Add support for type preinitialization in crossgen2 by hez2010 · Pull Request #124568 · dotnet/runtime

hez2010 · 2026-02-18T19:29:08Z

Type preinitialization for R2R bringing up

This PR brings type preinitialization support (already used by NativeAOT) to ReadyToRun.

With this change, eligible type static constructors can be interpreted at compile time, and the resulting static state is serialized into the R2R native format. At runtime, preinitialized types can skip normal class-init execution when validation succeeds, and materialize the preinitialized data directly without needs of running the cctor.

For easier context and details, please read the design doc:https://github.com/hez2010/runtime/blob/bcc30a083c8f7a2df504cf37d2079bec049c36de/docs/design/features/readytorun-preinitialized-statics.md

Benchmarks

I have tested several scenarios with composite R2R on self-contained apps, without trimming.

Note that I forgot to regenerate r2r images for the baseline so that the r2r code was skipped for baseline. I'll update the benchmark result with new numbers.

Avalonia app

I measured the time from startup to the window loaded. Startup time goes from 523ms to 299ms on my machine, which is a 43% startup time reduction. With TC=0, it boosts the startup time from 927ms to 340ms, which is a 63% reduction.

The size regression is about 0.8% (144mb vs 146mb).

Blazor SSR

I also measured the time from startup to the first page rendered. Without preinitializer it took 1050ms with TC=1, and 1733ms with TC=0, while with preinitializer, it reduced to 901ms and 1299ms, respectively.

The size regression is about 0.9% (252mb vs 254mb).

cc: @jkoritzinsky

Copilot

Pull request overview

This PR brings NativeAOT-style type preinitialization to ReadyToRun (crossgen2), enabling eligible .cctor bodies to be interpreted at compile time and the resulting static state to be serialized into the R2R image. At runtime, validated preinitialized types can skip normal class-init and materialize precomputed non-GC/GC static state directly.

Changes:

Introduces a new R2R section (TypePreinitializationMap, format v18.2) and corresponding compiler emission (map + serialized static payload/object templates).
Adds runtime support to detect preinitialized types, fetch serialized static payloads, and materialize GC graphs during static allocation.
Adds crossgen2 switches to enable/disable preinit statics and adds r2rdump support to display the new section.

Reviewed changes

Copilot reviewed 33 out of 33 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/coreclr/vm/readytoruninfo.h	Declares `ReadyToRun_TypePreinitializationMap` for runtime map queries.
src/coreclr/vm/readytoruninfo.cpp	Loads the new section and implements map lookup helpers.
src/coreclr/vm/methodtable.h	Adds MethodTable helpers for applying/materializing preinitialized static data.
src/coreclr/vm/methodtable.cpp	Implements copying/fixups for non-GC statics and GC graph materialization from templates.
src/coreclr/vm/ceeload.h	Adds `Module` APIs for preinit queries and payload retrieval.
src/coreclr/vm/ceeload.cpp	Implements runtime payload resolution and bounds validation for preinit static data.
src/coreclr/tools/r2rdump/TextDumper.cs	Adds dumping/diagnostics for the `TypePreinitializationMap` section.
src/coreclr/tools/aot/crossgen2/Properties/Resources.resx	Adds help text for new crossgen2 switches.
src/coreclr/tools/aot/crossgen2/Program.cs	Wires up preinitialization manager based on optimization/flags and logs stats.
src/coreclr/tools/aot/crossgen2/Crossgen2RootCommand.cs	Adds `--preinitstatics` / `--nopreinitstatics` switches.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/JitInterface/CorInfoImpl.ReadyToRun.cs	Skips compiling `.cctor` for types proven preinitialized; treats them as pre-inited.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/ILCompiler.ReadyToRun.csproj	Includes new compiler nodes and preinit-related sources.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/ReadyToRunCodegenCompilationBuilder.cs	Plumbs `PreinitializationManager` into the R2R compilation pipeline.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/ReadyToRunCodegenCompilation.cs	Passes preinit manager through component rewrite path.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/Preinitialization/ReadyToRunPreinitializationManager.cs	New: caches per-type preinit records and manages imports/object templates.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/Preinitialization/PreinitializationExtensions.cs	New: R2R-specific symbol/dependency hooks for serialized templates and delegate targets.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/Preinitialization/DelegateCreationInfo.ReadyToRun.cs	New: R2R-specific delegate creation/target node resolution for serialization.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/DependencyAnalysis/ReadyToRunSymbolNodeFactory.cs	Triggers preinit record materialization when emitting static base helpers.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/DependencyAnalysis/ReadyToRunCodegenNodeFactory.cs	Adds preinit import section and emits the new header table section.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/DependencyAnalysis/ReadyToRun/TypePreinitializedStaticsDataNode.cs	New: emits per-type serialized non-GC + GC static payload and boxed-static templates.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/DependencyAnalysis/ReadyToRun/TypePreinitializationMapNode.cs	New: emits the new map section (typedef + instantiation table + signature blob).
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/DependencyAnalysis/ReadyToRun/SerializedPreinitializationObjectDataNode.cs	New: emits serialized object templates with reloc-driven dependencies.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/DependencyAnalysis/ReadyToRun/MethodFixupSignature.cs	Adjusts method entry fixup optimization eligibility (accounts for unboxing).
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/Dataflow/FlowAnnotations.cs	New: R2R-local FlowAnnotations stub for preinit plumbing under READYTORUN.
src/coreclr/tools/aot/ILCompiler.Compiler/Compiler/TypePreinit.cs	Adds READYTORUN-specific delegate/object serialization layout and post-scan failure downgrade.
src/coreclr/tools/aot/ILCompiler.Compiler/Compiler/PreinitializationManager.cs	Adds READYTORUN FlowAnnotations aliasing.
src/coreclr/tools/Common/Internal/Runtime/ReadyToRunConstants.cs	Adds `ReadyToRunTypePreinitializationFlags`.
src/coreclr/tools/Common/Internal/Runtime/ModuleHeaders.cs	Bumps R2R minor version and adds new section enum value.
src/coreclr/tools/Common/Compiler/ObjectWriter/ObjectWriter.cs	Tweaks progress reporting behavior.
src/coreclr/nativeaot/Runtime/inc/ModuleHeaders.h	Bumps R2R minor version to match tools/runtime.
src/coreclr/jit/helperexpansion.cpp	Loosens assert to allow additional import address types in static init expansion.
src/coreclr/inc/readytorun.h	Bumps R2R minor version and defines the new section + map entry structs.
docs/design/features/readytorun-preinitialized-statics.md	New design doc describing format, enabling, and runtime behavior.

