Regression in 16.10.0 release results in System.BadImageFormatException

[kentcb]

Since the 16.10.0 VS update, the below code produces a BadImageFormatException. Prior to that release, it works as expected.

Repro steps

module Repro

type Data = interface end
and Service<'Data when 'Data :> Data>() = class end

type IThing = interface end
and Thing<'T> = { Metadata: 'T } with interface IThing

let createService metadata = (Service<'Data>())

let getCreateServiceCallback<'T> (thing: IThing) =
 let upcastThing =
 thing
 :?> Thing<'T>
 let getService () = createService upcastThing.Metadata
 (fun () -> getService)

[<EntryPoint>]
let main _ =
 let dummyThing : Thing<int> = { Thing.Metadata = 42 }
 // crash occurs on the following line
 let callback = getCreateServiceCallback<int> dummyThing
 let resolvedService = callback ()
 printfn "Resolved service: %A" resolvedService
 System.Console.ReadKey() |> ignore
 0

Expected behavior

Code should work as it did prior to 16.10.0, or at least produce a compiler error.

Actual behavior

Crashes with BadImageFormatException on the indicated line.

Known workarounds

• Marking the getService function as inline
• Explicitly annotating the getService return type as Service<Data>
• Run in release mode

Related information

• Windows 10
• .NET 5
• Visual Studio 2019

[cartermp]

Thanks for the repro, I can confirm it. I suspect we did regress somewhere here given that it still works in release mode. cc @TIHan

[TIHan]

Testing this, in Release, it does work however, I can't open the binary in ILSpy or ILDASM.
I'm not sure yet why this is occurring.

[TIHan]

peverify just tells us that it has bad headers.

[TIHan]

So, getService is type unit -> Service<#Data> - so being explicit with the return type via unit -> Service<Data> makes it a different type.

unit -> Service<#Data> tells us it found a free type variable due to #Data. This means getService is a forall type.
With it being captured in a closure, this might be the source of the issue. In release, this closure is probably getting erased.

[TIHan]

I can confirm: This regression occurred when this was merged - #11349 .

However, the initial fix df4969b works fine. It was only until subsequent changes to the PR where we tried to simplify the local type functions does this regression occur.
cc @dsyme