Skip to content

[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects - #125212

Merged
jozkee merged 1 commit into
release/9.0-stagingfrom
backport/pr-125116-to-release/9.0-staging
Mar 11, 2026
Merged

[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects#125212
jozkee merged 1 commit into
release/9.0-stagingfrom
backport/pr-125116-to-release/9.0-staging

Conversation

@github-actions

@github-actionsgithub-actionsBot commented Mar 5, 2026•
edited by BrzVlad
Loading

Copy link
Copy Markdown
Contributor

Backport of #125116 to release/9.0-staging

/cc @BrzVlad

Customer Impact

  • Customer reported
  • Found internally

In some cases, cards marked for non-array LOS objects (objects with size greater than 8K) were being ignored. This means that the GC could fail to observe that some object refs were stored inside these large objects. This can result in GC crashes or other undefined behavior. This can impact all mono workloads. This issue was confirmed to be hit by a customer who also investigated it via a GC debug flag. There are other undiagnosed GC crashes that might hopefully be fixed by this.

Regression

  • Yes
  • No

Testing

Was able to create a console app reproducing this bug. Validated the fix.

Risk

Low. The fix just does an address alignment, in order to scan correctly an additional card.

@BrzVlad
[mono][sgen] Fix card scanning in LOS non-array objects
811a4a3
`sgen_card_table_region_begin_scanning` needs to determine whether any cards are marked in the object starting at `start` address. The current card size in 512 bytes. Consider an object with start 500 and size 20, so this object lives within 2 cards. We will check the card associated with the address 500. Once this iteration is done, we will check whether `start + card_size < end` => `500 + 512 < 520`. This is false, so we will no longer scan the second card. The algorithm was expecting the start address to be aligned to the card start, which is what the fix does.
This bug is severe, but, in practice, this code path is not as frequent. This bug would only affect objects greater than 8k, that are not arrays.
This was referenced Mar 5, 2026
Open
Closed
Closed
@BrzVladBrzVlad added the Servicing-approved Approved for servicing release label Mar 6, 2026
@jozkee

jozkee commented Mar 11, 2026

Copy link
Copy Markdown
Member

@BrzVlad reminder that tomorrow is code complete.

@jozkee

jozkee commented Mar 11, 2026

Copy link
Copy Markdown
Member

/ba-g build failures are fixed by #125462

@jozkee
jozkee merged commit a9a230d into release/9.0-stagingMar 11, 2026
74 of 81 checks passed
@jozkee
jozkee deleted the backport/pr-125116-to-release/9.0-staging branch March 11, 2026 23:43
@github-actionsgithub-actionsBot locked and limited conversation to collaborators Apr 11, 2026
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@BrzVladBrzVladBrzVlad approved these changes
@lambdageeklambdageekAwaiting requested review from lambdageeklambdageek is a code owner

Assignees

@github-actionsgithub-actions[bot]

Labels

area-VM-meta-monoServicing-approvedApproved for servicing release

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jozkee@BrzVlad
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects by github-actions[bot] · Pull Request #125212 · dotnet/runtime · GitHub
Skip to content
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects - #125212
Merged
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Mar 11, 2026
Merged
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects#125212
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 5, 2026•

edited by BrzVlad

Loading

Copy link


Copy Markdown

Contributor
Backport of #125116 to release/9.0-staging
/cc @BrzVlad
Customer Impact
  •  Customer reported
  •  Found internally
In some cases, cards marked for non-array LOS objects (objects with size greater than 8K) were being ignored. This means that the GC could fail to observe that some object refs were stored inside these large objects. This can result in GC crashes or other undefined behavior. This can impact all mono workloads. This issue was confirmed to be hit by a customer who also investigated it via a GC debug flag. There are other undiagnosed GC crashes that might hopefully be fixed by this.
Regression
  •  Yes
  •  No
Testing
Was able to create a console app reproducing this bug. Validated the fix.
Risk
Low. The fix just does an address alignment, in order to scan correctly an additional card.
@BrzVlad
[mono][sgen] Fix card scanning in LOS non-array objects
811a4a3
`sgen_card_table_region_begin_scanning` needs to determine whether any cards are marked in the object starting at `start` address. The current card size in 512 bytes. Consider an object with start 500 and size 20, so this object lives within 2 cards. We will check the card associated with the address 500. Once this iteration is done, we will check whether `start + card_size < end` => `500 + 512 < 520`. This is false, so we will no longer scan the second card. The algorithm was expecting the start address to be aligned to the card start, which is what the fix does.
This bug is severe, but, in practice, this code path is not as frequent. This bug would only affect objects greater than 8k, that are not arrays.