...s/aot/ILCompiler.ReadyToRun/Compiler/Preinitialization/ReadyToRunPreinitializationManager.cs

src/coreclr/tools/Common/Compiler/ObjectWriter/ObjectWriter.cs

Copilot · 2026-02-18T19:38:26Z

src/coreclr/tools/r2rdump/TextDumper.cs


 using System;
 using System.Collections.Generic;
+using System.Drawing;


using System.Drawing; appears unused in this file. With TreatWarningsAsErrors enabled in the repo, the unnecessary using will fail the build (CS8019). Remove it unless you’re about to use System.Drawing types here.

Suggested change

using System.Drawing;

Copilot · 2026-02-18T19:38:26Z

src/coreclr/tools/r2rdump/TextDumper.cs

+                        uint computedGCStart = nonGCRva + alignedNonGCSize;
+                        uint nextPayloadStart = 0;
+                        for (int i = 0; i < sortedPayloadStarts.Count; i++)
+                        {
+                            uint payloadStart = sortedPayloadStarts[i];
+                            if (payloadStart > nonGCRva)
+                            {
+                                nextPayloadStart = payloadStart;
+                                break;
+                            }
+                        }
+
+                        uint size = nextPayloadStart == 0 ? (uint)_r2r.TargetPointerSize : nextPayloadStart - computedGCStart;
+                        if ((size % pointerSize) != 0)
+                        {
+                            reason = $"size {size} is not pointer-size aligned";
+                            return false;
+                        }
+


TryComputeGCDataRange picks nextPayloadStart based on payloadStart > nonGCRva, but the GC payload starts at computedGCStart (nonGCRva + alignedNonGCSize). If the next payload start is between nonGCRva and computedGCStart (possible in malformed/overlapping images), nextPayloadStart - computedGCStart will underflow and produce a huge gcSize, potentially causing r2rdump to read out of bounds. Consider selecting the first payloadStart strictly greater than computedGCStart and validating nextPayloadStart >= computedGCStart before subtracting.

Copilot · 2026-02-18T19:38:26Z

src/coreclr/vm/methodtable.cpp

+            PTR_TADDR pPointerField = dac_cast<PTR_TADDR>(pFieldAddress);
+            *pPointerField = ResolveReadyToRunEncodedPointer(*pPointerField);


Pointer-like fields in value types can be unaligned (e.g., explicit layout / packing). This code reads and writes them via PTR_TADDR dereference, which can fault on architectures that require alignment. Use unaligned access helpers (e.g., GET_UNALIGNED_PTR/SET_UNALIGNED_PTR or equivalent) when loading/storing pointer-sized values from raw value-type data.

Suggested change

PTR_TADDR pPointerField = dac_cast<PTR_TADDR>(pFieldAddress);

*pPointerField = ResolveReadyToRunEncodedPointer(*pPointerField);

UNALIGNED TADDR* pPointerField = reinterpret_cast<UNALIGNED TADDR*>(pFieldAddress);

TADDR pointerValue = *pPointerField;

pointerValue = ResolveReadyToRunEncodedPointer(pointerValue);

*pPointerField = pointerValue;

Copilot · 2026-02-18T19:38:26Z

src/coreclr/vm/methodtable.cpp

+
+        if (pField->IsObjRef())
+        {
+            TADDR encodedFieldReference = VolatileLoadWithoutBarrier(dac_cast<PTR_SIZE_T>(pTemplateFieldAddress));


This reads an encoded object reference from pTemplateFieldAddress via dac_cast<PTR_SIZE_T> and dereference. For value types with packing/explicit layout, reference fields may be unaligned, so this should use an unaligned read helper (e.g., GET_UNALIGNED_PTR) to avoid alignment faults on some architectures.

Suggested change

TADDR encodedFieldReference = VolatileLoadWithoutBarrier(dac_cast<PTR_SIZE_T>(pTemplateFieldAddress));

TADDR encodedFieldReference = VolatileLoadWithoutBarrier(GET_UNALIGNED_PTR(TADDR, pTemplateFieldAddress));

Copilot · 2026-02-18T19:38:27Z

src/coreclr/vm/methodtable.cpp

+                PTR_TADDR pPointerFieldAddress = dac_cast<PTR_TADDR>(pFieldAddress);
+                *pPointerFieldAddress = ResolveReadyToRunEncodedPointer(*pPointerFieldAddress);


Non-GC static data fixup writes pointer-like statics via PTR_TADDR dereference. If the static field layout includes unaligned pointer-sized fields (possible with explicit layout/pack), this can cause unaligned stores. Consider using unaligned load/store helpers for pointer-sized fields here as well.

