Test failure: baseservices/exceptions/regressions/V1/SEH/VJ/HandlerException/HandlerException.cmd

[VincentBu]

Failed in: runtime-coreclr jitstressregs-x86 20260419.1

Failed tests:

coreclr linux x64 Checked jitstressregs8_x86_noavx @ AzureLinux.3.Amd64.Open
- baseservices/exceptions/regressions/V1/SEH/VJ/HandlerException/HandlerException.cmd
coreclr windows x86 Checked jitstressregs8_x86_noavx @ Windows.10.Amd64.Open
- baseservices/exceptions/regressions/V1/SEH/VJ/HandlerException/HandlerException.cmd

Error message:

Process terminated.
Assertion failed.
state.HasAnySpinners
   at System.Threading.Lock.TryEnterSlow(Int32 timeoutMs, Int32 currentThreadId)
   at System.Threading.Lock.Enter()
   at System.Console.<get_Out>g__EnsureInitialized|26_0() in /_/src/libraries/System.Console/src/System/Console.cs:line 205
   at System.Console.WriteLine(String value) in /_/src/libraries/System.Console/src/System/Console.cs:line 860
   at HandlerException.runtest()
   at System.Threading.Thread.StartCallback(Thread* pThread)
waitpid() returned successfully (wstatus 00000000) WEXITSTATUS 0 WTERMSIG 0
/datadisks/disk1/work/ADB70908/w/A7340921/e/baseservices/exceptions/baseservices-exceptions/../regressions/V1/SEH/VJ/HandlerException/HandlerException.sh: line 432:  3510 Aborted                 (core dumped) $LAUNCHER $ExePath "${CLRTestExecutionArguments[@]}"

Return code:      1
Raw output file:      /datadisks/disk1/work/ADB70908/w/A7340921/uploads/regressions/V1/SEH/VJ/HandlerException/output.txt
Raw output:
BEGIN EXECUTION
/datadisks/disk1/work/ADB70908/p/corerun -p System.Reflection.Metadata.MetadataUpdater.IsSupported=false -p System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization=true HandlerException.dll ''
Done
Exception1 was caught by Thread 0
Exception2 was caught by Thread 0
Exception3 was caught by Thread 0
Exception4 was caught by Thread 0
Exception was caught
Exception was caught
Exception was caught
Exception4 was caught by Thread 3
Exception was caught
Exception2 was caught by Thread 1
Exception3 was caught by Thread 1
Exception4 was caught by Thread 1
Exception was caught
Exception3 was caught by Thread 2
Exception4 was caught by Thread 2
[createdump] Gathering state for process 3510 corerun
[createdump] Crashing thread 0df5 signal 6 (0006)
[createdump] Writing crash report to file /datadisks/disk1/dumps/coredump.3510.dmp.crashreport.json
[createdump] Crash report successfully written
[createdump] Writing minidump with heap to file /datadisks/disk1/dumps/coredump.3510.dmp
[createdump] Written 132206592 bytes (32277 pages) to core file
[createdump] Target process is alive
[createdump] Dump successfully written in 620ms
Expected: 100
Actual: 134
END EXECUTION - FAILED
Test Harness Exitcode is : 1
To run the test:
Set up CORE_ROOT and run.
> /datadisks/disk1/work/ADB70908/w/A7340921/e/baseservices/exceptions/baseservices-exceptions/../regressions/V1/SEH/VJ/HandlerException/HandlerException.sh

Stack trace:

   at Xunit.Assert.True(Nullable`1 condition, String userMessage) in /_/src/arcade/src/Microsoft.DotNet.XUnitAssert/src/BooleanAsserts.cs:line 135
   at Program.<<Main>$>g__TestExecutor148|0_149(StreamWriter tempLogSw, StreamWriter statsCsvSw, <>c__DisplayClass0_0&)

Kusto query result:

