Skip to content

Avoid incorrectly resolving a MonoClass for MONO_TYPE_GENERICINST when loading custom attribute values. - #123439

Merged
steveisok merged 10 commits into
dotnet:mainfrom
Venkad000:roslynfix
Apr 6, 2026
Merged

Avoid incorrectly resolving a MonoClass for MONO_TYPE_GENERICINST when loading custom attribute values.#123439
steveisok merged 10 commits into
dotnet:mainfrom
Venkad000:roslynfix

Conversation

@Venkad000

@Venkad000Venkad000 commented Jan 21, 2026

Copy link
Copy Markdown
Contributor

Avoid incorrectly resolving a MonoClass for MONO_TYPE_GENERICINST when loading custom attribute values.

load_cattr_value() previously unconditionally called m_type_data_get_klass(), which is invalid for GENERICINST and could lead to incorrect behavior when processing generic enum instances. This change defers class resolution for MONO_TYPE_GENERICINST and handles enum generic instances explicitly by extracting the underlying element type. This fixes a crash when decoding custom attributes involving generic types.

This crashes in Mono but doesn't in CoreClr

using System;
using System.Collections;
using System.Reflection;
using System.Runtime.InteropServices;
var attr = typeof(C).CustomAttributes.Single(d => d.AttributeType == typeof(A));
var arg = attr.ConstructorArguments.Single();
Console.WriteLine(arg.GetType());
class A : Attribute
{
public unsafe A(B<delegate*<void>[]>.E e) { }
} class B<T>
{
public enum E { }
}
[A(default)]
unsafe class C { }

Output on CoreClr:

System.Reflection.CustomAttributeTypedArgument

Output on Mono without fix:

MonoType with type 21 accessed by m_type_data_get_klass
=================================================================
Native Crash Reporting
=================================================================
Got a SIGABRT while executing native code. This usually indicates
a fatal error in the mono runtime or one of the native libraries used by your application.
=================================================================
=================================================================
Native stacktrace:
=================================================================
0x7fa2a25ffd2f - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a25a3e0e - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a25ff5b1 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a2a29040 - /lib64/libc.so.6 : 0x7fa2a2a82e5c - /lib64/libc.so.6 : 0x7fa2a2a28f0e - /lib64/libc.so.6 : gsignal
0x7fa2a2a106d0 - /lib64/libc.so.6 : abort
0x7fa2a26ac244 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a26b9e06 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a26ac606 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a26ac73e - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a277445b - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a277408d - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a276ee74 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a276e9c4 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : mono_reflection_create_custom_attr_data_args
0x7fa2a276fdbf - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a2704f08 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x4037366b - Unknown

Output on Mono with fix:

System.Reflection.CustomAttributeTypedArgument

@dotnet-policy-servicedotnet-policy-serviceBot added the community-contribution Indicates that the PR has been added by a community member label Jan 21, 2026
@github-actionsgithub-actionsBot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Jan 21, 2026
@lewinglewing added area-VM-meta-mono and removed needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Jan 21, 2026
CopilotAI mentioned this pull request Jan 21, 2026
Draft
@build-analysisbuild-analysisBot mentioned this pull request Jan 21, 2026
Closed
CopilotAI added a commit that referenced this pull request Jan 21, 2026
@lewing
Merge PR#123439Mono fix into test branch
5542a1f
Co-authored-by: lewing <24063+lewing@users.noreply.github.com>
This was referenced Jan 24, 2026
Open
Open
Closed
@Venkad000

Venkad000 commented Jan 28, 2026

Copy link
Copy Markdown
ContributorAuthor

@lewing should i add test cases to verify this?

@lewing

lewing commented Jan 30, 2026

Copy link
Copy Markdown
Member

@lewing should i add test cases to verify this?

Sorry, Your PR looks good and I'm experimenting in #123445 with a test case as a follow-up.

This was referenced Jan 31, 2026
Closed
Open
lewing added a commit to lewing/runtime that referenced this pull request Feb 3, 2026
@lewing
Simplify test to use int[] instead of function pointer array
6b07e9f
Change test from delegate*<void>[] to int[] to avoid hitting
unrelated Mono function pointer type equality issue (dotnet#90308)
while still testing the original crash fix (MONO_TYPE_GENERICINST
handling in custom attribute decoding from PR dotnet#123439).
Verified:
- Test crashes on Mono WITHOUT the fix (m_type_data_get_klass error)
- Test passes on Mono WITH the fix
- Test passes on CoreCLR
lewing added a commit that referenced this pull request Feb 3, 2026
@lewing
Add test for custom attribute with generic enum array argument
52f4a3f
Add regression test for Mono crash when decoding custom attributes
with generic enum arguments involving arrays (PR #123439).
Uses GenericClassForEnum<int[]>.E to test the MONO_TYPE_GENERICINST
handling in custom attribute decoding.
lewing added a commit that referenced this pull request Feb 3, 2026
@lewing@MichalStrehovsky
Add test for custom attribute with generic enum array argument
a33c5e6
Add regression test for Mono crash when decoding custom attributes
with generic enum arguments involving arrays (PR #123439).
Uses GenericClassForEnum<int[]>.E to test the MONO_TYPE_GENERICINST
handling in custom attribute decoding.
Co-authored-by: Michal Strehovsky <MichalStrehovsky@users.noreply.github.com>
@Venkad000

Venkad000 commented Feb 5, 2026

Copy link
Copy Markdown
ContributorAuthor

Can we merge this?

