JITed struct marshaler IL stub is missing a GC reference during codegen

[v-haren]

test failed in job: runtime-coreclr gcstress-extra 20200321.1

Error message

Return code: 1
Raw output file: C:\h\w\A2980975\w\A57E090D\e\Interop\PInvoke\Reports\Interop.PInvoke\BestFitMapping\LPStr\Pinvoke_False_True\Pinvoke_False_True\Pinvoke_False_True.output.txt
Raw output:
BEGIN EXECUTION
"C:\h\w\A2980975\p\corerun.exe" Pinvoke_False_True.dll 
Test Failure: TestLibrary.AssertTestException: Assert.Fail: Expected 'System.ArgumentException' to be thrown, however 'System.NullReferenceException' was thrown. [Error] Location tlpsbst3
at TestLibrary.Assert.HandleFail(String assertionName, String message) in F:\workspace\_work\1\s\src\coreclr\tests\src\Common\CoreCLRTestLibrary\Assertion.cs:line 735
at TestLibrary.Assert.Throws[T](Action action, String message, AssertThrowsOptions options) in F:\workspace\_work\1\s\src\coreclr\tests\src\Common\CoreCLRTestLibrary\Assertion.cs:line 191
at BFM_LPStrMarshaler.testLPStrBufferStruct() in F:\workspace\_work\1\s\src\coreclr\tests\src\Interop\PInvoke\BestFitMapping\LPStr\Pinvoke_False_True\Pinvoke_False_True.cs:line 206
at BFM_LPStrMarshaler.runTest() in F:\workspace\_work\1\s\src\coreclr\tests\src\Interop\PInvoke\BestFitMapping\LPStr\Pinvoke_False_True\Pinvoke_False_True.cs:line 314
at BFM_LPStrMarshaler.Main() in F:\workspace\_work\1\s\src\coreclr\tests\src\Interop\PInvoke\BestFitMapping\LPStr\Pinvoke_False_True\Pinvoke_False_True.cs:line 333
xx This is the initial test string. 
yy This is the initial test string. 
zz This is the initial test string. 
Expected: 100
Actual: 101
END EXECUTION - FAILED
FAILED
Test Harness Exitcode is : 1
To run the test:
> set CORE_ROOT=C:\h\w\A2980975\p
> C:\h\w\A2980975\w\A57E090D\e\Interop\PInvoke\BestFitMapping\LPStr\Pinvoke_False_True\Pinvoke_False_True\Pinvoke_False_True.cmd
Expected: True
Actual: False


Stack trace
   at Interop_PInvoke._BestFitMapping_LPStr_Pinvoke_False_True_Pinvoke_False_True_Pinvoke_False_True_._BestFitMapping_LPStr_Pinvoke_False_True_Pinvoke_False_True_Pinvoke_False_True_cmd() in F:\workspace\_work\1\s\artifacts\tests\coreclr\Windows_NT.x64.Checked\TestWrappers\Interop.PInvoke\Interop.PInvoke.XUnitWrapper.cs:line 5281

[v-haren]

failed again in job: runtime-coreclr gcstress-extra 20200329.1

failed test: Interop\PInvoke\BestFitMapping\LPStr\AFT_PFT\AFT_PFT\AFT_PFT.cmd

Error message

Return code: 1
Raw output file: C:\h\w\B8670A32\w\A0100948\e\Interop\PInvoke\Reports\Interop.PInvoke\BestFitMapping\LPStr\AFT_PFT\AFT_PFT\AFT_PFT.output.txt
Raw output:
BEGIN EXECUTION
"C:\h\w\B8670A32\p\corerun.exe" AFT_PFT.dll 
Test Failure: TestLibrary.AssertTestException: Assert.Fail: Expected 'System.ArgumentException' to be thrown, however 'System.NullReferenceException' was thrown. [Error] Location tlpsbaos3
at TestLibrary.Assert.HandleFail(String assertionName, String message) in F:\workspace\_work\1\s\src\coreclr\tests\src\Common\CoreCLRTestLibrary\Assertion.cs:line 735
at TestLibrary.Assert.Throws[T](Action action, String message, AssertThrowsOptions options) in F:\workspace\_work\1\s\src\coreclr\tests\src\Common\CoreCLRTestLibrary\Assertion.cs:line 191
at BFM_LPStrMarshaler.testLPStrBufferArrayOfStructs() in F:\workspace\_work\1\s\src\coreclr\tests\src\Interop\PInvoke\BestFitMapping\LPStr\AFT_PFT\AFT_PFT.cs:line 289
at BFM_LPStrMarshaler.Main() in F:\workspace\_work\1\s\src\coreclr\tests\src\Interop\PInvoke\BestFitMapping\LPStr\AFT_PFT\AFT_PFT.cs:line 334
xx This is the initial test string. 
yy This is the initial test string. 
zz This is the initial test string. 
This is the initial test string. 
This is the initial test string. 
This is the initial test string. 
This is the initial test string. 
This is the initial test string. 
This is the initial test string. 
This is the initial test string. 
This is the initial test string. 
This is the initial test string. 
** This is the initial test string. 
** This is the initial test string. 
Expected: 100
Actual: 101
END EXECUTION - FAILED
FAILED
Test Harness Exitcode is : 1
To run the test:
> set CORE_ROOT=C:\h\w\B8670A32\p
> C:\h\w\B8670A32\w\A0100948\e\Interop\PInvoke\BestFitMapping\LPStr\AFT_PFT\AFT_PFT\AFT_PFT.cmd
Expected: True
Actual: False


