(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<unsigned char, std::allocator<unsigned char> > const&) /root/walrus/src/shell/Shell.cpp:379
    #9 0x637e8a1b16c2 in main /root/walrus/src/shell/Shell.cpp:1403
    #10 0x7e3002a2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #11 0x7e3002a2a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #12 0x637e89bea2c4 in _start (/root/walrus/out/fuzz-asan/walrus+0xd92c4) (BuildId: 09f7d9f95068fbdf40aefc725d851d7ca4375ed5)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/walrus/src/parser/WASMComponentParser.cpp:879 in wabt::WASMComponentBinaryReader::OnExport(wabt::ComponentStringLoc const&, nonstd::sv_lite::basic_string_view<char, std::char_traits<char> >*, wabt::ComponentExternalInfo*, wabt::ComponentExportInfo*)
==3799584==ABORTING
```

- heap-buffer-overflow in `Walrus::ComponentType::getType(unsigned long)`
```cpp
=================================================================
==3799109==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000000128 at pc 0x57313857233f bp 0x7ffd0a188770 sp 0x7ffd0a188760
READ of size 8 at 0x502000000128 thread T0
    #0 0x57313857233e in Walrus::ComponentType::getType(unsigned long) /root/walrus/src/runtime/Component.h:598
    #1 0x573138556fb6 in wabt::WASMComponentBinaryReader::OnCanonType(wabt::ComponentCanon, unsigned int) /root/walrus/src/parser/WASMComponentParser.cpp:849
    #2 0x57313899250d in wabt::ComponentBinaryReaderDelegateWalrus::OnCanonType(wabt::ComponentCanon, wabt::ComponentIndexLoc const&) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2042
    #3 0x5731388eacb1 in wabt::(anonymous namespace)::BinaryReader::ReadComponentCanon() /root/walrus/third_party/wabt/src/binary-reader.cc:4243
    #4 0x5731388ddb6c in wabt::(anonymous namespace)::BinaryReader::ReadComponent() /root/walrus/third_party/wabt/src/binary-reader.cc:4449
    #5 0x5731388d9169 in wabt::(anonymous namespace)::BinaryReader::ReadModule(wabt::(anonymous namespace)::BinaryReader::ReadModuleOptions const&) /root/walrus/third_party/wabt/src/binary-reader.cc:4527
    #6 0x5731388d96bb in wabt::ReadBinaryComponent(nonstd::span_lite::span<unsigned char const, 18446744073709551615ul>, wabt::ComponentBinaryReaderDelegate*, wabt::ReadBinaryOptions const&) /root/walrus/third_party/wabt/src/binary-reader.cc:4565
    #7 0x573138965e28 in wabt::ReadWasmComponentBinary[abi:cxx11](unsigned char const*, unsigned long, wabt::WASMComponentBinaryReaderDelegate*) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2129
    #8 0x573138548fd1 in Walrus::WASMComponentParser::parseBinary(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned char const*, unsigned long, unsigned int, unsigned int) /root/walrus/src/parser/WASMComponentParser.cpp:928
    #9 0x5731388431b3 in executeWASMComponent(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<unsigned char, std::allocator<unsigned char> > const&) /root/walrus/src/shell/Shell.cpp:379
    #10 0x57313883d6c2 in main /root/walrus/src/shell/Shell.cpp:1403
    #11 0x7ae49582a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #12 0x7ae49582a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #13 0x5731382762c4 in _start (/root/walrus/out/fuzz-asan/walrus+0xd92c4) (BuildId: 09f7d9f95068fbdf40aefc725d851d7ca4375ed5)

0x502000000128 is located 8 bytes before 8-byte region [0x502000000130,0x502000000138)
allocated by thread T0 here:
    #0 0x7ae4960fe548 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95
    #1 0x573138bc1411 in std::__new_allocator<wabt::SharedComponentValidator::TypeBase*>::allocate(unsigned long, void const*) /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/new_allocator.h:151
    #2 0x573138bc10b7 in std::allocator_traits<std::allocator<wabt::SharedComponentValidator::TypeBase*> >::allocate(std::allocator<wabt::SharedComponentValidator::TypeBase*>&, unsigned long) /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/alloc_traits.h:482
    #3 0x573138bc10b7 in std::_Vector_base<wabt::SharedComponentValidator::TypeBase*, std::allocator<wabt::SharedComponentValidator::TypeBase*> >::_M_allocate(unsigned long) /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:381