@giritrivedi

giritrivedi commented Feb 6, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

@copilot
Can you check if everything is good and merger this PR. ?

@saitama951

saitama951 commented Feb 13, 2026

Copy link
Copy Markdown
Contributor

@lewing is the test case experimentation complete? can this be merged yet?

This was referenced Feb 23, 2026
Open
Closed
Closed
Closed
@giritrivedi

giritrivedi commented Mar 9, 2026

Copy link
Copy Markdown
Contributor

Can this be merged ?

@steveisok
steveisok enabled auto-merge (squash) April 6, 2026 16:53
@steveisok

steveisok commented Apr 6, 2026

Copy link
Copy Markdown
Member

/ba-g Generic known issues

@steveisok
steveisok merged commit f7fcd1c into dotnet:mainApr 6, 2026
74 of 76 checks passed
@Venkad000
Venkad000 deleted the roslynfix branch April 7, 2026 05:11
@dotnet-maestrodotnet-maestroBot mentioned this pull request Apr 8, 2026
Merged
radekdoulik pushed a commit to radekdoulik/runtime that referenced this pull request Apr 9, 2026
@Venkad000@lewing@radekdoulik
Avoid incorrectly resolving a MonoClass for MONO_TYPE_GENERICINST whe…
d68074f
…n loading custom attribute values. (dotnet#123439)
Avoid incorrectly resolving a MonoClass for `MONO_TYPE_GENERICINST` when
loading custom attribute values.
`load_cattr_value()` previously unconditionally called
`m_type_data_get_klass()`, which is invalid for `GENERICINST` and could
lead to incorrect behavior when processing generic enum instances. This
change defers class resolution for `MONO_TYPE_GENERICINST` and handles
enum generic instances explicitly by extracting the underlying element
type. This fixes a crash when decoding custom attributes involving
generic types.
#### This crashes in Mono but doesn't in CoreClr
```
using System;
using System.Collections;
using System.Reflection;
using System.Runtime.InteropServices;
var attr = typeof(C).CustomAttributes.Single(d => d.AttributeType == typeof(A));
var arg = attr.ConstructorArguments.Single();
Console.WriteLine(arg.GetType());
class A : Attribute
{
public unsafe A(B<delegate*<void>[]>.E e) { }
} class B<T>
{
public enum E { }
}
[A(default)]
unsafe class C { }
```
#### Output on CoreClr:
```
System.Reflection.CustomAttributeTypedArgument
```
#### Output on Mono without fix:
```
MonoType with type 21 accessed by m_type_data_get_klass
=================================================================
Native Crash Reporting
=================================================================
Got a SIGABRT while executing native code. This usually indicates
a fatal error in the mono runtime or one of the native libraries used by your application.
=================================================================
=================================================================
Native stacktrace:
=================================================================
0x7fa2a25ffd2f - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a25a3e0e - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a25ff5b1 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a2a29040 - /lib64/libc.so.6 : 0x7fa2a2a82e5c - /lib64/libc.so.6 : 0x7fa2a2a28f0e - /lib64/libc.so.6 : gsignal
0x7fa2a2a106d0 - /lib64/libc.so.6 : abort
0x7fa2a26ac244 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a26b9e06 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a26ac606 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a26ac73e - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a277445b - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a277408d - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a276ee74 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a276e9c4 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : mono_reflection_create_custom_attr_data_args
0x7fa2a276fdbf - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x7fa2a2704f08 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 0x4037366b - Unknown
```
#### Output on Mono with fix:
```
System.Reflection.CustomAttributeTypedArgument
```
Co-authored-by: Larry Ewing <lewing@microsoft.com>
@pavelsavarapavelsavara mentioned this pull request Apr 16, 2026
Open
@github-actionsgithub-actionsBot locked and limited conversation to collaborators May 7, 2026
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@lewinglewinglewing approved these changes
@steveisoksteveisoksteveisok approved these changes
@thaystgthaystgAwaiting requested review from thaystgthaystg is a code owner
@vitek-karasvitek-karasAwaiting requested review from vitek-karasvitek-karas is a code owner

Assignees

No one assigned

Labels

area-VM-meta-monocommunity-contributionIndicates that the PR has been added by a community member

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Venkad000@lewing@giritrivedi@saitama951@steveisok