Suggested change

PTR_TADDR pPointerFieldAddress = dac_cast<PTR_TADDR>(pFieldAddress);

*pPointerFieldAddress = ResolveReadyToRunEncodedPointer(*pPointerFieldAddress);

TADDR pointerFieldValue;

memcpy(&pointerFieldValue, pFieldAddress, sizeof(TADDR));

pointerFieldValue = ResolveReadyToRunEncodedPointer(pointerFieldValue);

memcpy(pFieldAddress, &pointerFieldValue, sizeof(TADDR));

jkotas · 2026-02-18T21:44:11Z

Startup time goes from 523ms to 299ms on my machine, which is a 43% startup time reduction

This sounds too good to be true. Can you share more detailed breakdown where this startup time reduction actually came from?

docs/design/features/readytorun-preinitialized-statics.md

...piler.ReadyToRun/Compiler/DependencyAnalysis/ReadyToRun/TypePreinitializedStaticsDataNode.cs

jkoritzinsky · 2026-02-18T23:09:32Z

...ools/aot/ILCompiler.ReadyToRun/Compiler/Preinitialization/DelegateCreationInfo.ReadyToRun.cs

+        private bool TargetMethodIsUnboxingThunk
+            => PossiblyUnresolvedTargetMethod.OwningType.IsValueType && !PossiblyUnresolvedTargetMethod.Signature.IsStatic;


This seems like a heuristic. Can we get a comment here about why this is always true or do a type check against the unboxing method desc type(s)?

This is mirrored from ilc:

runtime/src/coreclr/tools/aot/ILCompiler.Compiler/Compiler/DelegateCreationInfo.cs

Line 67 in 2af34ab

return TargetMethod.OwningType.IsValueType && !TargetMethod.Signature.IsStatic;

jkoritzinsky · 2026-02-18T23:14:03Z

...s/aot/ILCompiler.ReadyToRun/Compiler/Preinitialization/ReadyToRunPreinitializationManager.cs

+        private void RootStaticsDataNode(TypePreinitializationRecord record)
+        {
+            if (record?.StaticsDataNode != null)
+            {
+                _factory.AddCompilationRoot(record.StaticsDataNode, "ReadyToRun preinitialized statics data");
+            }
+        }


Instead of rooting the statics data node as a compilation root here, can we get it added as a dependency of the class constructor's method node?

For cases where we'd skip compilation in our various root providers, we can root the statics data there as well.

Alternatively, you can make this type an ICompilationRootProvider (and extend IRootingServiceProvider with a void AddCompilationRoot(object o, string reason) method like ILC has).

I don't see an obvious way to refactor this. Either seems to complicate things because instantiated preinit types can be discovered lazily after the dependency analysis done, that's why we need to manually root those static data nodes (for instantiations).

jkoritzinsky · 2026-02-18T23:14:59Z

.../tools/aot/ILCompiler.ReadyToRun/Compiler/DependencyAnalysis/ReadyToRunCodegenNodeFactory.cs

+        internal void AddCompilationRoot(DependencyNodeCore<NodeFactory> node, string reason)
+        {
+            _graph?.AddRoot(node, reason);
+        }
+


Let's look at ways to avoid adding this method (and storing the graph in the node factory as a field).

src/coreclr/tools/aot/ILCompiler.ReadyToRun/ILCompiler.ReadyToRun.csproj

hez2010 · 2026-02-19T00:18:01Z

Startup time goes from 523ms to 299ms on my machine, which is a 43% startup time reduction

This sounds too good to be true. Can you share more detailed breakdown where this startup time reduction actually came from?

Meh... I have to awkwardly admit that I just realized that I was using corerun to run the baseline without regenerating the image, so actually prejit code was actually skipped due to r2r version mismatch.

Update the new numbers:

Avalonia:

Baseline: 311ms
PR: 299ms
Improvement: 3%

ASP.NET Core Blazor SSR:

Baseline: 917.2818 ms
PR: 916.5541ms
Improvement: no meaningful difference

Sorry for the hype...

The above numbers are from i7-13700K. I think there will be more diff on low-end devices and apps that do heavy things in cctor like cswinrt 3.0, but I don't have the environment to test those cases.

jkotas · 2026-02-19T00:30:16Z

Baseline: 311ms
PR: 299ms
Improvement: 3%

This is still on the high side of what I would expect from this change. How accurate are these numbers? Can you share more detailed breakdown of where the improvement came from?

hez2010 · 2026-02-19T00:38:56Z

Baseline: 311ms
PR: 299ms
Improvement: 3%

This is still on the high side of what I would expect from this change. How accurate are these numbers? Can you share more detailed breakdown of where the improvement came from?

As for Avalonia, I record a DateTime at the entrypoint Main, then record another at the OnAttachedToVisualTree of a control I put on the MainWindow, then print the diff of two DateTimes as the result. Baseline and PR were both run for 5 times on Windows, and the lowest number was taken as the result.

From the crossgen2 verbose log I see 4482 out of 7957 types were preinitialized.

Maybe I need to switch to a Linux environment for more accurate measurement? Do we have any performance test suite for startup time?

hez2010 · 2026-02-19T01:01:52Z

Also, there're still some room need to explore.

For example, the preinitialized objects can be allocated on FOH, also the JIT can take advantage of it to skip classIsInit check etc.

jkotas · 2026-02-19T01:38:31Z

I have doubts that the pre-initialization would be a material win for R2R in its current state. It is a tradeoff between the cost of pre-initialized data lookup and application vs. cost of. finding and running the static constructor code (+ saving some static constructor probes). These costs are very small compared to the total R2R overhead (loading all types, etc.).

