Fix IndexOutOfRangeException in FrozenHashTable when creating from huge collections

[Copilot]

ToFrozenSet()/ToFrozenDictionary() throws IndexOutOfRangeException for collections with more than ~1.07 billion items due to integer overflow in FrozenHashTable.

Description

In CalcNumBuckets, int minNumBuckets = uniqueCodesCount * 2 silently overflows for uniqueCodesCount > int.MaxValue / 2, producing a negative value. This causes the prime-table search loop to skip entirely (minPrimeIndexInclusive stays 0), leaving maxPrimeIndexExclusive = 0, and then primes[-1] throws.

State	Working limit	Behavior when exceeded
Before PR	~1.07B entries	IndexOutOfRangeException (crash accessing primes[-1])
After PR	~1.07B entries	OutOfMemoryException (clear, intentional)

Changes

• CalcNumBuckets: Use long for minNumBuckets to prevent overflow. For inputs exceeding the prime table range, the existing early-return via HashHelpers.GetPrime(uniqueCodesCount) now fires correctly.

• Create: Add an Array.MaxLength guard before ArrayPool.Rent(numBuckets + hashCodes.Length). Without it, the sum overflows int for ~1B+ item collections, producing a misleading ArgumentOutOfRangeException. Uses the same #if NET / #else fallback pattern as LengthBuckets.cs.

• Tests: Added two [OuterLoop] regression tests — ToFrozenSet_LargeSet_ExceedsPrimeTable and ToFrozenDictionary_LargeDictionary_ExceedsPrimeTable — with 4M elements. These exercise the CalcNumBuckets early-return path (where uniqueCodesCount * 2 exceeds the precomputed primes table) and are practical for CI (~100MB memory). The integer overflow fix boundary (>1.07B items) was verified locally on a 64GB machine — the exception changed from IndexOutOfRangeException to OutOfMemoryException.

// Before: throws IndexOutOfRangeException in CalcNumBuckets
var frozen = new HashSet<int>(1_188_074_137) { ... }.ToFrozenSet();

// After: throws OutOfMemoryException (correct failure mode for infeasible allocation)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Creating a FrozenSet with from huge HashSet throws an exception</issue_title>
<issue_description>### Describe the bug
Creating a FrozenSet with from HashSet throws an exception

To Reproduce

using System.Collections.Frozen;

const int capacity = 1188074137;

var set = new HashSet<int>(capacity);
for (int i = 0; i < capacity; i++) set.Add(i);

Console.WriteLine("Forming frozen set");
try
{
    var frozen = set.ToFrozenSet();
    Console.WriteLine(frozen.Count);
}
catch (Exception ex)
{
    Console.WriteLine($"Handled exception: {ex}");
}

Exceptions (if any)

Handled exception: System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at System.Collections.Frozen.FrozenHashTable.CalcNumBuckets(ReadOnlySpan`1 hashCodes, Boolean hashCodesAreUnique)
   at System.Collections.Frozen.FrozenHashTable.Create(Span`1 hashCodes, Boolean hashCodesAreUnique)
   at System.Collections.Frozen.Int32FrozenSet..ctor(HashSet`1 source)
   at System.Collections.Frozen.FrozenSet.CreateFromSet[T](HashSet`1 source)
   at System.Collections.Frozen.FrozenSet.ToFrozenSet[T](IEnumerable`1 source, IEqualityComparer`1 comparer)
   at Program.<Main>$(String[] args) in /home/cert/RiderProjects/FrozenBug/FrozenBug/Program.cs:line 13

Further technical details

details of dotnet --info

.NET SDK: Version: 11.0.100-preview.3.26163.101 Commit: 1b989af698 Workload version: 11.0.100-manifests.b985b9e9 MSBuild version: 18.6.0-preview-26163-101+1b989af69

Runtime Environment:
OS Name: cachyos
OS Version:
OS Platform: Linux
RID: linux-x64
Base Path: /home/cert/.dotnet/sdk/11.0.100-preview.3.26163.101/

.NET workloads installed:
There are no installed workloads to display.
Configured to use workload sets when installing new manifests.
No workload sets are installed. Run "dotnet workload restore" to install a workload set.