This was referenced Mar 5, 2026

Open


Closed


Closed

@BrzVladBrzVlad
added
the 
Servicing-approved
Approved for servicing release
label
Mar 6, 2026
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
@BrzVlad reminder that tomorrow is code complete.
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
/ba-g build failures are fixed by #125462
@jozkee
jozkee
merged commit a9a230d
into
release/9.0-stagingMar 11, 2026

74 of 81 checks passed

@jozkee
jozkee
deleted the

backport/pr-125116-to-release/9.0-staging

branch
March 11, 2026 23:43
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Apr 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@BrzVladBrzVladBrzVlad approved these changes
@lambdageeklambdageekAwaiting requested review from lambdageeklambdageek is a code owner

Assignees

@github-actionsgithub-actions[bot]

Labels

area-VM-meta-monoServicing-approvedApproved for servicing release

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jozkee@BrzVlad

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects by github-actions[bot] · Pull Request #125212 · dotnet/runtime · GitHub
Skip to content
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects - #125212
Merged
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Mar 11, 2026
Merged
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects#125212
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 5, 2026•

edited by BrzVlad

Loading

Copy link


Copy Markdown

Contributor
Backport of #125116 to release/9.0-staging
/cc @BrzVlad
Customer Impact
  •  Customer reported
  •  Found internally
In some cases, cards marked for non-array LOS objects (objects with size greater than 8K) were being ignored. This means that the GC could fail to observe that some object refs were stored inside these large objects. This can result in GC crashes or other undefined behavior. This can impact all mono workloads. This issue was confirmed to be hit by a customer who also investigated it via a GC debug flag. There are other undiagnosed GC crashes that might hopefully be fixed by this.
Regression
  •  Yes
  •  No
Testing
Was able to create a console app reproducing this bug. Validated the fix.
Risk
Low. The fix just does an address alignment, in order to scan correctly an additional card.
@BrzVlad
[mono][sgen] Fix card scanning in LOS non-array objects
811a4a3
`sgen_card_table_region_begin_scanning` needs to determine whether any cards are marked in the object starting at `start` address. The current card size in 512 bytes. Consider an object with start 500 and size 20, so this object lives within 2 cards. We will check the card associated with the address 500. Once this iteration is done, we will check whether `start + card_size < end` => `500 + 512 < 520`. This is false, so we will no longer scan the second card. The algorithm was expecting the start address to be aligned to the card start, which is what the fix does.
This bug is severe, but, in practice, this code path is not as frequent. This bug would only affect objects greater than 8k, that are not arrays.

This was referenced Mar 5, 2026

Open


Closed


Closed

@BrzVladBrzVlad
added
the 
Servicing-approved
Approved for servicing release
label
Mar 6, 2026
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
@BrzVlad reminder that tomorrow is code complete.
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
/ba-g build failures are fixed by #125462
@jozkee
jozkee
merged commit a9a230d
into
release/9.0-stagingMar 11, 2026

74 of 81 checks passed

@jozkee
jozkee
deleted the

backport/pr-125116-to-release/9.0-staging

branch
March 11, 2026 23:43
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Apr 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@BrzVladBrzVladBrzVlad approved these changes
@lambdageeklambdageekAwaiting requested review from lambdageeklambdageek is a code owner

Assignees

@github-actionsgithub-actions[bot]