    #4 0x573138bc0bea in void std::vector<wabt::SharedComponentValidator::TypeBase*, std::allocator<wabt::SharedComponentValidator::TypeBase*> >::_M_realloc_insert<wabt::SharedComponentValidator::TypeBase*>(__gnu_cxx::__normal_iterator<wabt::SharedComponentValidator::TypeBase**, std::vector<wabt::SharedComponentValidator::TypeBase*, std::allocator<wabt::SharedComponentValidator::TypeBase*> > >, wabt::SharedComponentValidator::TypeBase*&&) /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/vector.tcc:459
    #5 0x573138bc0b36 in void std::vector<wabt::SharedComponentValidator::TypeBase*, std::allocator<wabt::SharedComponentValidator::TypeBase*> >::emplace_back<wabt::SharedComponentValidator::TypeBase*>(wabt::SharedComponentValidator::TypeBase*&&) /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/vector.tcc:123
    #6 0x573138b9968c in std::vector<wabt::SharedComponentValidator::TypeBase*, std::allocator<wabt::SharedComponentValidator::TypeBase*> >::push_back(wabt::SharedComponentValidator::TypeBase*&&) /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:1299
    #7 0x573138ba6726 in wabt::SharedComponentValidator::OnCanonType(wabt::ComponentCanon, wabt::ComponentIndexLoc const&) /root/walrus/third_party/wabt/src/shared-validator.cc:2678
    #8 0x573138992458 in wabt::ComponentBinaryReaderDelegateWalrus::OnCanonType(wabt::ComponentCanon, wabt::ComponentIndexLoc const&) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2041
    #9 0x5731388eacb1 in wabt::(anonymous namespace)::BinaryReader::ReadComponentCanon() /root/walrus/third_party/wabt/src/binary-reader.cc:4243
    #10 0x5731388ddb6c in wabt::(anonymous namespace)::BinaryReader::ReadComponent() /root/walrus/third_party/wabt/src/binary-reader.cc:4449
    #11 0x5731388d9169 in wabt::(anonymous namespace)::BinaryReader::ReadModule(wabt::(anonymous namespace)::BinaryReader::ReadModuleOptions const&) /root/walrus/third_party/wabt/src/binary-reader.cc:4527
    #12 0x5731388d96bb in wabt::ReadBinaryComponent(nonstd::span_lite::span<unsigned char const, 18446744073709551615ul>, wabt::ComponentBinaryReaderDelegate*, wabt::ReadBinaryOptions const&) /root/walrus/third_party/wabt/src/binary-reader.cc:4565
    #13 0x573138965e28 in wabt::ReadWasmComponentBinary[abi:cxx11](unsigned char const*, unsigned long, wabt::WASMComponentBinaryReaderDelegate*) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2129
    #14 0x573138548fd1 in Walrus::WASMComponentParser::parseBinary(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned char const*, unsigned long, unsigned int, unsigned int) /root/walrus/src/parser/WASMComponentParser.cpp:928
    #15 0x5731388431b3 in executeWASMComponent(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<unsigned char, std::allocator<unsigned char> > const&) /root/walrus/src/shell/Shell.cpp:379
    #16 0x57313883d6c2 in main /root/walrus/src/shell/Shell.cpp:1403
    #17 0x7ae49582a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #18 0x7ae49582a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #19 0x5731382762c4 in _start (/root/walrus/out/fuzz-asan/walrus+0xd92c4) (BuildId: 09f7d9f95068fbdf40aefc725d851d7ca4375ed5)

SUMMARY: AddressSanitizer: heap-buffer-overflow /root/walrus/src/runtime/Component.h:598 in Walrus::ComponentType::getType(unsigned long)
Shadow bytes around the buggy address:
  0x501ffffffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x501fffffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x501fffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x502000000000: fa fa 01 fa fa fa 00 fa fa fa fd fa fa fa 00 fa
  0x502000000080: fa fa fd fd fa fa 00 fa fa fa 00 fa fa fa 00 fa
=>0x502000000100: fa fa 00 00 fa[fa]00 fa fa fa fa fa fa fa fa fa
  0x502000000180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3799109==ABORTING
```

- heap-use-after-free in `Walrus::ComponentRefCounted::releaseRef()`
```cpp
=================================================================