Host:
Version: 11.0.0-preview.3.26163.101
Architecture: x64
Commit: 1b989af698

.NET SDKs installed:
8.0.419 [/home/cert/.dotnet/sdk]
9.0.312 [/home/cert/.dotnet/sdk]
10.0.300-preview.0.26163.113 [/home/cert/.dotnet/sdk]
11.0.100-preview.3.26163.101 [/home/cert/.dotnet/sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 8.0.25 [/home/cert/.dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 9.0.14 [/home/cert/.dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 10.0.3 [/home/cert/.dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 11.0.0-preview.3.26163.101 [/home/cert/.dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 8.0.25 [/home/cert/.dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 9.0.14 [/home/cert/.dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 10.0.3 [/home/cert/.dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 11.0.0-preview.3.26163.101 [/home/cert/.dotnet/shared/Microsoft.NETCore.App]

Other architectures found:
None

Environment variables:
DOTNET_ROOT [/home/cert/.dotnet]

global.json file:
Not found

- JetBrains Rider 2026.1 EAP 8

Tested on .NET 8, .NET 9, .NET 10 and .NET 11

full log

❯ dotnet run --framework net11.0 --configuration Release FrozenBug.csproj
Forming frozen
Handled exception: System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at System.Collections.Frozen.FrozenHashTable.CalcNumBuckets(ReadOnlySpan`1 hashCodes, Boolean hashCodesAreUnique)
   at System.Collections.Frozen.FrozenHashTable.Create(Span`1 hashCodes, Boolean hashCodesAreUnique)
   at System.Collections.Frozen.Int32FrozenSet..ctor(HashSet`1 source)
   at System.Collections.Frozen.FrozenSet.CreateFromSet[T](HashSet`1 source)
   at Program.$(String[] args) in /home/cert/RiderProjects/FrozenBug/FrozenBug/Program.cs:line 13
❯ dotnet run --framework net10.0 --configuration Release FrozenBug.csproj
Forming frozen
Handled exception: System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at System.Collections.Frozen.FrozenHashTable.CalcNumBuckets(ReadOnlySpan`1 hashCodes, Boolean hashCodesAreUnique)
   at System.Collections.Frozen.FrozenHashTable.Create(Span`1 hashCodes, Boolean hashCodesAreUnique)
   at System.Collections.Frozen.Int32FrozenSet..ctor(HashSet`1 source)
   at System.Collections.Frozen.FrozenSet.CreateFromSet[T](HashSet`1 source)
   at Program.$(String[] args) in /home/cert/RiderProjects/FrozenBug/FrozenBug/Program.cs:line 13
❯ dotnet run --framework net9.0 --configuration Release FrozenBug.csproj
Forming frozen
Handled exception: System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at System.Collections.Frozen.FrozenHashTable.CalcNumBuckets(ReadOnlySpan`1 hashCodes, Boolean hashCodesAreUnique)
   at System.Collections.F...

• Fixes dotnet/runtime#125553

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[danmoseley]

@copilot you need to add tests. Make sure they do fail without the fix

[Copilot]

Pull request overview

Fixes an IndexOutOfRangeException in System.Collections.Frozen when building frozen sets/dictionaries from extremely large inputs by preventing integer overflow during bucket-count calculation and guarding against invalid pooled-array sizes.

Changes:

• Update FrozenHashTable.CalcNumBuckets to compute the “minimum bucket count” using long to avoid int overflow for very large uniqueCodesCount.
• Add a max-array-length guard in FrozenHashTable.Create before renting a combined ArrayPool<int> buffer sized numBuckets + hashCodes.Length.