I think that the best way to optimize R2R is by fixing bugs and local inefficiencies (#124519 is a good example). My guess is that we have quite a few of those. For larger new features, focus on the most expensive things (likely type loading).

jkoritzinsky · 2026-02-19T02:10:36Z

I think this may be an interesting win for our mobile platforms but we definitely need numbers for those platforms before taking the change.

docs/design/features/readytorun-preinitialized-statics.md

jkotas · 2026-02-19T04:48:02Z

an interesting win for our mobile platforms

Why would it be more interesting for mobile platforms? Overall R2R perf characteristics on mobile platforms should not be significantly different.

jkoritzinsky · 2026-02-19T06:03:34Z

We're still lagging behind Mono's startup performance as of the last measurements I saw and this would be an optimization that doesn't exist in Mono's AOT story.

Additionally, I expect that the interop tooling and MAUI code will be more similar to the Avalonia case and provide a more consistent win across the experiences our customers care about for those platforms than platforms that have more server-focused experiences. Once again, this depends on actual numbers.

hez2010 · 2026-02-19T06:48:04Z

If we have things like extensive vtbl population inside the cctor (eg. a bunch of code that takes function pointers and save them into a struct) like what CsWinRT 3.0 does, I think preinitializing them would be a great improvement.

jkotas · 2026-02-19T11:08:34Z

Avalonia case

I would like to understand where the saving is actually coming from in the Avalonia case. I suspect that the saving is caused by a second order effect and we can achieve the same saving by bug-fix level changes, without adding a new complicated structure to R2R format.

If we have things like extensive vtbl population inside the cctor (eg. a bunch of code that takes function pointers and save them into a struct) like what CsWinRT 3.0 does,

The problem is that R2R does type loading at runtime, and so these function pointers cost a very non-trivial number of instructions to hydrate at runtime. You are saving close to nothing by avoiding the few instructions that deal with writing the function pointer into the vtbl.

Co-authored-by: Jeremy Koritzinsky <jkoritzinsky@gmail.com>

jkotas · 2026-02-19T11:14:08Z

We're still lagging behind Mono's startup performance as of the last measurements I saw

FWIW, the last numbers that I have seen show that CoreCLR is better than Mono (for real apps, on iOS).

Copilot

Pull request overview

Copilot reviewed 32 out of 32 changed files in this pull request and generated 4 comments.

Copilot · 2026-02-19T11:17:15Z

src/coreclr/vm/readytoruninfo.cpp

+        PCCOR_SIGNATURE pSignature = reinterpret_cast<PCCOR_SIGNATURE>(pSignatureBlob + pCurrentEntry->TypeSignatureOffset);
+        SigPointer sp(pSignature, pCurrentEntry->TypeSignatureLength);
+        if (FAILED(sp.SkipExactlyOne()) || (sp.GetPtr() != (pSignature + pCurrentEntry->TypeSignatureLength)))
+            continue;
+
+        if (!ZapSig::CompareSignatureToTypeHandle(pSignature, pModule, TypeHandle(pMT), &zapSigContext))
+            continue;


The instantiation entry lookup uses TypeSignatureOffset/TypeSignatureLength to compute pSignature = pSignatureBlob + offset without validating that the computed range stays within the ReadyToRun image/section. A malformed/corrupted R2R image could cause out-of-bounds reads during signature parsing/comparison. Add bounds checks (including overflow-safe offset+length validation) before constructing SigPointer/calling CompareSignatureToTypeHandle.

Copilot · 2026-02-19T11:17:15Z

src/coreclr/tools/aot/crossgen2/Properties/Resources.resx

+  <data name="PreinitStaticsOption" xml:space="preserve">
+    <value>Interpret static constructors at compile time if possible (implied by -O)</value>
+  </data>
+  <data name="NoPreinitStaticsOption" xml:space="preserve">
+    <value>Do not interpret static constructors at compile time</value>
+  </data>


Help text says preinit statics is "implied by -O", but the implementation enables it for any non-None optimization mode (including --Os/--Ot, and potentially default optimization selection). Update the option description to reflect the actual enabling conditions so the CLI help is accurate.

Copilot · 2026-02-19T11:17:16Z

src/coreclr/vm/methodtable.cpp

+        if (!GetModule()->IsReadyToRunTypePreinitialized(this))
+            return false;
+
+        PTR_BYTE pPreinitializedData = NULL;
+        DWORD cbPreinitializedData = 0;
+
+        DWORD cbExpectedNonGCStatics = GetClass()->GetNonGCRegularStaticFieldBytes();
+        if (cbExpectedNonGCStatics != 0 &&
+            (!GetModule()->TryGetReadyToRunPreinitializedNonGCStaticsData(this, &pPreinitializedData, &cbPreinitializedData) ||
+            (cbPreinitializedData != cbExpectedNonGCStatics)))
+        {
+            return false;
+        }
+
+        DWORD cExpectedGCStatics = GetClass()->GetNumHandleRegularStatics();
+        if (cExpectedGCStatics != 0)
+        {
+            DWORD cbExpectedGCStatics = cExpectedGCStatics * sizeof(TADDR);
+            if (!GetModule()->TryGetReadyToRunPreinitializedGCStaticsData(this, &pPreinitializedData, &cbPreinitializedData) ||
+                (cbPreinitializedData != cbExpectedGCStatics))
+            {
+                return false;
+            }
+        }
+
+        return true;


New R2R preinitialized statics behavior changes class-init semantics (e.g., types with a .cctor can now be treated as pre-inited when the preinit map/data matches). There should be targeted ReadyToRun tests exercising: (1) preinitialized non-GC statics, (2) GC statics materialization (including object graphs), and (3) generic instantiation entries. Consider adding coverage under src/tests/readytorun/ to validate correctness and guard against regressions.

docs/design/features/readytorun-preinitialized-statics.md

Copilot

Pull request overview

Copilot reviewed 32 out of 32 changed files in this pull request and generated 8 comments.

