[wasm][mono][AOT] Number_AsCollectionElement_RoundTrip crashes with unction signature mismatch boxing Nullable<Int128> #131537

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1531463
Failing test: System.Text.Json.Serialization.Tests.NumberHandlingTestsDynamic.Number_AsCollectionElement_RoundTrip
Failing leg: WasmTestOnChrome-MONO-ST-System.Text.Json.Tests (Mono WASM, AOT'd corelib + interpreted test assembly)
Console log: https://helix.dot.net/api/2019-06-17/jobs/53d5855e-85a6-4f44-8001-1d7062dda38e/workitems/WasmTestOnChrome-MONO-ST-System.Text.Json.Tests/console

Error Message

{
  "ErrorMessage": ["Number_AsCollectionElement_RoundTrip","function signature mismatch"],
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Details

The test crashes the WebAssembly runtime (aborting the whole Helix work item) with a function signature mismatch while boxing a Nullable<Int128> element through the non-generic IEnumerator.Current path (triggered by new Queue(ICollection) enumerating the collection):

[14:41:22] info: [STRT] System.Text.Json.Serialization.Tests.NumberHandlingTestsDynamic.Number_AsCollectionElement_RoundTrip
[14:41:25] info: MONO_WASM: function signature mismatch
                 RuntimeError: function signature mismatch
                     at aot_instances_aot_wrapper_gsharedvt_out_sig_obj_cl4c_Mono_dValueTuple_602_3cbyte_2c_20Mono_dValueTuple_602_3clong_2c_20long_3e_3e_
                     at corlib_System_Collections_Generic_List_1_Enumerator_T_GSHAREDVT_System_Collections_IEnumerator_get_Current
                     at System_Collections_NonGeneric_System_Collections_Queue__ctor_System_Collections_ICollection
                     ...

The missing wrapper signature gsharedvt_out_sig_obj(ValueTuple<byte,(long,long)>) corresponds to object(Nullable<Int128>).

Root cause / relationship to existing issues

• This is the WASM manifestation of [iOS] [System.Text.Json] Number_AsCollectionElement_RoundTrip test failure on device #66220 (same gsharedvt_out_sig "function signature mismatch" crash; previously seen on Apple mobile).
• PR [mono][wasm][AOT] Generate gsharedvt out-sig wrappers for Nullable<T>.Box/Unbox #131049 attempted to fix this in the AOT compiler and removed the !PlatformDetection.IsBrowser skip, re-enabling the NullableInt128s / NullableUInt128s / NullableHalfs cases of Number_AsCollectionElement_RoundTrip on Browser (see NumberHandlingTests.cs).
• The AOT-compiler fix in [mono][wasm][AOT] Generate gsharedvt out-sig wrappers for Nullable<T>.Box/Unbox #131049 adds Nullable<T>.Box/Unbox to the compile set for concrete Nullable<T> instantiations reached via each assembly's TYPESPEC table. In this CI configuration the corelib is AOT-compiled but the test assembly (System.Text.Json.Tests) runs in the interpreter, so Nullable<Int128> is never instantiated in the AOT'd corelib's TYPESPEC table — the object(Nullable<Int128>) out-sig wrapper is therefore still absent, and the interpreted jit_call traps with a signature mismatch. The fix is incomplete for the AOT-corelib + interpreted-app scenario.

This is a deterministic failure (it fires every time the test runs), not a flake, so it blocks clean CI on unrelated PRs.

Recommended action

1. Immediate: re-add the !PlatformDetection.IsBrowser guard around the NullableInt128s / NullableUInt128s / NullableHalfs cases in Number_AsCollectionElement_RoundTrip to unblock CI (reverting the test-enablement half of [mono][wasm][AOT] Generate gsharedvt out-sig wrappers for Nullable<T>.Box/Unbox #131049 while keeping its AOT-compiler change).
2. Follow-up: complete the AOT-compiler fix so the required object(Nullable<T>) / Nullable<T>(object) gsharedvt out-sig wrappers are emitted for novel struct payloads reachable from the interpreter, i.e. when the corelib is AOT'd but the consuming assembly is interpreted.

cc @lewing @BrzVlad

Known issue validation

Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1531463
Error message validated: [Number_AsCollectionElement_RoundTrip function signature mismatch]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 7/29/2026 4:35:19 PM UTC

Report

Summary