Crossgen2 Mach-O R2R output has LC_SEGMENT_64 filesize > vmsize, rejected by llvm-objdump/otool

[jtschuster]

Crossgen2 composite Mach-O R2R images have filesize > vmsize in the first LC_SEGMENT_64 load command. This causes llvm-objdump --macho and llvm-readobj to reject the file:

   llvm-objdump: error: 'file.dll': truncated or malformed object
   (load command 0 filesize field in LC_SEGMENT_64 greater than vmsize field)

The __data section extends past the segment's declared vmsize. For example, a small library produces vmsize=0x7A9 but filesize=0x9D9.

The runtime loads these images fine — this only affects tooling inspection.

Repro steps:

   # On x64 Linux, cross-compile for osx-arm64

   # Build clr for x64 (crossgen2 host) and arm64 (target JIT + libs)
   ./build.sh clr -c Release
   ./build.sh clr+libs -arch arm64 -c Release

   # Crossgen2 any library as composite Mach-O for osx-arm64
   dotnet exec artifacts/bin/coreclr/linux.x64.Release/crossgen2/crossgen2.dll \
       --jitpath artifacts/bin/coreclr/linux.arm64.Release/libclrjit_universal_arm64_x64.so \
       --targetarch arm64 --targetos osx \
       -f macho --composite \
       -r "artifacts/bin/microsoft.netcore.app.runtime.linux-arm64/Release/runtimes/linux-arm64/lib/net11.0/*.dll" \
       -r "artifacts/bin/coreclr/linux.arm64.Release/IL/System.Private.CoreLib.dll" \
       --out /tmp/test.macho.dll \
       "artifacts/bin/microsoft.netcore.app.runtime.linux-arm64/Release/runtimes/linux-arm64/lib/net11.0/System.Buffers.dll"

   # Output is valid Mach-O:
   file /tmp/test.macho.dll
   # Mach-O 64-bit arm64 object, flags:<|SUBSECTIONS_VIA_SYMBOLS>

   # But llvm-objdump rejects it:
   llvm-objdump --macho --section-headers /tmp/test.macho.dll
   # error: truncated or malformed object (load command 0 filesize field
   #   in LC_SEGMENT_64 greater than vmsize field)

[jkoritzinsky]

@jtschuster can you check if this is true for NativeAOT mach-o object files as well?

[jtschuster]

It doesn't seem to be happening to the .o file from ilc when I try to repro.

[filipnavara]

ILC usually produces a section with uninitialized data (BSS) that is larger than the load command prolog. The bug in the size calculation is still present but it doesn't violate the invariant.