Copilot · 2026-02-19T11:29:42Z

src/coreclr/tools/r2rdump/TextDumper.cs


 using System;
 using System.Collections.Generic;
+using System.Drawing;


Remove the unused using directive 'using System.Drawing;'. This namespace is not used anywhere in the file and adds an unnecessary dependency.

Suggested change

using System.Drawing;

Copilot · 2026-02-19T11:29:43Z

src/coreclr/vm/methodtable.cpp

+                        SIZE_T componentSize = pObjectType->RawGetComponentSize();
+                        TypeHandle elementTypeHandle = pObjectType->GetArrayElementTypeHandle();


Redundant variable declaration: 'componentSize' is already computed at line 4237 and then redeclared at line 4273. Remove the redundant declaration and reuse the existing variable.

Suggested change

SIZE_T componentSize = pObjectType->RawGetComponentSize();

TypeHandle elementTypeHandle = pObjectType->GetArrayElementTypeHandle();

Copilot · 2026-02-19T11:29:43Z

src/coreclr/vm/ceeload.cpp

+    DWORD cbGCStatics = pMT->GetClass()->GetNumHandleRegularStatics() * sizeof(TADDR);
+    if (cbGCStatics == 0)
+        return false;
+


Potential integer overflow: The multiplication pMT->GetClass()->GetNumHandleRegularStatics() * sizeof(TADDR) could overflow if GetNumHandleRegularStatics() returns a very large value. Consider using checked arithmetic or validating the result fits within a DWORD before the multiplication.

Suggested change

DWORD cbGCStatics = pMT->GetClass()->GetNumHandleRegularStatics() * sizeof(TADDR);

if (cbGCStatics == 0)

return false;

SIZE_T numHandleStatics = pMT->GetClass()->GetNumHandleRegularStatics();

if (numHandleStatics == 0)

return false;

if (numHandleStatics > (MAXDWORD / sizeof(TADDR)))

return false;

DWORD cbGCStatics = static_cast<DWORD>(numHandleStatics * sizeof(TADDR));

Copilot · 2026-02-19T11:29:43Z

src/coreclr/vm/ceeload.cpp

+    TADDR gcDataAddress = dataAddress + alignedNonGCDataSize;
+    ReadyToRunLoadedImage *pImage = GetReadyToRunImage();
+    TADDR imageBase = pImage->GetBase();
+    uint32_t imageSize = pImage->GetVirtualSize();
+
+    TADDR imageEnd = imageBase + imageSize;


Potential integer overflow: The addition dataAddress + alignedNonGCDataSize could overflow if both values are large. Consider checking for overflow before the addition or using saturating arithmetic to prevent wraparound.

Suggested change

TADDR gcDataAddress = dataAddress + alignedNonGCDataSize;

ReadyToRunLoadedImage *pImage = GetReadyToRunImage();

TADDR imageBase = pImage->GetBase();

uint32_t imageSize = pImage->GetVirtualSize();

TADDR imageEnd = imageBase + imageSize;

ReadyToRunLoadedImage *pImage = GetReadyToRunImage();

TADDR imageBase = pImage->GetBase();

uint32_t imageSize = pImage->GetVirtualSize();

TADDR imageEnd = imageBase + imageSize;

if (imageEnd < imageBase)

return false;

if ((dataAddress < imageBase) || (dataAddress > imageEnd))

return false;

if (alignedNonGCDataSize > static_cast<DWORD>(imageEnd - dataAddress))

return false;

TADDR gcDataAddress = dataAddress + alignedNonGCDataSize;

Copilot · 2026-02-19T11:29:44Z

src/coreclr/vm/ceeload.cpp

+    ReadyToRunLoadedImage *pImage = pModule->GetReadyToRunImage();
+    TADDR imageBase = pImage->GetBase();
+    uint32_t imageSize = pImage->GetVirtualSize();
+


Potential integer overflow: The addition imageBase + imageSize could overflow if both values are near the maximum address space. Consider checking for overflow before the addition.

Suggested change

if (imageBase > (TADDR)-1 - static_cast<TADDR>(imageSize))

return false;

Copilot · 2026-02-19T11:29:44Z

src/coreclr/vm/readytoruninfo.cpp

+        if (pCurrentEntry->TypeSignatureLength == 0)
+            continue;
+
+        PCCOR_SIGNATURE pSignature = reinterpret_cast<PCCOR_SIGNATURE>(pSignatureBlob + pCurrentEntry->TypeSignatureOffset);


Missing bounds check: Before computing pSignature = pSignatureBlob + pCurrentEntry->TypeSignatureOffset, validate that TypeSignatureOffset and TypeSignatureLength don't exceed the bounds of the signature blob region. An out-of-bounds offset could lead to reading arbitrary memory.

Copilot · 2026-02-19T11:29:44Z

src/coreclr/vm/methodtable.cpp

+            SIZE_T cbData = (SIZE_T)arrayLength * componentSize;
+


Potential integer overflow: The multiplication (SIZE_T)arrayLength * componentSize at line 4238 could overflow if arrayLength is very large. Although TryAllocateFrozenSzArray validates the allocation, this computation should be checked for overflow before use, as cbData is used to validate memory accesses later.