Stack trace
   at Interop_PInvoke._BestFitMapping_LPStr_AFT_PFT_AFT_PFT_AFT_PFT_._BestFitMapping_LPStr_AFT_PFT_AFT_PFT_AFT_PFT_cmd() in F:\workspace\_work\1\s\artifacts\tests\coreclr\Windows_NT.x64.Checked\TestWrappers\Interop.PInvoke\Interop.PInvoke.XUnitWrapper.cs:line 3729

[AaronRobinsonMSFT]

Able to reproduce this locally will investigate further.

@jkoritzinsky for below.

There appears to be another much worse issue here. Running the AFT_PFT.dll test with COMPlus_GCStress=0xC and commenting out the below in AFT_PFT.cs causes an assert in Checked builds. The assert appears to be related to struct marshaling and is occurring in the generated IL Stubs when attempting to call Ole32.CoTaskMemFree. This doesn't occur in Debug builds.

    static void runTest()
    {
        // testLPStrBufferString();
        // testLPStrBufferStringBuilder();
        // testLPStrBufferStruct();
        // testLPStrBufferArray();
        // testLPStrBufferClass();
        testLPStrBufferArrayOfStructs();
    }

Struct to marshal:

[StructLayout(LayoutKind.Sequential)]
[BestFitMapping(false, ThrowOnUnmappableChar = true)]
public struct LPStrTestStruct
{
    [MarshalAs(UnmanagedType.LPStr)]
    public String str;
}

Assert failure(PID 1548 [0x0000060c], Thread: 15456 [0x3c60]): pMD->ShouldSuppressGCTransition() || pThread->GetFrame()->GetVTablePtr() == InlinedCallFrame::GetMethodFrameVPtr()

CORECLR! NDirectImportWorker + 0x1C3 (0x00007fff`a5de6ab3)
CORECLR! NDirectImportThunk + 0x43 (0x00007fff`a5df0903)
<no module>! <no symbol> + 0x0 (0x00007fff`467488b1)
    File: D:\runtime\src\coreclr\src\vm\dllimport.cpp Line: 7249
    Image: D:\runtime\artifacts\tests\coreclr\Windows_NT.x64.Checked\Tests\Core_Root\corerun.exe

 	coreclr.dll!DbgAssertDialog(const char * szFile, int iLine, const char * szExpr) Line 691	C++
>	coreclr.dll!NDirectImportWorker(NDirectMethodDesc * pMD) Line 7249	C++
 	coreclr.dll!NDirectImportThunk() Line 198	Unknown
 	00007fff467488b1()	Unknown
 	coreclr.dll!CallDescrWorkerInternal() Line 101	Unknown
 	coreclr.dll!DispatchCallSimple(unsigned __int64 * pSrc, unsigned long numStackSlotsToCopy, unsigned __int64 pTargetAddress, unsigned long dwDispatchCallSimpleFlags) Line 227	C++
 	coreclr.dll!MarshalStructViaILStubCode(unsigned __int64 pStubCode, void * pManagedData, void * pNativeData, StructMarshalStubs::MarshalOperation operation, void * * ppCleanupWorkList) Line 7198	C++
 	coreclr.dll!OleVariant::MarshalNonBlittableRecordArrayComToOle(REF<ArrayBase> * pComArray, void * oleArray, MethodTable * pInterfaceMT, int fBestFitMapping, int fThrowOnUnmappableChar, int fOleArrayIsValid, unsigned __int64 cElements, unsigned __int64 pManagedMarshalerCode) Line 2110	C++
 	coreclr.dll!OleVariant::MarshalRecordArrayComToOle(REF<ArrayBase> * pComArray, void * oleArray, MethodTable * pElementMT, int fBestFitMapping, int fThrowOnUnmappableChar, int fOleArrayIsValid, unsigned __int64 cElements, unsigned __int64 pManagedMarshalerCode) Line 2729	C++
 	coreclr.dll!MngdNativeArrayMarshaler::ConvertContentsToNative(MngdNativeArrayMarshaler * pThis, OBJECTREF * pManagedHome, void * * pNativeHome) Line 4404	C++

