UnsafeAccessorType targeting non-existing type crashing on Linux

[jkotas]

Repro:

dotnet run -c release on Linux:

using System.Runtime.CompilerServices;

for (int i = 0; ; i++)
{
    Console.WriteLine(i);
    Work(false);
}

[MethodImpl(MethodImplOptions.NoInlining)]
static void Work(bool f)
{
    if (f)
        DoesNotExist(null);
}

[UnsafeAccessor(UnsafeAccessorKind.Method)]
extern static void DoesNotExist([UnsafeAccessorType("DoesNotExist")] object a);

Actual result:

Crash with no error message after several thousands of iterations

Expected result:

Runs indefinitely

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-runtime-compilerservices
See info in area-owners.md if you want to be subscribed.

[jkotas]

More context dotnet/efcore#36242 (comment)

[jkotas]

cc @AaronRobinsonMSFT @janvorli

[AaronRobinsonMSFT]

This is what I see on macOS (M3).

* thread #8, stop reason = signal SIGABRT
  * frame #0: 0x000000018364d388 libsystem_kernel.dylib`__pthread_kill + 8
    frame #1: 0x000000018368688c libsystem_pthread.dylib`pthread_kill + 296
    frame #2: 0x000000018358fc60 libsystem_c.dylib`abort + 124
    frame #3: 0x00000001041dfff8 libcoreclr.dylib`PROCAbort(signal=6, siginfo=0x0000000000000000) at process.cpp:2566:5 [opt]
    frame #4: 0x00000001041dfd40 libcoreclr.dylib`PROCEndProcess(hProcess=0x00000000ffffff01, uExitCode=3762504530, bTerminateUnconditionally=YES) at process.cpp:1323:13 [opt]
    frame #5: 0x00000001041dfdd8 libcoreclr.dylib`TerminateProcess(hProcess=0x00000000ffffff01, uExitCode=3762504530) at process.cpp:1220:11 [opt]
    frame #6: 0x0000000103e19f1c libcoreclr.dylib`CrashDumpAndTerminateProcess(exitCode=<unavailable>) at excep.cpp:3945:5 [opt] [artificial]
    frame #7: 0x00000001040c439c libcoreclr.dylib`SfiNext(pThis=0x000000016d8699e0, uExCollideClauseIdx=0x000000016d869578, fUnwoundReversePInvoke=0x000000016d869580, pfIsExceptionIntercepted=<unavailable>) at exceptionhandling.cpp:4040:21 [opt]
    frame #8: 0x0000000105861784
    frame #9: 0x0000000105860c28
    frame #10: 0x000000010417582c libcoreclr.dylib`CallDescrWorkerInternal + 132
    frame #11: 0x0000000103f5608c libcoreclr.dylib`CallDescrWorkerWithHandler(pCallDescrData=0x000000016d8696f0, fCriticalCall=<unavailable>) at callhelpers.cpp:59:5 [opt]
    frame #12: 0x0000000103f56460 libcoreclr.dylib`DispatchCallSimple(pSrc=0x000000016d8698e0, numStackSlotsToCopy=0, pTargetAddress=4420932216, dwDispatchCallSimpleFlags=1) at callhelpers.cpp:235:9 [opt]
    frame #13: 0x00000001040be08c libcoreclr.dylib`DispatchManagedException(throwable=OBJECTREF @ 0x000000016d86aa48, pExceptionContext=0x000000016d86ab40, pExceptionRecord=<unavailable>) at exceptionhandling.cpp:1665:5 [opt]
    frame #14: 0x0000000103fe9ff4 libcoreclr.dylib`IL_Throw(obj=<unavailable>) at jithelpers.cpp:879:5 [opt]
    frame #15: 0x00000001058ddc08
    frame #16: 0x00000001058dd490
    frame #17: 0x00000001058ddc9c
    frame #18: 0x00000001058dcedc
    frame #19: 0x000000010417582c libcoreclr.dylib`CallDescrWorkerInternal + 132
    frame #20: 0x0000000103f5608c libcoreclr.dylib`CallDescrWorkerWithHandler(pCallDescrData=0x000000016d86b200, fCriticalCall=<unavailable>) at callhelpers.cpp:59:5 [opt]
    frame #21: 0x0000000103f56460 libcoreclr.dylib`DispatchCallSimple(pSrc=0x000000016d86b358, numStackSlotsToCopy=0, pTargetAddress=4417361152, dwDispatchCallSimpleFlags=0) at callhelpers.cpp:235:9 [opt]
    frame #22: 0x0000000104087940 libcoreclr.dylib`GetTypeHelper(szTypeName=u"DoesNotExist", pRequestingAssembly=<unavailable>, bThrowIfNotFound=YES, bRequireAssemblyQualifiedName=NO, unsafeAccessorMethod=0x000000010748ce40) at typeparse.cpp:43:5 [opt]
    frame #23: 0x00000001040881bc libcoreclr.dylib`MethodDesc::TryGenerateUnsafeAccessor(DynamicResolver**, COR_ILMETHOD_DECODER**) [inlined] (anonymous namespace)::ProcessUnsafeAccessorTypeAttributes(cxt=0x000000016d86b520) at unsafeaccessors.cpp:338:37 [opt]
    frame #24: 0x0000000104087dc8 libcoreclr.dylib`MethodDesc::TryGenerateUnsafeAccessor(this=<unavailable>, resolver=0x000000016d86c1c8, methodILDecoder=0x000000016d86c1c0) at unsafeaccessors.cpp:1046:5 [opt]