Suggested change

SIZE_T cbData = (SIZE_T)arrayLength * componentSize;

S_SIZE_T cbDataSafe = S_SIZE_T(arrayLength) * S_SIZE_T(componentSize);

if (cbDataSafe.IsOverflow())

{

COMPlusThrowOM();

}

SIZE_T cbData = cbDataSafe.Value();

Copilot · 2026-02-19T11:29:44Z

src/coreclr/vm/methodtable.cpp

+                if (!elementTypeHandle.IsTypeDesc() && !elementTypeHandle.AsMethodTable()->IsValueType())
+                {
+                    PTR_OBJECTREF pArrayRefs = dac_cast<PTR_OBJECTREF>(pArrayData);
+                    PTR_TADDR pTemplateRefs = dac_cast<PTR_TADDR>(templateDataAddress + dataOffset);


Missing bounds check: Before dereferencing templateDataAddress + dataOffset, validate that this address and the subsequent data (up to templateDataAddress + dataOffset + cbData) are within the bounds of the R2R image. A corrupted or malicious image could specify offsets that point outside valid memory.

src/coreclr/tools/Common/Compiler/TypePreinit.cs

src/coreclr/tools/aot/ILCompiler.Compiler/Compiler/TypePreinit.cs

src/coreclr/tools/Common/Compiler/TypePreinit.cs

Copilot

Pull request overview

Copilot reviewed 32 out of 34 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (2)

src/coreclr/tools/r2rdump/TextDumper.cs:6

The using System.Drawing; directive is not used anywhere in this file and should be removed.

using System.IO;

src/coreclr/tools/Common/Compiler/TypePreinit.cs:3274

The code at lines 3266-3274 handles open static delegates (when _firstParameter == null), but DelegateCreationInfo.Create throws NotSupportedException("Open static delegates") (DelegateCreationInfo.ReadyToRun.cs:55) before this code can be reached. Either the check in DelegateCreationInfo should be removed to allow open static delegates, or this code path is unreachable dead code and should be removed or replaced with an assertion that throws. Additionally, line 3271 asserts that creationInfo.Thunk != null, but the Thunk is always set to null in DelegateCreationInfo (line 65), so this assertion will always fail if the code is reached.

src/coreclr/vm/methodtable.cpp

Copilot

Pull request overview

Copilot reviewed 32 out of 34 changed files in this pull request and generated 4 comments.

Copilot · 2026-02-19T14:49:02Z

src/coreclr/vm/readytoruninfo.cpp

+    uint32_t instantiationEntryCount = *reinterpret_cast<const uint32_t*>(pAfterTypeDefEntries);
+    const READYTORUN_TYPE_PREINITIALIZATION_MAP_INSTANTIATION_ENTRY *pInstantiationEntries =
+        reinterpret_cast<const READYTORUN_TYPE_PREINITIALIZATION_MAP_INSTANTIATION_ENTRY*>(pAfterTypeDefEntries + sizeof(uint32_t));
+
+    const uint8_t *pSignatureBlob = reinterpret_cast<const uint8_t*>(pInstantiationEntries + instantiationEntryCount);
+
+    if (instantiationStartIndex > instantiationEntryCount)
+        return false;
+
+    if (instantiationCountForType > (instantiationEntryCount - instantiationStartIndex))
+        return false;
+
+    ZapSig::Context zapSigContext(pModule, pModule);
+    for (uint32_t index = 0; index < instantiationCountForType; index++)
+    {
+        const READYTORUN_TYPE_PREINITIALIZATION_MAP_INSTANTIATION_ENTRY *pCurrentEntry = &pInstantiationEntries[instantiationStartIndex + index];
+
+        if (pCurrentEntry->TypeSignatureLength == 0)
+            continue;
+
+        PCCOR_SIGNATURE pSignature = reinterpret_cast<PCCOR_SIGNATURE>(pSignatureBlob + pCurrentEntry->TypeSignatureOffset);
+        SigPointer sp(pSignature, pCurrentEntry->TypeSignatureLength);
+        if (FAILED(sp.SkipExactlyOne()) || (sp.GetPtr() != (pSignature + pCurrentEntry->TypeSignatureLength)))
+            continue;


TryGetInstantiationEntry computes pSignatureBlob + TypeSignatureOffset and then parses TypeSignatureLength bytes without validating that the offset/length are within the TypePreinitializationMap section (or at least within the mapped R2R image). A malformed R2R image could cause out-of-bounds reads/AVs here. Add bounds checks for TypeSignatureOffset + TypeSignatureLength against the end of the R2R image (and similarly validate the instantiation table read at pAfterTypeDefEntries).

Copilot · 2026-02-19T14:49:03Z

src/coreclr/vm/methodtable.cpp

+    if (!IsAddressInReadyToRunImage(GetModule(), templateDataAddress))
+        COMPlusThrow(kInvalidProgramException);
+
+    TADDR encodedMethodTableAddress = VolatileLoadWithoutBarrier(dac_cast<PTR_SIZE_T>(templateDataAddress));
+    BYTE methodTableFixupKind = 0;
+    TADDR methodTableAddress = ResolveReadyToRunEncodedPointer(encodedMethodTableAddress, &methodTableFixupKind);
+    if (methodTableFixupKind != READYTORUN_FIXUP_TypeHandle)
+        COMPlusThrow(kInvalidProgramException);
+
+    TypeHandle th = TypeHandle::FromTAddr(methodTableAddress);
+    if (th.IsNull() || th.IsTypeDesc())
+        COMPlusThrow(kInvalidProgramException);
+
+    MethodTable *pObjectType = th.AsMethodTable();
+    pObjectType->EnsureInstanceActive();
+
+    if (pObjectType->IsArray())
+    {
+        _ASSERTE(!pObjectType->IsMultiDimArray());
+
+        INT32 arrayLength = GET_UNALIGNED_VAL32((PTR_BYTE)(templateDataAddress + TARGET_POINTER_SIZE));
+        OBJECTREF arrayRef = TryAllocateFrozenSzArray(pObjectType, arrayLength);
+        if (arrayRef == NULL)
+            arrayRef = AllocateSzArray(pObjectType, arrayLength);
+


