[wasm][aot] Test failure - `System.Runtime.InteropServices.JavaScript.Tests.MarshalTests.MarshalPrimitivesToCS`

[radical]

Hitting on rolling builds. Build, and log:

[10:11:49] fail: [FAIL] System.Runtime.InteropServices.JavaScript.Tests.MarshalTests.MarshalPrimitivesToCS
[10:11:49] info: Assert.Equal() Failure
[10:11:49] info: Expected: 99
[10:11:49] info: Actual:   73014444131
[10:11:49] info:    at System.Reflection.RuntimeMethodInfo.InvokeNonEmitUnsafe(Object , IntPtr* , Span`1 , BindingFlags )
[10:11:49] fail: exception thrown in [System.Private.Runtime.InteropServices.JavaScript.Tests]System.Runtime.InteropServices.JavaScript.Tests.HelperMarshal:InvokeReturnLong

cc @vargaz @kg @pavelsavara

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Hitting on rolling builds. Build, and log:

[10:11:49] fail: [FAIL] System.Runtime.InteropServices.JavaScript.Tests.MarshalTests.MarshalPrimitivesToCS
[10:11:49] info: Assert.Equal() Failure
[10:11:49] info: Expected: 99
[10:11:49] info: Actual:   73014444131
[10:11:49] info:    at System.Reflection.RuntimeMethodInfo.InvokeNonEmitUnsafe(Object , IntPtr* , Span`1 , BindingFlags )
[10:11:49] fail: exception thrown in [System.Private.Runtime.InteropServices.JavaScript.Tests]System.Runtime.InteropServices.JavaScript.Tests.HelperMarshal:InvokeReturnLong

cc @vargaz @kg @pavelsavara

Author:	radical
Assignees:	-
Labels:	arch-wasm, blocking-clean-ci, area-Codegen-AOT-mono, test-failure
Milestone:	-

[vargaz]

Note that the failure only happens with AOT.

[kg]

This is heap corruption, something is trashing the buffer used by bindings invoke and that buffer is created using _malloc. We typically reuse the buffer if it's for a bound method, but if it's a one-off call we will allocate it on every call.
If I switch to stackAlloc for the buffer the crash goes away, so I'm considering doing that for now (it's worthwhile to stack alloc the buffer anyway), but we should figure out how to investigate the heap corruption that's happening here.

[pavelsavara]

I found issue dealing with negative int52 but it's probably unrelated as in this issue the value is random and my issue is deterministic. Edit: Not sure about that anymore