==3798928==ERROR: AddressSanitizer: heap-use-after-free on address 0x502000000118 at pc 0x5cc79f989736 bp 0x7ffc734a0020 sp 0x7ffc734a0010
READ of size 8 at 0x502000000118 thread T0
    #0 0x5cc79f989735 in Walrus::ComponentRefCounted::releaseRef() /root/walrus/src/runtime/Component.h:102
    #1 0x5cc79f9895dd in Walrus::ComponentCanonType::~ComponentCanonType() /root/walrus/src/runtime/Component.h:1007
    #2 0x5cc79f9896b8 in Walrus::ComponentCanonType::~ComponentCanonType() /root/walrus/src/runtime/Component.h:1006
    #3 0x5cc79faf4c27 in Walrus::Component::~Component() /root/walrus/src/runtime/Component.cpp:343
    #4 0x5cc79fbcd10f in Walrus::Store::~Store() /root/walrus/src/runtime/Store.cpp:77
    #5 0x5cc79fc2b786 in main /root/walrus/src/shell/Shell.cpp:1433
    #6 0x7f46c9c2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #7 0x7f46c9c2a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #8 0x5cc79f6632c4 in _start (/root/walrus/out/fuzz-asan/walrus+0xd92c4) (BuildId: 09f7d9f95068fbdf40aefc725d851d7ca4375ed5)

0x502000000118 is located 8 bytes inside of 16-byte region [0x502000000110,0x502000000120)
freed by thread T0 here:
    #0 0x7f46ca4ff0a8 in operator delete(void*) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:152
    #1 0x5cc79ff9dfa1 in wabt::SharedComponentValidator::TypeBase::~TypeBase() /root/walrus/third_party/wabt/include/wabt/shared-validator.h:624
    #2 0x5cc79fd81a00 in std::default_delete<wabt::SharedComponentValidator::TypeBase>::operator()(wabt::SharedComponentValidator::TypeBase*) const /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/unique_ptr.h:99
    #3 0x5cc79fd81817 in std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> >::~unique_ptr() /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/unique_ptr.h:404
    #4 0x5cc79fd81764 in void std::_Destroy<std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> > >(std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> >*) /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_construct.h:151
    #5 0x5cc79fd816a6 in void std::_Destroy_aux<false>::__destroy<std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> >*>(std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> >*, std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> >*) /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_construct.h:163
    #6 0x5cc79fd8163c in void std::_Destroy<std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> >*>(std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> >*, std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> >*) /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_construct.h:195
    #7 0x5cc79fd7fbac in void std::_Destroy<std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> >*, std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> > >(std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> >*, std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> >*, std::allocator<std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> > >&) /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/alloc_traits.h:948
    #8 0x5cc79fd7fbac in std::vector<std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> >, std::allocator<std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> > > >::~vector() /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/stl_vector.h:735
    #9 0x5cc79fd7b5b9 in wabt::SharedComponentValidator::~SharedComponentValidator() /root/walrus/third_party/wabt/include/wabt/shared-validator.h:415
    #10 0x5cc79fd5342a in wabt::ComponentBinaryReaderDelegateWalrus::~ComponentBinaryReaderDelegateWalrus() /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:1631
    #11 0x5cc79fd530ae in wabt::ReadWasmComponentBinary[abi:cxx11](unsigned char const*, unsigned long, wabt::WASMComponentBinaryReaderDelegate*) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2140
    #12 0x5cc79f935fd1 in Walrus::WASMComponentParser::parseBinary(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned char const*, unsigned long, unsigned int, unsigned int) /root/walrus/src/parser/WASMComponentParser.cpp:928
