Description
Calling ICorProfilerInfo10::RequestReJITWithInliners on certain methods can result in AV inside the runtime, leading to the program to crash with the output:
Fatal error. Internal CLR error. (0x80131506)
I haven't identified exactly what's unique about the methods that can cause this, but they seem to primarily be certain getters/setters. One method I can use to consistently trigger this problem is: System.Security.Cryptography.Xml.dll!System.Security.Cryptography.Xml.EncryptedXml.get_Encoding in an aspnet application that has recently started.
Crash information
Exception and callstack:
(2698.5640): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
coreclr!MethodDesc::GetMethodDescIndex [inlined in coreclr!CodeVersionManager::GetActiveILCodeVersion+0x6]:
> k
00 coreclr!MethodDesc::GetMethodDescIndex [D:\a\_work\1\s\src\coreclr\vm\method.hpp @ 2568]
01 coreclr!MethodDesc::GetMethodDescChunk [D:\a\_work\1\s\src\coreclr\vm\method.hpp @ 2575]
02 coreclr!MethodDesc::GetMemberDef_NoLogging [D:\a\_work\1\s\src\coreclr\vm\method.hpp @ 3821]
03 coreclr!MethodDesc::GetMemberDef [D:\a\_work\1\s\src\coreclr\vm\method.hpp @ 3835]
04 coreclr!CodeVersionManager::GetActiveILCodeVersion+0x6 [D:\a\_work\1\s\src\coreclr\vm\codeversion.cpp @ 1377]
05 coreclr!ReJitManager::UpdateNativeInlinerActiveILVersions+0x1b5 [D:\a\_work\1\s\src\coreclr\vm\rejit.cpp @ 830]
06 coreclr!ReJitManager::UpdateActiveILVersions+0x16a [D:\a\_work\1\s\src\coreclr\vm\rejit.cpp @ 626]
07 coreclr!ReJitManager::RequestReJIT+0x17 [D:\a\_work\1\s\src\coreclr\vm\rejit.cpp @ 533]
08 coreclr!ProfToEEInterfaceImpl::RequestReJITWithInliners+0x161 [D:\a\_work\1\s\src\coreclr\vm\proftoeeinterfaceimpl.cpp @ 6852]
...
Of note in coreclr!ReJitManager::UpdateNativeInlinerActiveILVersions, the below GetMethodDesc() appears to returns NULL and isn't checked, which ultimately leads to the AV later on:
|
pInliner = inlinerIter.GetMethodDesc(); |
Other locals from this frame:
0:013> .frame 05 ; dv /t
05 000000cc`ad7ff3e0 00007fff`8e644c2e coreclr!ReJitManager::UpdateNativeInlinerActiveILVersions+0x1b5 [D:\a\_work\1\s\src\coreclr\vm\rejit.cpp @ 830]
class SHash<ReJitManager::CodeActivationBatchTraits> * pMgrToCodeActivationBatch = 0x000000cc`ad7ff580
class MethodDesc * pInlinee = 0x00007fff`2fab8070
int fIsRevert = 0n0
__MIDL___MIDL_itf_corprof_0000_0000_0012 flags = COR_PRF_REJIT_BLOCK_INLINING (0n1)
class AppDomain::AssemblyIterator domainAssemblyIterator = class AppDomain::AssemblyIterator
class NativeImageInliningIterator inlinerIter = class NativeImageInliningIterator
HRESULT hr = <value unavailable>
class CollectibleAssemblyHolder<DomainAssembly *> pDomainAssembly = class CollectibleAssemblyHolder<DomainAssembly *>
class DomainAssembly::ModuleIterator domainModuleIterator = class DomainAssembly::ModuleIterator
class Module * pCurModule = 0x00007fff`2fab7510
class MethodDesc * pInliner = 0x00000000`00000000
class ILCodeVersion ilVersion = class ILCodeVersion
class CodeVersionManager::LockHolder codeVersioningLockHolder = class CodeVersionManager::LockHolder
class CodeVersionManager * pCodeVersionManager = <value unavailable>
Reproduction Steps
Call RequestReJITWithInliners on System.Security.Cryptography.Xml.dll!System.Security.Cryptography.Xml.EncryptedXml.get_Encoding in an aspnet6 application that has recently started.
Expected behavior
ICorProfilerCallback4::ReJITError is called if the method can't be rejitted.
Actual behavior
The app crashes with:
Fatal error. Internal CLR error. (0x80131506)
Regression?
No response
Known Workarounds
No response
Configuration
Issues happens on net6 (6.0.20, only tested on Windows so far). I haven't been able to repro it on net7.0 or net8.0.
Other information
I did a quick search, and it may be possibly related to this PR: #69634 as this change isn't backported to net6.0
Description
Calling
ICorProfilerInfo10::RequestReJITWithInlinerson certain methods can result in AV inside the runtime, leading to the program to crash with the output:I haven't identified exactly what's unique about the methods that can cause this, but they seem to primarily be certain getters/setters. One method I can use to consistently trigger this problem is:
System.Security.Cryptography.Xml.dll!System.Security.Cryptography.Xml.EncryptedXml.get_Encodingin an aspnet application that has recently started.Crash information
Exception and callstack:
Of note in
coreclr!ReJitManager::UpdateNativeInlinerActiveILVersions, the belowGetMethodDesc()appears to returnsNULLand isn't checked, which ultimately leads to the AV later on:runtime/src/coreclr/vm/rejit.cpp
Line 825 in a08d9ce
Other locals from this frame:
Reproduction Steps
Call
RequestReJITWithInlinersonSystem.Security.Cryptography.Xml.dll!System.Security.Cryptography.Xml.EncryptedXml.get_Encodingin an aspnet6 application that has recently started.Expected behavior
ICorProfilerCallback4::ReJITErroris called if the method can't be rejitted.Actual behavior
The app crashes with:
Regression?
No response
Known Workarounds
No response
Configuration
Issues happens on net6 (6.0.20, only tested on Windows so far). I haven't been able to repro it on net7.0 or net8.0.
Other information
I did a quick search, and it may be possibly related to this PR: #69634 as this change isn't backported to net6.0