.NET 7 JIT Crash when referencing struct of particular shape: Fatal error. Internal CLR error. (0x80131506) #80624
Comments
|
Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch, @kunalspathak Issue DetailsDescriptionReferencing a ref struct with explicit layout, containing a ref struct, containing a struct, containing a value crashes the JIT in the importer phase when jitting the method containing that reference. Reproduction Stepsusing System.Runtime.InteropServices;
Console.WriteLine("Testing for crash.");
FailsToJit();
Console.WriteLine("Did not crash.");
static void FailsToJit()
{
// any reference (direct or indirect) to godot_variant will crash in during JIT import when resolving the type token
// loading a function pointer using the type, sizeof(), ... all crash in basically the same way
void Test(godot_variant arg) { }
Test(default);
}
[StructLayout(LayoutKind.Explicit)]
public ref struct godot_variant
{
[FieldOffset(0)] // offset doesn't matter
private godot_variant_data _data;
private ref struct godot_variant_data
{
private godot_variant_data_mem _mem;
public struct godot_variant_data_mem
{
private float _mem0; // also happens for int here
}
}
}Expected behaviorProgram runs to completion, printing two lines to console. Actual behaviorThe program crashes with the following output when trying to execute Native Backtrace: Native debugging message: It varies depending on how the type is used, but it always ends at a call Regression?Yes, when changing the target framework to net6.0 the same code does not crash and executes successfully. Known WorkaroundsRemoving about anything from the MRP makes the crash go away. ConfigurationOn Windows 10 x64 versions: On Linux Ubuntu 22.04.1 x64 version Other informationNo response
|
|
Seems to be VM issue? |
|
cc @AaronRobinsonMSFT @jkotas @jkoritzinsky does it ring a bell? |
|
This is entirely possible a mistake was made in this area for ref fields. @EgorBo The above is an assert, can you remove that and see if there is a deeper issue that clarifies the issue further.
Edit 7 to 6. Missed the title. |
|
This is crashing because we are using invalid data after the assert. I think this is fallout of #65246. I will take a look next week. |
|
Correction. I think this is a simple fix. I've put up #80642 to test the existing tests. Once I have some sanity beyond my local testing I will additional tests. |
|
@RedworkDE This work has been merged into the 7.0 release branch. It will be going out in the next servicing update. |
Description
Referencing a ref struct with explicit layout, containing a ref struct, containing a struct, containing a value crashes the JIT in the importer phase when jitting the method containing that reference.
Reproduction Steps
Expected behavior
Program runs to completion, printing two lines to console.
Actual behavior
The program crashes with the following output when trying to execute
FailsToJit.Native Backtrace:
Native debugging message:
It varies depending on how the type is used, but it always ends at a call
info.compCompHnd->xxx()with a type token as one of the arguments.I think execution should continue in
coreclr.dllat this point, but i am unable to get visual studio to step into that call, or to execute the program with a debug build of coreclrRegression?
Yes, when changing the target framework to net6.0 the same code does not crash and executes successfully.
Known Workarounds
Removing about anything from the MRP makes the crash go away.
Configuration
On Windows 10 x64 versions:
.NET 7.0.2 - d099f07
.NET 7.0.0 - d037e07
On Linux Ubuntu 22.04.1 x64 version
.NET 7.0.2 - d037e07
Other information
No response
The text was updated successfully, but these errors were encountered: