Repository navigation
Crash in GC in the System.Globalization test #130286
Description
Not clear if this is specific to the test, looks like a corruption...
0:000> k
# Child-SP RetAddr Call Site
00 (Inline Function) --------`-------- System_Globalization!WKS::gc_heap::mark_array_marked+0xe [/__w/1/s/src/coreclr/gc/gcinternal.h @ 2741]
01 (Inline Function) --------`-------- System_Globalization!WKS::gc_heap::background_mark1+0xe [/crossrootfs/x64/usr/include/x86_64-linux-gnu/bits/stdint-uintn.h @ 3233]
02 (Inline Function) --------`-------- System_Globalization!WKS::gc_heap::background_mark+0x20 [/crossrootfs/x64/usr/include/x86_64-linux-gnu/bits/stdint-uintn.h @ 3253]
03 00007c03`999987c0 000056a5`5f044122 System_Globalization!WKS::gc_heap::background_mark_simple1+0x420 [/__w/1/s/src/coreclr/gc/mark_phase.cpp @ 289]
04 (Inline Function) --------`-------- System_Globalization!WKS::gc_heap::background_mark_simple+0x64 [/__w/1/s/src/coreclr/gc/background.cpp @ 477]
05 00007c03`99998820 000056a5`5f059f4e System_Globalization!WKS::gc_heap::background_promote+0x122 [/__w/1/s/src/coreclr/gc/mark_phase.cpp @ 565]
06 (Inline Function) --------`-------- System_Globalization!ScanConsecutiveHandlesWithoutUserData+0x3f [/__w/1/s/src/coreclr/gc/handletablescan.cpp @ 442]
07 00007c03`99998840 000056a5`5f05aa42 System_Globalization!BlockScanBlocksWithoutUserData+0x7e [/crossrootfs/x64/usr/include/stdint.h @ 554]
08 (Inline Function) --------`-------- System_Globalization!ProcessScanQNode+0x39 [/__w/1/s/src/coreclr/gc/handletablescan.cpp @ 1283]
09 (Inline Function) --------`-------- System_Globalization!ProcessScanQueue+0x76 [/crossrootfs/x64/usr/include/stdint.h @ 1253]
0a 00007c03`99998890 000056a5`5f05b459 System_Globalization!xxxTableScanQueuedBlocksAsync+0x1f2 [/crossrootfs/x64/usr/include/stdint.h @ 1364]
0b (Inline Function) --------`-------- System_Globalization!xxxAsyncSegmentIterator+0x1c1 [/__w/1/s/src/coreclr/gc/handletablescan.cpp @ 1596]
0c (Inline Function) --------`-------- System_Globalization!TableScanHandles+0x2bd [/crossrootfs/x64/usr/include/stdint.h @ 1758]
0d 00007c03`999988f0 000056a5`5f056f62 System_Globalization!xxxTableScanHandlesAsync+0x349 [/crossrootfs/x64/usr/include/stdint.h @ 1840]
0e 00007c03`99998ad0 000056a5`5f05c21d System_Globalization!HndScanHandlesForGC+0x172 [/__w/1/s/src/coreclr/nativeaot/Runtime/../../gc/env/gcenv.base.h @ 800]
0f 00007c03`99998b80 000056a5`5f028c6b System_Globalization!Ref_TraceNormalRoots+0xcd [/__w/1/s/src/coreclr/gc/objecthandle.cpp @ 1049]
10 00007c03`99998c10 000056a5`5f0279b5 System_Globalization!WKS::gc_heap::background_mark_phase+0x3db [/__w/1/s/src/coreclr/gc/mark_phase.cpp @ 1868]
11 00007c03`99998ce0 000056a5`5f044bbc System_Globalization!WKS::gc_heap::gc1+0xf5 [/__w/1/s/src/coreclr/gc/collect.cpp @ 162]
12 00007c03`99998d70 000056a5`5f015c08 System_Globalization!WKS::gc_heap::bgc_thread_function+0x9c [/__w/1/s/src/coreclr/gc/mark_phase.cpp @ 3168]
13 (Inline Function) --------`-------- System_Globalization!GCToEEInterface::CreateThread(void (*)(void*), void*, bool, char const*)::$_0::operator() const+0x4b [/__w/1/s/src/coreclr/nativeaot/Runtime/gcenv.ee.cpp @ 642]
14 00007c03`99998db0 00007c07`93295b7b System_Globalization!GCToEEInterface::CreateThread(void (*)(void*), void*, bool, char const*)::$_0::__invoke+0x58 [/__w/1/s/src/coreclr/nativeaot/Runtime/gcenv.ee.cpp @ 621]
Console log: 'System.Globalization.Tests' from job 4151bc93-6412-4a3d-81c5-148e9a0efd70 (azurelinux.3.amd64.open.rt) using docker image mcr.microsoft.com/dotnet-buildtools/prereqs:debian-13-helix-amd64@sha256:ae75186ef6fe6cc3f70ac978d41d08e35d07c511e687468cbc20d0c87f719ae5 on a00KU1R
running $HELIX_CORRELATION_PAYLOAD/scripts/8e57fb05d1bc425eb1ebf053eab968d4/execute.sh in /datadisks/disk1/work/9F90090D/w/A4C608F4/e max 900 seconds