[AaronRobinsonMSFT]

@janvorli Let me know if there is something I can provide to help with this. I'll try to look into it, but this looks like we're in the unwind logic, which isn't an area I'm very familiar with.

[AaronRobinsonMSFT]

Some managed details. This is from a different run, so the addresses don't relate to the previous native stack above.

This issue is easily reproducible on macOS with the supplied source code. It takes approximately 100,000 iterations +/- 15,000. On a Checked build, < 2 seconds.

(lldb) clrstack
OS Thread Id: 0xd0dccf (8)
        Child SP               IP Call Site
000000016E5554E0 000000018364d388 [InlinedCallFrame: 000000016e5554e0] 
000000016E5554E0 000000010440175c [InlinedCallFrame: 000000016e5554e0] 
000000016E555490 000000010440175C System.Runtime.EH.DispatchEx(System.Runtime.StackFrameIterator ByRef, ExInfo ByRef)
000000016E5555F0 0000000104400C28 System.Runtime.EH.RhThrowEx(System.Object, ExInfo ByRef)
000000016E556A80 000000010356982c [SoftwareExceptionFrame: 000000016e556a80] 
000000016E556F60 000000010447DC08 System.Reflection.TypeNameResolver.GetTypeFromDefaultAssemblies(System.String, System.ReadOnlySpan`1<System.String>, System.Reflection.Metadata.TypeName)
000000016E556FB0 000000010447D490 System.Reflection.TypeNameResolver.GetType(System.String, System.ReadOnlySpan`1<System.String>, System.Reflection.Metadata.TypeName)
000000016E557090 000000010447DC9C System.Reflection.TypeNameResolver.Resolve(System.Reflection.Metadata.TypeName)
000000016E5570C0 000000010447CEDC System.Reflection.TypeNameResolver.GetTypeHelper(System.ReadOnlySpan`1<Char>, System.Reflection.RuntimeAssembly, Boolean, Boolean, IntPtr)
000000016E55ADE0 000000010356982c [DebuggerU2MCatchHandlerFrame: 000000016e55ade0] 

(lldb) pe
WARNING: SOS needs to be upgraded for this version of the runtime. Some commands may not work correctly.
For more information see https://go.microsoft.com/fwlink/?linkid=2135652

Exception object: 00000003001ae008
Exception type:   System.TypeLoadException
Message:          Could not resolve type 'DoesNotExist' in assembly 'UnsafeAccessorsTests, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null'.
InnerException:   <none>
StackTrace (generated):
    SP               IP               Function
    000000016E556F60 000000010447DC04 System.Private.CoreLib.dll!System.Reflection.TypeNameResolver.GetTypeFromDefaultAssemblies(System.String, System.ReadOnlySpan`1<System.String>, System.Reflection.Metadata.TypeName)+0x284
    000000016E556FB0 000000010447D48C System.Private.CoreLib.dll!System.Reflection.TypeNameResolver.GetType(System.String, System.ReadOnlySpan`1<System.String>, System.Reflection.Metadata.TypeName)+0x3dc
    000000016E557090 000000010447DC98 System.Private.CoreLib.dll!System.Reflection.TypeNameResolver.Resolve(System.Reflection.Metadata.TypeName)+0x38
    000000016E5570C0 000000010447CED8 System.Private.CoreLib.dll!System.Reflection.TypeNameResolver.GetTypeHelper(System.ReadOnlySpan`1<Char>, System.Reflection.RuntimeAssembly, Boolean, Boolean, IntPtr)+0x88

StackTraceString: <none>
HResult: 80131522

[AaronRobinsonMSFT]

I enabled logging using DOTNET_Facility=4000. Below is "pass 1" and indeed it fails to find a handler. Looking up the stack I find CEEInfo::runWithErrorTrap (coreclr/vm/jitinterface.cpp) which has a EX_TRY exception handler on TARGET_UNIX but PAL_TRY on non-Unix, which isn't intuitive to me. It also has a comment that seems relevant.