[AaronRobinsonMSFT]

This appears to be an issue with tracking GC references during codegen. The issue manifests in this test as an incorrect exception being thrown (i.e. NullReferenceException instead of ArgumentException). The NullReferenceException is thrown from within the generated marshal IL stub during the expected call to ExceptionDispatchInfo.Throw(), but the ExceptionDispatchInfo reference is lost during the GC stress operation and thus considered "null" hence NullReferenceException is thrown.

The error can be observed in this test by building a CHK version of coreclr and setting COMPlus_GCStress=0xC - JITStress is not needed. The incorrectly generated function is an IL stub and the JIT Dump for that can be collected by setting COMPlus_JitDump=IL_STUB_StructMarshal.

From within the JIT dump log the following indicates the issue:

IG8 tracks the V05 which is the ExceptionDispatchInfo instance of interest.
IG08, GCvars=0000000000000080 {V05}, gcrefRegs=00000000 {}, byrefRegs=00000000 {}

The later emitted code lacks this tracking:
G_M2693_IG08: ; offs=0000F8H, size=0010H, bbWeight=1 PerfScore 4.25, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, byref, is

A snippet of the problem scenario is below.

G_M2693_IG07:        ; offs=0000E1H, size=0017H, bbWeight=1    PerfScore 8.00, isz, extend

IN0030: 0000E1 mov      rdx, qword ptr [V13 rbp-40H]
IN0031: 0000E5 mov      byte  ptr [rdx+12], 1
IN0032: 0000E9 cmp      dword ptr [(reloc 0x7fff9b0a65b0)], 0
IN0033: 0000F0 je       SHORT G_M2693_IG08
IN0034: 0000F2 call     [CORINFO_HELP_STOP_FOR_GC]

// Object V05 is valid

// The following is inserted by GC stress
hlt
adc     eax, 5FF79CB8h

// Object at V05 is invalid at this point

G_M2693_IG08:        ; offs=0000F8H, size=0010H, bbWeight=1    PerfScore 4.25, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, byref, isz

IN0035: 0000F8 mov      rcx, qword ptr [V01 rbp+18H]
IN0036: 0000FC xor      eax, eax
IN0037: 0000FE mov      qword ptr [rcx], rax
IN0038: 000101 cmp      gword ptr [V05 rbp-48H], 0
IN0039: 000106 jne      SHORT G_M2693_IG11

G_M2693_IG11:        ; offs=000130H, size=000AH, bbWeight=0    PerfScore 0.00, gcVars=0000000000000080 {V05}, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, gcvars, byref

IN003f: 000130 mov      rcx, gword ptr [V05 rbp-48H]
IN0040: 000134 call     System.Runtime.ExceptionServices.ExceptionDispatchInfo:Throw():this
IN0041: 000139 int3

For completeness the generated IL stub is below.