Labels

area-VM-meta-monoServicing-approvedApproved for servicing release

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jozkee@BrzVlad

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects by github-actions[bot] · Pull Request #125212 · dotnet/runtime · GitHub
Skip to content
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects - #125212
Merged
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Mar 11, 2026
Merged
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects#125212
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 5, 2026•

edited by BrzVlad

Loading

Copy link


Copy Markdown

Contributor
Backport of #125116 to release/9.0-staging
/cc @BrzVlad
Customer Impact
  •  Customer reported
  •  Found internally
In some cases, cards marked for non-array LOS objects (objects with size greater than 8K) were being ignored. This means that the GC could fail to observe that some object refs were stored inside these large objects. This can result in GC crashes or other undefined behavior. This can impact all mono workloads. This issue was confirmed to be hit by a customer who also investigated it via a GC debug flag. There are other undiagnosed GC crashes that might hopefully be fixed by this.
Regression
  •  Yes
  •  No
Testing
Was able to create a console app reproducing this bug. Validated the fix.
Risk
Low. The fix just does an address alignment, in order to scan correctly an additional card.
@BrzVlad
[mono][sgen] Fix card scanning in LOS non-array objects
811a4a3
`sgen_card_table_region_begin_scanning` needs to determine whether any cards are marked in the object starting at `start` address. The current card size in 512 bytes. Consider an object with start 500 and size 20, so this object lives within 2 cards. We will check the card associated with the address 500. Once this iteration is done, we will check whether `start + card_size < end` => `500 + 512 < 520`. This is false, so we will no longer scan the second card. The algorithm was expecting the start address to be aligned to the card start, which is what the fix does.
This bug is severe, but, in practice, this code path is not as frequent. This bug would only affect objects greater than 8k, that are not arrays.

This was referenced Mar 5, 2026

Open


Closed


Closed

@BrzVladBrzVlad
added
the 
Servicing-approved
Approved for servicing release
label
Mar 6, 2026
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
@BrzVlad reminder that tomorrow is code complete.
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
/ba-g build failures are fixed by #125462
@jozkee
jozkee
merged commit a9a230d
into
release/9.0-stagingMar 11, 2026

74 of 81 checks passed

@jozkee
jozkee
deleted the

backport/pr-125116-to-release/9.0-staging

branch
March 11, 2026 23:43
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Apr 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@BrzVladBrzVladBrzVlad approved these changes
@lambdageeklambdageekAwaiting requested review from lambdageeklambdageek is a code owner

Assignees

@github-actionsgithub-actions[bot]

Labels

area-VM-meta-monoServicing-approvedApproved for servicing release

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jozkee@BrzVlad

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects by github-actions[bot] · Pull Request #125212 · dotnet/runtime · GitHub
Skip to content
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects - #125212
Merged
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Mar 11, 2026
Merged
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects#125212
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 5, 2026•

edited by BrzVlad

Loading

Copy link


Copy Markdown

Contributor
Backport of #125116 to release/9.0-staging
/cc @BrzVlad
Customer Impact
  •  Customer reported
  •  Found internally
In some cases, cards marked for non-array LOS objects (objects with size greater than 8K) were being ignored. This means that the GC could fail to observe that some object refs were stored inside these large objects. This can result in GC crashes or other undefined behavior. This can impact all mono workloads. This issue was confirmed to be hit by a customer who also investigated it via a GC debug flag. There are other undiagnosed GC crashes that might hopefully be fixed by this.
Regression
  •  Yes
  •  No
Testing
Was able to create a console app reproducing this bug. Validated the fix.
Risk
Low. The fix just does an address alignment, in order to scan correctly an additional card.
@BrzVlad
[mono][sgen] Fix card scanning in LOS non-array objects
811a4a3
`sgen_card_table_region_begin_scanning` needs to determine whether any cards are marked in the object starting at `start` address. The current card size in 512 bytes. Consider an object with start 500 and size 20, so this object lives within 2 cards. We will check the card associated with the address 500. Once this iteration is done, we will check whether `start + card_size < end` => `500 + 512 < 520`. This is false, so we will no longer scan the second card. The algorithm was expecting the start address to be aligned to the card start, which is what the fix does.
This bug is severe, but, in practice, this code path is not as frequent. This bug would only affect objects greater than 8k, that are not arrays.