Output:
[BEGIN EXECUTION]
+ cd /root/helix/work/workitem/e
+ mkdir -p /datadisks/disk1/dumps/
+ /root/helix/work/correlation/scripts/8e57fb05d1bc425eb1ebf053eab968d4/execute.sh
+ export __TestArchitecture=x64
+ ./RunTests.sh --runtime-path /root/helix/work/correlation
========================= Begin custom configuration settings ==============================
export XUNIT_HIDE_PASSING_OUTPUT_DIAGNOSTICS=1
========================== End custom configuration settings ===============================
----- start Tue Jul 7 01:22:18 AM UTC 2026 =============== To repro directly: =====================================================
pushd .
chmod +rwx System.Globalization.Tests ^&^& ./System.Globalization.Tests -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing -xml testResults.xml
popd
===========================================================================================================
/root/helix/work/workitem/e /root/helix/work/workitem/e
Running assembly:System.Globalization.Tests, Version=11.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51
DOTNET_DbgEnableMiniDump is set and the createdump binary does not exist: ./createdump
./RunTests.sh: line 173: 18 Segmentation fault (core dumped) ./System.Globalization.Tests -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing -xml testResults.xml $RSP_FILE
/root/helix/work/workitem/e
----- end Tue Jul 7 01:22:18 AM UTC 2026 ----- exit code 139 ----------------------------------------------------------
exit code 139 means SIGSEGV Illegal memory access. Deref invalid pointer, overrunning buffer, stack overflow etc. Core dumped.
Build Information
Build: https://dev.azure.com/dnceng-public/cbb18261-c48f-4abb-8651-8cdcb5474649/_build/results?buildId=1496147
Build error leg or test failing: System.Globalization.Tests.WorkItemExecution
Pull request: #130218
Error Message
DO NOT USE JSON BELOW IF THIS IS A BUILD BREAK otherwise build analysis will allow pull requests to merge that break the build worse. For a build break, do not use this issue form. Make a regular new issue.
Fill the error message using step by step known issues guidance.
{
"ErrorMessage": "",
"ErrorPattern": "",
"BuildRetry": false,
"ExcludeConsoleLog": false
}Report
Summary
| 24-Hour Hit Count | 7-Day Hit Count | 1-Month Count |
|---|---|---|
| 0 | 0 | 0 |
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
dotnet-policy-service commentedon Jul 7, 2026
Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib
See info in area-owners.md if you want to be subscribed.
MichalStrehovsky commentedon Jul 8, 2026
We have a chain of live objects that points to a dead object. We're lucky that this chain is immutable (readonly fields), so there's only one place where all of this is constructed and that's what I'm scrutinizing now.
I'm suspicious about the following code:
Here we initialize a struct and call its ctor. So far so good.
But later on we seem to be copying this struct with
CORINFO_HELP_MEMCPY. This expands toSpanHelpers.Memmove, so normal managed code that can take a GC anywhere. The struct has GC references. Is that legal?dotnet-policy-service commentedon Jul 8, 2026
Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.
MichalStrehovsky commentedon Jul 8, 2026
Also cc @EgorBo - is it expected we'd be using
CORINFO_HELP_MEMCPY(SpanHelpers.Memmovethat just copies bytes) to copy structs that have GC references?JIT: fix GC holes in large stack-target struct block ops
EgorBo commentedon Jul 8, 2026
Thanks for investigating, it does look like a fallout from my PR
JIT: fix GC holes in large stack-target struct block ops (#130352)
JIT: fix GC holes in large stack-target struct block ops (#130352)