void()" StubMethodSignature="void(LPStrTestStruct /* MT: 0x00007FFF4257EEB8 */&,LPStrTestStruct_NativeValueType /* MT: 0x00007FFF4257EEB8 */*,int32,System.StubHelpers.CleanupWorkListElement /* MT: 0x00007FFF425AAE80 */&)" StubMethodILCode="// Code size	142 (0x008e)
    .maxstack 3 
    .locals (int32,System.Runtime.ExceptionServices.ExceptionDispatchInfo /* MT: 0x00007FFF425AB690 */,string&,native int&,native int,string)
    // Initialize {
             /*( 0)*/ ldnull           
             /*( 1)*/ stloc.1          
             /*( 0)*/ nop             // field setup { 
             /*( 0)*/ nop             // managed field setup { 
             /*( 0)*/ ldarg.0          
             /*( 1)*/ ldc.i4.0         
             /*( 2)*/ add              
             /*( 1)*/ stloc.2          
             /*( 0)*/ nop             // } managed field setup 
             /*( 0)*/ nop             // native field setup { 
             /*( 0)*/ ldarg.1          
             /*( 1)*/ ldc.i4.0         
             /*( 2)*/ add              
             /*( 1)*/ stloc.3          
             /*( 0)*/ nop             // } native field setup 
             /*( 0)*/ nop             // } field setup 
             /*( 0)*/ nop             // marshal operation jump table { 
             /*( 0)*/ ldarg.2          
             /*( 1)*/ ldc.i4.0         
             /*( 2)*/ beq             IL_0029 
             /*( 0)*/ ldarg.2          
             /*( 1)*/ ldc.i4.1         
             /*( 2)*/ beq             IL_005b 
             /*( 0)*/ ldarg.2          
             /*( 1)*/ ldc.i4.2         
             /*( 2)*/ beq             IL_0072 
             /*( 0)*/ nop             // } marshal operation jump table 
    // } Initialize 
    // Marshal {
             /*( 0)*/ ldc.i4.0         
             /*( 1)*/ stloc.0          
    IL_0029: /*( 0)*/ ldarg.1          
             /*( 1)*/ ldc.i4.0         
             /*( 2)*/ ldc.i4.8         
             /*( 3)*/ initblk          
             /*( 0)*/ nop             // field {  
             /*( 0)*/ ldc.i4          0x100 
             /*( 1)*/ ldloc.2          
             /*( 2)*/ unaligned.      0x1 
             /*( 2)*/ ldind.ref        
             /*( 2)*/ ldc.i4.0         
             /*( 3)*/ conv.i           
             /*( 3)*/ call            native int [System.Private.CoreLib] System.StubHelpers.CSTRMarshaler::ConvertToNative(int32,string,native int) 
             /*( 1)*/ stloc.s         0x4 
             /*( 0)*/ ldloc.3          
             /*( 1)*/ ldloc.s         0x4 
             /*( 2)*/ unaligned.      0x1 
             /*( 2)*/ stind.i          
             /*( 0)*/ nop             // } field 
             /*( 0)*/ leave           IL_005a 
    IL_004f: /*( 0)*/ call            class System.Runtime.ExceptionServices.ExceptionDispatchInfo [System.Private.CoreLib] System.Runtime.ExceptionServices.ExceptionDispatchInfo::Capture(class System.Exception) 
             /*( 1)*/ stloc.1          
             /*( 0)*/ leave           IL_0072 
    IL_005a:
    // } Marshal 
    // CallMethod {
    IL_005a: /*( 0)*/ ret              
    // } CallMethod 
    // Unmarshal {
    IL_005b: /*( 0)*/ nop             // field {  
             /*( 0)*/ ldloc.3          
             /*( 1)*/ unaligned.      0x1 
             /*( 1)*/ ldind.i          
             /*( 1)*/ call            string [System.Private.CoreLib] System.StubHelpers.CSTRMarshaler::ConvertToManaged(native int) 
             /*( 1)*/ stloc.s         0x5 
             /*( 0)*/ ldloc.2          
             /*( 1)*/ ldloc.s         0x5 
             /*( 2)*/ unaligned.      0x1 
             /*( 2)*/ stind.ref        
             /*( 0)*/ nop             // } field 
             /*( 0)*/ ret              
             /*( 0)*/ ret              
    // } Unmarshal 
    // Cleanup {
    IL_0072: /*( 0)*/ ldloc.3          
             /*( 1)*/ unaligned.      0x1 
             /*( 1)*/ ldind.i          
             /*( 1)*/ call            void [System.Private.CoreLib] System.StubHelpers.CSTRMarshaler::ClearNative(native int) 
             /*( 0)*/ ldarg.1          
             /*( 1)*/ ldc.i4.0         
             /*( 2)*/ ldc.i4.8         
             /*( 3)*/ initblk          
             /*( 0)*/ ldloc.1          
             /*( 1)*/ brfalse         IL_005a 
             /*( 0)*/ ldloc.1          
             /*( 1)*/ call            instance void [System.Private.CoreLib] System.Runtime.ExceptionServices.ExceptionDispatchInfo::Throw() 
             /*( 1)*/ ret              
    // } Cleanup 
    .try IL_0029 to IL_004f catch handler IL_004f to IL_005a

/cc @dotnet/jit-contrib @BruceForstall

[AndyAyersMS]

@AaronRobinsonMSFT did this get fixed? It is no longer failing.

[AaronRobinsonMSFT]

@AndyAyersMS I was not involved in any fix here. I did some investigations, but wasn't able to determine exactly what was wrong. I guess it is possible it is fixed. I can send you the offline thread with some additional details - they are a bit much to paste here.

[AndyAyersMS]

I've been trying to repro locally with no success, and the full test is now passing in CI. Wonder if this might have been fixed via #35026?

Am going to close.