This was referenced Mar 5, 2026

Open


Closed


Closed

@BrzVladBrzVlad
added
the 
Servicing-approved
Approved for servicing release
label
Mar 6, 2026
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
@BrzVlad reminder that tomorrow is code complete.
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
/ba-g build failures are fixed by #125462
@jozkee
jozkee
merged commit a9a230d
into
release/9.0-stagingMar 11, 2026

74 of 81 checks passed

@jozkee
jozkee
deleted the

backport/pr-125116-to-release/9.0-staging

branch
March 11, 2026 23:43
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Apr 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@BrzVladBrzVladBrzVlad approved these changes
@lambdageeklambdageekAwaiting requested review from lambdageeklambdageek is a code owner

Assignees

@github-actionsgithub-actions[bot]

Labels

area-VM-meta-monoServicing-approvedApproved for servicing release

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jozkee@BrzVlad

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects by github-actions[bot] · Pull Request #125212 · dotnet/runtime · GitHub
Skip to content
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects - #125212
Merged
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Mar 11, 2026
Merged
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects#125212
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 5, 2026•

edited by BrzVlad

Loading

Copy link


Copy Markdown

Contributor
Backport of #125116 to release/9.0-staging
/cc @BrzVlad
Customer Impact
  •  Customer reported
  •  Found internally
In some cases, cards marked for non-array LOS objects (objects with size greater than 8K) were being ignored. This means that the GC could fail to observe that some object refs were stored inside these large objects. This can result in GC crashes or other undefined behavior. This can impact all mono workloads. This issue was confirmed to be hit by a customer who also investigated it via a GC debug flag. There are other undiagnosed GC crashes that might hopefully be fixed by this.
Regression
  •  Yes
  •  No
Testing
Was able to create a console app reproducing this bug. Validated the fix.
Risk
Low. The fix just does an address alignment, in order to scan correctly an additional card.
@BrzVlad
[mono][sgen] Fix card scanning in LOS non-array objects
811a4a3
`sgen_card_table_region_begin_scanning` needs to determine whether any cards are marked in the object starting at `start` address. The current card size in 512 bytes. Consider an object with start 500 and size 20, so this object lives within 2 cards. We will check the card associated with the address 500. Once this iteration is done, we will check whether `start + card_size < end` => `500 + 512 < 520`. This is false, so we will no longer scan the second card. The algorithm was expecting the start address to be aligned to the card start, which is what the fix does.
This bug is severe, but, in practice, this code path is not as frequent. This bug would only affect objects greater than 8k, that are not arrays.

This was referenced Mar 5, 2026

Open


Closed


Closed

@BrzVladBrzVlad
added
the 
Servicing-approved
Approved for servicing release
label
Mar 6, 2026
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
@BrzVlad reminder that tomorrow is code complete.
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
/ba-g build failures are fixed by #125462
@jozkee
jozkee
merged commit a9a230d
into
release/9.0-stagingMar 11, 2026

74 of 81 checks passed

@jozkee
jozkee
deleted the

backport/pr-125116-to-release/9.0-staging

branch
March 11, 2026 23:43
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Apr 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@BrzVladBrzVladBrzVlad approved these changes
@lambdageeklambdageekAwaiting requested review from lambdageeklambdageek is a code owner

Assignees

@github-actionsgithub-actions[bot]

Labels

area-VM-meta-monoServicing-approvedApproved for servicing release

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jozkee@BrzVlad

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects by github-actions[bot] · Pull Request #125212 · dotnet/runtime · GitHub
Skip to content
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects - #125212
Merged
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Mar 11, 2026
Merged
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects#125212
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 5, 2026•

edited by BrzVlad

Loading

Copy link


Copy Markdown

Contributor
Backport of #125116 to release/9.0-staging
/cc @BrzVlad
Customer Impact
  •  Customer reported
  •  Found internally
In some cases, cards marked for non-array LOS objects (objects with size greater than 8K) were being ignored. This means that the GC could fail to observe that some object refs were stored inside these large objects. This can result in GC crashes or other undefined behavior. This can impact all mono workloads. This issue was confirmed to be hit by a customer who also investigated it via a GC debug flag. There are other undiagnosed GC crashes that might hopefully be fixed by this.
Regression
  •  Yes
  •  No
Testing
Was able to create a console app reproducing this bug. Validated the fix.
Risk
Low. The fix just does an address alignment, in order to scan correctly an additional card.
@BrzVlad
[mono][sgen] Fix card scanning in LOS non-array objects
811a4a3
`sgen_card_table_region_begin_scanning` needs to determine whether any cards are marked in the object starting at `start` address. The current card size in 512 bytes. Consider an object with start 500 and size 20, so this object lives within 2 cards. We will check the card associated with the address 500. Once this iteration is done, we will check whether `start + card_size < end` => `500 + 512 < 520`. This is false, so we will no longer scan the second card. The algorithm was expecting the start address to be aligned to the card start, which is what the fix does.
This bug is severe, but, in practice, this code path is not as frequent. This bug would only affect objects greater than 8k, that are not arrays.