MaterializeReadyToRunPreinitializedClassData validates that templateDataAddress is within the R2R image, but it then reads variable-sized data (method table pointer, array length, field payloads) without checking that the full template range is within image bounds. A malformed image could cause out-of-bounds reads/AVs during static materialization. Consider validating the minimum required range before each read (e.g., header + array length, and then header + dataOffset + cbData for arrays; and for objects validate up to the last instance field end).

Copilot · 2026-02-19T14:49:03Z

src/coreclr/vm/ceeload.cpp

+
+    TADDR imageEnd = imageBase + imageSize;
+    TADDR dataAddress = pImage->GetRvaData(dataRva);
+    if ((dataAddress < imageBase) || (dataAddress > imageEnd))


In TryGetReadyToRunPreinitializedStaticsDataInfo, the bounds check allows dataAddress == imageEnd (dataAddress > imageEnd), which is not a valid start address (it is one-past-the-end). Tighten the check to reject dataAddress >= imageEnd to avoid accepting a non-dereferenceable pointer when dataSize == 0 and to match the usual half-open range conventions used elsewhere.

Suggested change

if ((dataAddress < imageBase) || (dataAddress > imageEnd))

if ((dataAddress < imageBase) || (dataAddress >= imageEnd))

Copilot · 2026-02-19T14:49:03Z

src/coreclr/tools/r2rdump/TextDumper.cs

+                        uint size = nextPayloadStart == 0 ? (uint)_r2r.TargetPointerSize : nextPayloadStart - computedGCStart;
+                        if ((size % pointerSize) != 0)
+                        {
+                            reason = $"size {size} is not pointer-size aligned";
+                            return false;
+                        }
+
+                        gcRva = computedGCStart;
+                        gcSize = size;
+                        return true;
+                    }


TryComputeGCDataRange falls back to pointerSize when there is no next payload start (nextPayloadStart == 0), which will almost always under-report GC static payload size for the last entry and can make r2rdump output misleading. Consider printing GC data as "unknown" in that case, or compute the expected GC handle count from metadata (static fields) when metadata is available.

hez2010 · 2026-02-19T17:34:46Z

I have doubts that the pre-initialization would be a material win for R2R in its current state. It is a tradeoff between the cost of pre-initialized data lookup and application vs. cost of. finding and running the static constructor code (+ saving some static constructor probes). These costs are very small compared to the total R2R overhead (loading all types, etc.).

I think that the best way to optimize R2R is by fixing bugs and local inefficiencies (#124519 is a good example). My guess is that we have quite a few of those. For larger new features, focus on the most expensive things (likely type loading).

@jkotas FYI I experimented implementing getStaticFieldContent for R2R because with preinit we now know the static field content at compile-time. This enabled aggressive JIT constant folding (especially for those non-gc statics) and now we managed to get a promising result.

In my test app (still Avalonia but more complicated).

Before (no-preinit):

542.0519 ms
532.5862 ms
534.0867 ms
532.6754 ms
532.3926 ms
536.6259 ms
528.5405 ms
533.6437 ms
531.622 ms
537.5929 ms

The current state of PR so far (preinit, no jit constant folding):

531.0204 ms
531.9242 ms
528.7039 ms
527.6184 ms
527.7125 ms
529.5206 ms
531.6338 ms
529.3657 ms
531.842 ms
531.0134 ms

After (preinit + jit constant folding):

495.899 ms
491.8927 ms
491.6906 ms
486.5729 ms
492.5815 ms
496.9796 ms
491.8558 ms
495.2152 ms
492.3521 ms
489.5596 ms

This achieved a 8% reduction of startup time.

I'm still verifying some implementation details so not committed into this PR yet.

Bring up type preinitialization for R2R

bcc30a0

Copilot AI review requested due to automatic review settings February 18, 2026 19:29

hez2010 requested a review from MichalStrehovsky as a code owner February 18, 2026 19:29

github-actions bot added the area-crossgen2-coreclr label Feb 18, 2026

dotnet-policy-service bot added the community-contribution Indicates that the PR has been added by a community member label Feb 18, 2026

Copilot started reviewing on behalf of hez2010 February 18, 2026 19:30 View session

Copilot AI reviewed Feb 18, 2026

View reviewed changes

Revert unnecessary helper expansion

b3ebd6a

jkoritzinsky requested review from davidwrighton and jkoritzinsky February 18, 2026 20:43

jkoritzinsky reviewed Feb 19, 2026

View reviewed changes

build-analysis bot mentioned this pull request Feb 19, 2026

[android][clr] No peer certificates when executing System.Net.Http.Functional.Tests on Android emulator #124526

Open

hez2010 commented Feb 19, 2026

View reviewed changes

docs/design/features/readytorun-preinitialized-statics.md Outdated Show resolved Hide resolved

Apply suggestions from code review

8611d11

Co-authored-by: Jeremy Koritzinsky <jkoritzinsky@gmail.com>

Copilot AI review requested due to automatic review settings February 19, 2026 11:08

Copilot started reviewing on behalf of hez2010 February 19, 2026 11:09 View session