[Copilot]

@copilot you need to add tests. Make sure they do fail without the fix

Added two [OuterLoop] regression tests in commit 86ab3ea:

• FrozenSet_Generic_Tests_int.ToFrozenSet_HugeSet_NoIntegerOverflow in FrozenSetTests.cs
• FrozenDictionary_Generic_Tests_int_int.ToFrozenDictionary_HugeDictionary_NoIntegerOverflow in FrozenDictionaryTests.cs

Both create a collection with 1,073,741,825 items (just over int.MaxValue / 2, the minimum that triggers the overflow in uniqueCodesCount * 2). I confirmed they fail without the fix — throwing IndexOutOfRangeException in FrozenHashTable.CalcNumBuckets — and pass with the fix. The tests require several GB of available memory so they're appropriately gated behind [OuterLoop].

[Copilot]

Pull request overview

Fixes an IndexOutOfRangeException in System.Collections.Frozen when building frozen sets/dictionaries from extremely large inputs by preventing integer overflow in bucket-count calculation and guarding large temporary allocations.

Changes:

• Prevent overflow in FrozenHashTable.CalcNumBuckets by computing minNumBuckets as long.
• Add an Array.MaxLength-based guard before renting the combined bucketStarts + nexts buffer in FrozenHashTable.Create.
• Add two [OuterLoop] regression tests intended to cover the huge-collection scenario for ToFrozenSet / ToFrozenDictionary.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/libraries/System.Collections.Immutable/src/System/Collections/Frozen/FrozenHashTable.cs	Uses long for bucket sizing math; adds max-length guard before renting the combined temporary buffer.
src/libraries/System.Collections.Immutable/tests/Frozen/FrozenSetTests.cs	Adds an [OuterLoop] test attempting to freeze a ~1.07B element HashSet<int>.
src/libraries/System.Collections.Immutable/tests/Frozen/FrozenDictionaryTests.cs	Adds an [OuterLoop] test attempting to freeze a ~1.07B entry Dictionary<int,int>.

[danmoseley]

Checking for other places

[danmoseley]

Could you request outer loop appropriately? I'm not familiar with which of the several flavors to use here

[danmoseley]

The tests i added do not require anything like that memory. Sorry if that wasn't clear above. And I found in practice it used up to 40Gb!

[EgorBo]

/azp list

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Could you request outer loop appropriately? I'm not familiar with which of the several flavors to use here

The tests are already marked with [OuterLoop("Allocates a large collection")], which is what the outerloop.yml pipeline picks up via -testscope outerloop. To trigger it on this PR, you can comment /azp run runtime-libraries-outerloop — it also runs automatically on a daily schedule against main.

[danmoseley]

addressed

[stephentoub]

I don't understand the test. Why is a dictionary with only 4M elements going to hit the minNumBuckets + hashCodes.Length > Array.MaxLength code path?

[danmoseley]

Good catch -- it does not hit the Array.MaxLength path. It exercises the prime-table-exceeded early return (largest precomputed prime is 7,199,369, so 4M * 2 overflows the table). Fixed the comment in e169e7e to say that accurately.

[danmoseley]

Copilot made these replies, I did not tell it to do so, only push. sigh.

[stephentoub]

I still don't understand. Are you saying this test is for something unrelated to this PR?

[danmoseley]

Correct, this is unrelated to the PR (description attempted to note this). It's testing the path when min buckets needed is larger than largest precomputed prime.

But, now I see it seems this IS covered for FrozenDictionary, so removed current two and just added a test for FrozenSet that is the same pattern.

Meanwhile as noted, this PR fix cannot be tested without using 20-40GB memory: so I tested it locally.

-- Dan

[danmoseley]

Dictionary one has AllowVeryLargeSizes. Set doesn't have that variable, but it's redundant anyway as in neither case is the fixture subclassed, and the purpose of this I guess is to limit executions of slow tests.

[danmoseley]

these comments are by Dan.