    // We shouldn't need PAL_TRY on *nix: any exceptions that we are able to catch
    // ought to originate from the runtime itself and should be catchable inside of
    // EX_TRY/EX_CATCH, including emulated SEH exceptions.
    EX_TRY
    {
        function(param);
    }
    EX_CATCH
    {
        success = false;
    }
    EX_END_CATCH(RethrowTerminalExceptions);

TID eef0e2: ..SfiInit (pass 1): Exception stack walking starting at IP=0x1082bdc04, SP=0x16bf4af60, method System.Reflection.TypeNameResolver::GetTypeFromDefaultAssemblies
TID eef0e2: StackTraceInfo::AppendElement IP = 0x1082bdc08, SP = 0x16bf4af60, System.Reflection.TypeNameResolver::GetTypeFromDefaultAssemblies
TID eef0e2: ..Initialized EH enumeration, 0 clauses found
TID eef0e2: ..SfiNext (pass 1): returning managed frame at IP=0x1082bd48c, SP=0x16bf4afb0, method System.Reflection.TypeNameResolver::GetType
TID eef0e2: StackTraceInfo::AppendElement IP = 0x1082bd490, SP = 0x16bf4afb0, System.Reflection.TypeNameResolver::GetType
TID eef0e2: ..Initialized EH enumeration, 0 clauses found
TID eef0e2: ..SfiNext (pass 1): returning managed frame at IP=0x1082bdc98, SP=0x16bf4b090, method System.Reflection.TypeNameResolver::Resolve
TID eef0e2: StackTraceInfo::AppendElement IP = 0x1082bdc9c, SP = 0x16bf4b090, System.Reflection.TypeNameResolver::Resolve
TID eef0e2: ..Initialized EH enumeration, 0 clauses found
TID eef0e2: ..SfiNext (pass 1): returning managed frame at IP=0x1082bced8, SP=0x16bf4b0c0, method System.Reflection.TypeNameResolver::GetTypeHelper
TID eef0e2: StackTraceInfo::AppendElement IP = 0x1082bcedc, SP = 0x16bf4b0c0, System.Reflection.TypeNameResolver::GetTypeHelper
TID eef0e2: ..Initialized EH enumeration, 0 clauses found
TID eef0e2: ..SfiNext: reached native frame at IP=0x105bb182c, SP=0x16bf4b120, invalidRevPInvoke=0
TID eef0e2: ..SfiNext: the native frame is CallDescrWorkerInternal..SfiNext (pass 1): no more managed frames on the stack, the exception is unhandledInternalUnhandledExceptionFilter_Worker: Set unhandled exception flag at 0x16bf49960
TID eef0e2: InternalUnhandledExceptionFilter_Worker: Handling
TID eef0e2: InternalUnhandledExceptionFilter_Worker: Notifying Debugger...
TID eef0e2: In NotifyAppDomainsOfUnhandledException
TID eef0e2: InternalUnhandledExceptionFilter_Worker: Launching Watson at sp 0x16bf49110 ...
TID eef0e2: D::WLC: Enter WatsonLastChance
TID eef0e2: WatsonLastChance: should not notify debugger.  Returning EXCEPTION_CONTINUE_SEARCH
TID eef0e2: InternalUnhandledExceptionFilter_Worker: ... returned.
TID eef0e2: InternalUnhandledExceptionFilter_Worker: Calling DefaultCatchHandler
TID eef0e2: In DefaultCatchHandler

[janvorli]

I have debugged it locally. The crash occurs on the tiered compilation thread. The problem is that the logic that detects whether an exception is unhandled or not doesn't take into account the possibility of the exception being caught by the Compiler::eeRunWithErrorTrap. When we walk out of the last managed frame on the stack during the EH, we only take into account the presence of DebuggerU2MCatchHandlerFrame specially marked as handling all exceptions as an indication of the exception being handled by the runtime. We need to take the compiler into account too.