This was referenced Mar 5, 2026

Open


Closed


Closed

@BrzVladBrzVlad
added
the 
Servicing-approved
Approved for servicing release
label
Mar 6, 2026
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
@BrzVlad reminder that tomorrow is code complete.
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
/ba-g build failures are fixed by #125462
@jozkee
jozkee
merged commit a9a230d
into
release/9.0-stagingMar 11, 2026

74 of 81 checks passed

@jozkee
jozkee
deleted the

backport/pr-125116-to-release/9.0-staging

branch
March 11, 2026 23:43
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Apr 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@BrzVladBrzVladBrzVlad approved these changes
@lambdageeklambdageekAwaiting requested review from lambdageeklambdageek is a code owner

Assignees

@github-actionsgithub-actions[bot]

Labels

area-VM-meta-monoServicing-approvedApproved for servicing release

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jozkee@BrzVlad

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects by github-actions[bot] · Pull Request #125212 · dotnet/runtime · GitHub
Skip to content
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects - #125212
Merged
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Mar 11, 2026
Merged
[release/9.0-staging] [mono][sgen] Fix card scanning in LOS non-array objects#125212
jozkee merged 1 commit into
release/9.0-stagingfrom 
backport/pr-125116-to-release/9.0-staging
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 5, 2026•

edited by BrzVlad

Loading

Copy link


Copy Markdown

Contributor
Backport of #125116 to release/9.0-staging
/cc @BrzVlad
Customer Impact
  •  Customer reported
  •  Found internally
In some cases, cards marked for non-array LOS objects (objects with size greater than 8K) were being ignored. This means that the GC could fail to observe that some object refs were stored inside these large objects. This can result in GC crashes or other undefined behavior. This can impact all mono workloads. This issue was confirmed to be hit by a customer who also investigated it via a GC debug flag. There are other undiagnosed GC crashes that might hopefully be fixed by this.
Regression
  •  Yes
  •  No
Testing
Was able to create a console app reproducing this bug. Validated the fix.
Risk
Low. The fix just does an address alignment, in order to scan correctly an additional card.
@BrzVlad
[mono][sgen] Fix card scanning in LOS non-array objects
811a4a3
`sgen_card_table_region_begin_scanning` needs to determine whether any cards are marked in the object starting at `start` address. The current card size in 512 bytes. Consider an object with start 500 and size 20, so this object lives within 2 cards. We will check the card associated with the address 500. Once this iteration is done, we will check whether `start + card_size < end` => `500 + 512 < 520`. This is false, so we will no longer scan the second card. The algorithm was expecting the start address to be aligned to the card start, which is what the fix does.
This bug is severe, but, in practice, this code path is not as frequent. This bug would only affect objects greater than 8k, that are not arrays.

This was referenced Mar 5, 2026

Open


Closed


Closed

@BrzVladBrzVlad
added
the 
Servicing-approved
Approved for servicing release
label
Mar 6, 2026
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
@BrzVlad reminder that tomorrow is code complete.
@jozkee
jozkee
commented
Mar 11, 2026

Copy link


Copy Markdown

Member
/ba-g build failures are fixed by #125462
@jozkee
jozkee
merged commit a9a230d
into
release/9.0-stagingMar 11, 2026

74 of 81 checks passed

@jozkee
jozkee
deleted the

backport/pr-125116-to-release/9.0-staging

branch
March 11, 2026 23:43
@github-actionsgithub-actionsBot
locked and limited conversation to collaborators
Apr 11, 2026
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@BrzVladBrzVladBrzVlad approved these changes
@lambdageeklambdageekAwaiting requested review from lambdageeklambdageek is a code owner

Assignees

@github-actionsgithub-actions[bot]

Labels

area-VM-meta-monoServicing-approvedApproved for servicing release

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@jozkee@BrzVlad