Queued	Pipeline	Pipeline Configuration	OS	Arch	Test	Outcome	Properties	Build Reason
2026-04-19 20:14:16.969000+00:00	runtime-coreclr jitstressregs-x86	Checked-jitstressregs8_x86_noavx	azurelinux.3.amd64.open.rt	x64	baseservices/exceptions/regressions/V1/SEH/VJ/HandlerException/HandlerException.cmd	Failed	{"DefinitionName":"runtime-coreclr jitstressregs-x86","System.StageAttempt":"1","BuildNumber":"20260419.1","Project":"public","Reason":"Schedule","architecture":"x64","configuration":"Checked-jitstressregs8_x86_noavx","operatingSystem":"AzureLinux.3.Amd64.Open","System.JobId":"6dfec640-5b96-5d95-2a5b-7c236ea2d5c5","BuildId":"1386227","System.JobAttempt":"1","AzurePipelinesTestRunId":"38718380","System.JobName":"__default","CollectionUri":"https://dev.azure.com/dnceng-public/","System.PhaseAttempt":"1","System.PhaseName":"run_test_p1__linux_x64_checked","DefinitionId":"117","System.StageName":"Build"}	Schedule

[dotnet-policy-service]

Tagging subscribers to this area: @agocke
See info in area-owners.md if you want to be subscribed.

[mangod9]

some dump analysis. @jakobbotsch please check if this might be related to your change.

- PR #125333 merged: 2026-04-19T01:05:49Z (commit 6e70a8c21132)
 - Failing build commit: 2026-04-19T18:43:26Z (commit 001b2435) — 17 hours later

The PR Fixes This Exact Class of Bug — But May Be Incomplete

PR #125333 by @jakobbotsch addresses the LSRA's handling of def-use register conflicts. The key change for cmpxchg:

 -            // for cmpxchg we need to keep the original value in RAX
 -            assert(node->GetRegNum() == REG_RAX);
              ...
 +            inst_Mov(node->TypeGet(), node->GetRegNum(), REG_RAX, /* canSkip */ true);

This adds an explicit copy from RAX to the target register. However, this change is in the genLockedInstructions
path for the cmpxchg-loop idiom (used by Interlocked.Add/Increment). The direct Interlocked.CompareExchange → 
GT_CMPXCHG intrinsic is a different code path.

Matching Bug Signatures

┌────────────────┬─────────────────────────────────────────────┬───────────────────────────────────────────────────┐
│                │ Issue #125312                               │ Issue #127131 (ours)                              │
├────────────────┼─────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ Stress mode    │ jitstressregs2, jitstressregs0x80           │ jitstressregs8                                    │
├────────────────┼─────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ Root cause     │ Register misallocation loses value          │ CAS comparand register reused for address         │
├────────────────┼─────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ Pattern        │ Value written to wrong offset (struct       │ CAS return compared with itself (comparand lost)  │
│                │ store)                                      │                                                   │
├────────────────┼─────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ LSRA issue     │ Def-use conflict on struct copy             │ Def-use conflict on cmpxchg comparand             │
├────────────────┼─────────────────────────────────────────────┼───────────────────────────────────────────────────┤
│ Fixed by PR    │ ✅ Closed by @jakobbotsch                   │ ❓ Same class, different code path                │
└────────────────┴─────────────────────────────────────────────┴───────────────────────────────────────────────────┘

What Happened in Our Case

The bug assembly shows the CAS in TryLockBeforeSpinLoop:

 leaq   0x14(%r12), %r15       ; r15 = &_state ADDRESS (overwrites comparand)
 movl   stack, %eax             ; eax = comparand
 lock cmpxchgl %ebx, (%r15)    ; CAS
 movl   %eax, %ebx             ; ebx = result
 movl   %eax, %r15d            ; r15d = result (comparand LOST from r15!)
 cmpl   %r15d, %ebx            ; result == result → ALWAYS TRUE

The LSRA assigned r15 for the &_state address, but r15 was also supposed to hold the original comparand for the
post-CAS comparison. Before PR #125333, the LSRA might have resolved this conflict by changing the use register. 
After the PR, the LSRA no longer changes use registers, but the necessary explicit copy wasn't emitted for this
pattern.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[jakobbotsch]

My change likely is related in that it exposed the issue, but the analysis does not make much sense to me. It looks more like we are missing a kill in LSRA since it seemingly thinks that eax stays live across the cmpxchg which is not the case.