Copilot AI reviewed Feb 19, 2026

View reviewed changes

hez2010 added 2 commits February 19, 2026 20:18

Allocate GC statics in frozen object heap

e7c04fc

Fix a type

c703338

Copilot AI review requested due to automatic review settings February 19, 2026 11:19

Copilot started reviewing on behalf of hez2010 February 19, 2026 11:20 View session

Copilot AI reviewed Feb 19, 2026

View reviewed changes

Move some files

5ec0455

MichalStrehovsky reviewed Feb 19, 2026

View reviewed changes

src/coreclr/tools/Common/Compiler/TypePreinit.cs Outdated Show resolved Hide resolved

src/coreclr/tools/aot/ILCompiler.Compiler/Compiler/TypePreinit.cs Outdated Show resolved Hide resolved

src/coreclr/tools/Common/Compiler/TypePreinit.cs Outdated Show resolved Hide resolved

Address more feedbacks

2615096

Copilot AI review requested due to automatic review settings February 19, 2026 13:27

Nit

1297050

Copilot started reviewing on behalf of hez2010 February 19, 2026 13:28 View session

Copilot AI reviewed Feb 19, 2026

View reviewed changes

src/coreclr/vm/methodtable.cpp Outdated Show resolved Hide resolved

src/coreclr/vm/methodtable.cpp Outdated Show resolved Hide resolved

hez2010 added 2 commits February 19, 2026 23:27

Get rid of unnecessary binary search

c34163b

Frozen object fixes

79c7e83

Copilot AI review requested due to automatic review settings February 19, 2026 14:38

Copilot started reviewing on behalf of hez2010 February 19, 2026 14:39 View session

Copilot AI reviewed Feb 19, 2026

View reviewed changes

		PTR_TADDR pPointerField = dac_cast<PTR_TADDR>(pFieldAddress);
		pPointerField = ResolveReadyToRunEncodedPointer(pPointerField);

-            PTR_TADDR pPointerField = dac_cast<PTR_TADDR>(pFieldAddress);
-            *pPointerField = ResolveReadyToRunEncodedPointer(*pPointerField);
+            UNALIGNED TADDR* pPointerField = reinterpret_cast<UNALIGNED TADDR*>(pFieldAddress);
+            TADDR pointerValue = *pPointerField;
+            pointerValue = ResolveReadyToRunEncodedPointer(pointerValue);
+            *pPointerField = pointerValue;

	TADDR encodedFieldReference = VolatileLoadWithoutBarrier(dac_cast<PTR_SIZE_T>(pTemplateFieldAddress));
	TADDR encodedFieldReference = VolatileLoadWithoutBarrier(GET_UNALIGNED_PTR(TADDR, pTemplateFieldAddress));

		PTR_TADDR pPointerFieldAddress = dac_cast<PTR_TADDR>(pFieldAddress);
		pPointerFieldAddress = ResolveReadyToRunEncodedPointer(pPointerFieldAddress);

-                PTR_TADDR pPointerFieldAddress = dac_cast<PTR_TADDR>(pFieldAddress);
-                *pPointerFieldAddress = ResolveReadyToRunEncodedPointer(*pPointerFieldAddress);
+                TADDR pointerFieldValue;
+                memcpy(&pointerFieldValue, pFieldAddress, sizeof(TADDR));
+                pointerFieldValue = ResolveReadyToRunEncodedPointer(pointerFieldValue);
+                memcpy(pFieldAddress, &pointerFieldValue, sizeof(TADDR));

		private bool TargetMethodIsUnboxingThunk
		=> PossiblyUnresolvedTargetMethod.OwningType.IsValueType && !PossiblyUnresolvedTargetMethod.Signature.IsStatic;

		SIZE_T componentSize = pObjectType->RawGetComponentSize();
		TypeHandle elementTypeHandle = pObjectType->GetArrayElementTypeHandle();



	if (imageBase > (TADDR)-1 - static_cast<TADDR>(imageSize))
	return false;

-            SIZE_T cbData = (SIZE_T)arrayLength * componentSize;
+            S_SIZE_T cbDataSafe = S_SIZE_T(arrayLength) * S_SIZE_T(componentSize);
+            if (cbDataSafe.IsOverflow())
+            {
+                COMPlusThrowOM();
+            }
+            SIZE_T cbData = cbDataSafe.Value();

	if ((dataAddress < imageBase) \|\| (dataAddress > imageEnd))
	if ((dataAddress < imageBase) \|\| (dataAddress >= imageEnd))

Conversation

hez2010 commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Type preinitialization for R2R bringing up

Benchmarks

Avalonia app

Blazor SSR

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

jkotas commented Feb 18, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jkoritzinsky Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

hez2010 Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

jkoritzinsky Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

hez2010 Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

jkoritzinsky Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hez2010 commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jkotas commented Feb 19, 2026

Uh oh!

hez2010 commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hez2010 commented Feb 19, 2026

Uh oh!

jkotas commented Feb 19, 2026

Uh oh!

jkoritzinsky commented Feb 19, 2026

Uh oh!

Uh oh!

jkotas commented Feb 19, 2026

Uh oh!

jkoritzinsky commented Feb 19, 2026

Uh oh!

hez2010 commented Feb 19, 2026

Uh oh!

jkotas commented Feb 19, 2026

Uh oh!

jkotas commented Feb 19, 2026

Uh oh!

Copilot AI left a comment

hez2010 commented Feb 18, 2026 •

edited

Loading

hez2010 commented Feb 19, 2026 •

edited

Loading

hez2010 commented Feb 19, 2026 •

edited

Loading