    #13 0x5cc79fc301b3 in executeWASMComponent(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<unsigned char, std::allocator<unsigned char> > const&) /root/walrus/src/shell/Shell.cpp:379
    #14 0x5cc79fc2a6c2 in main /root/walrus/src/shell/Shell.cpp:1403
    #15 0x7f46c9c2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #16 0x7f46c9c2a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #17 0x5cc79f6632c4 in _start (/root/walrus/out/fuzz-asan/walrus+0xd92c4) (BuildId: 09f7d9f95068fbdf40aefc725d851d7ca4375ed5)

previously allocated by thread T0 here:
    #0 0x7f46ca4fe548 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95
    #1 0x5cc79ff92cd8 in std::unique_ptr<wabt::SharedComponentValidator::TypeBase, std::default_delete<wabt::SharedComponentValidator::TypeBase> > wabt::MakeUnique<wabt::SharedComponentValidator::TypeBase, wabt::SharedComponentValidator::TypeDef>(wabt::SharedComponentValidator::TypeDef&&) /root/walrus/third_party/wabt/include/wabt/make-unique.h:37
    #2 0x5cc79ff936bb in wabt::SharedComponentValidator::OnCanonType(wabt::ComponentCanon, wabt::ComponentIndexLoc const&) /root/walrus/third_party/wabt/src/shared-validator.cc:2677
    #3 0x5cc79fd7f458 in wabt::ComponentBinaryReaderDelegateWalrus::OnCanonType(wabt::ComponentCanon, wabt::ComponentIndexLoc const&) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2041
    #4 0x5cc79fcd7cb1 in wabt::(anonymous namespace)::BinaryReader::ReadComponentCanon() /root/walrus/third_party/wabt/src/binary-reader.cc:4243
    #5 0x5cc79fccab6c in wabt::(anonymous namespace)::BinaryReader::ReadComponent() /root/walrus/third_party/wabt/src/binary-reader.cc:4449
    #6 0x5cc79fcc6169 in wabt::(anonymous namespace)::BinaryReader::ReadModule(wabt::(anonymous namespace)::BinaryReader::ReadModuleOptions const&) /root/walrus/third_party/wabt/src/binary-reader.cc:4527
    #7 0x5cc79fcc66bb in wabt::ReadBinaryComponent(nonstd::span_lite::span<unsigned char const, 18446744073709551615ul>, wabt::ComponentBinaryReaderDelegate*, wabt::ReadBinaryOptions const&) /root/walrus/third_party/wabt/src/binary-reader.cc:4565
    #8 0x5cc79fd52e28 in wabt::ReadWasmComponentBinary[abi:cxx11](unsigned char const*, unsigned long, wabt::WASMComponentBinaryReaderDelegate*) /root/walrus/third_party/wabt/src/walrus/binary-reader-walrus.cc:2129
    #9 0x5cc79f935fd1 in Walrus::WASMComponentParser::parseBinary(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, unsigned char const*, unsigned long, unsigned int, unsigned int) /root/walrus/src/parser/WASMComponentParser.cpp:928
    #10 0x5cc79fc301b3 in executeWASMComponent(Walrus::Store*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<unsigned char, std::allocator<unsigned char> > const&) /root/walrus/src/shell/Shell.cpp:379
    #11 0x5cc79fc2a6c2 in main /root/walrus/src/shell/Shell.cpp:1403
    #12 0x7f46c9c2a1c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #13 0x7f46c9c2a28a in __libc_start_main_impl ../csu/libc-start.c:360
    #14 0x5cc79f6632c4 in _start (/root/walrus/out/fuzz-asan/walrus+0xd92c4) (BuildId: 09f7d9f95068fbdf40aefc725d851d7ca4375ed5)

SUMMARY: AddressSanitizer: heap-use-after-free /root/walrus/src/runtime/Component.h:102 in Walrus::ComponentRefCounted::releaseRef()
Shadow bytes around the buggy address:
  0x501ffffffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x501fffffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x501fffffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x502000000000: fa fa 01 fa fa fa 00 fa fa fa fd fa fa fa fd fa
  0x502000000080: fa fa fd fd fa fa 00 fa fa fa fd fa fa fa 00 fa
=>0x502000000100: fa fa fd[fd]fa fa fd fa fa fa 00 fa fa fa fa fa
  0x502000000180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x502000000380: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==3798928==ABORTING
```
[report_walrus.zip](https://github.com/user-attachments/files/30453081/report_walrus.zip)

Navigation Menu

Uh oh!

Various Issues #462

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

Various Issues #462

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions