[clr-ios] Fix SIGSEGV in open virtual delegate dispatch with interpreter

[kotlarmilos]

Description

Fix a crash when the interpreter invokes a compiled open virtual delegate target.

When the interpreter's call delegate handler detects an open virtual delegate whose resolved target is compiled (targetIp == NULL), the code previously fell through to a generic path that called GetTarget() on the delegate. For open delegates, GetTarget() returns null, which corrupted the argument slot and caused a SIGSEGV.

The fix adds a dedicated path for open virtual delegates with compiled targets. It uses memmove to shift the call arguments down by one slot (removing the delegate object) while preserving 16-byte alignment for V128 arguments, then jumps to CALL_INTERP_METHOD to invoke the resolved targetMethod directly. The same shifting is applied for interpreted targets in the non-tail-call path. The alignment-preserving shift logic is extracted into a ShiftDelegateCallArgs() helper to avoid duplication.

Additionally, this re-enables test suites previously excluded under #124325 (except System.Runtime.Serialization.Xml.Tests, which hits a native stack overflow unrelated to this fix).

[dotnet-policy-service]

Tagging subscribers to this area: @BrzVlad, @janvorli, @kg
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Fixes an interpreter crash on iOS when invoking compiled open virtual delegate targets, and updates AppleMobile/CoreCLR libraries test selection.

Changes:

• Handle open virtual delegates whose resolved target has no interpreter bytecode (targetIp == NULL) by skipping the delegate argument slot and directly dispatching via CALL_INTERP_METHOD.
• Remove several AppleMobile/CoreCLR test project exclusions from src/libraries/tests.proj.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/tests.proj	Removes previously-added AppleMobile/CoreCLR test exclusions (re-enables several Serialization test projects).
src/coreclr/vm/interpexec.cpp	Adds a NULL-targetIp open-virtual delegate path that avoids GetTarget() and dispatches the resolved MethodDesc directly.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/coreclr/vm/interpexec.cpp:3224

• In the open-virtual + compiled-target path, the tailcall case adjusts callArgsOffset by one slot and then jumps to CALL_INTERP_METHOD. If CALL_INTERP_METHOD ends up invoking a compiled method (targetIp == NULL), the call stub expects the argument block to follow interpreter stack alignment rules from offset 0 (including 16-byte alignment for V128). Bumping the base pointer by 8 can violate those assumptions. Consider either applying the same alignment-preserving shift for this tailcall case (which likely means carrying the size metadata on INTOP_CALLDELEGATE_TAIL too), or falling back to the normal delegate invoke/shuffle-thunk path for tail calls when the resolved target is compiled.

if ((targetMethod = NonVirtualEntry2MethodDesc(targetAddress)) != NULL)
{
// In this case targetMethod holds a pointer to the MethodDesc that will be called by using targetMethodObj as
// the this pointer. This may be the final method (in the case of instance method delegates), or it may be a

[janvorli]

LGTM, thank you!

[kotlarmilos]

Description

Fix a crash when the interpreter invokes a compiled open virtual delegate target.

When the interpreter's call delegate handler detects an open virtual delegate whose resolved target is compiled (targetIp == NULL), the code previously fell through to a generic path that called GetTarget() on the delegate. For open delegates, GetTarget() returns null, which corrupted the argument slot and caused a SIGSEGV.

The fix adds a dedicated path for open virtual delegates with compiled targets. It uses memmove to shift the call arguments down by one slot (removing the delegate object) while preserving 16-byte alignment for V128 arguments, then jumps to CALL_INTERP_METHOD to invoke the resolved targetMethod directly. The same shifting is applied for interpreted targets in the non-tail-call path. The alignment-preserving shift logic is extracted into a ShiftDelegateCallArgs() helper to avoid duplication.

Additionally, this re-enables test suites previously excluded under #124325 (except System.Runtime.Serialization.Xml.Tests, which hits a native stack overflow unrelated to this fix).

[dotnet-policy-service]

Tagging subscribers to this area: @BrzVlad, @janvorli, @kg
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Fixes an interpreter crash on iOS when invoking compiled open virtual delegate targets, and updates AppleMobile/CoreCLR libraries test selection.

Changes:

• Handle open virtual delegates whose resolved target has no interpreter bytecode (targetIp == NULL) by skipping the delegate argument slot and directly dispatching via CALL_INTERP_METHOD.
• Remove several AppleMobile/CoreCLR test project exclusions from src/libraries/tests.proj.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/tests.proj	Removes previously-added AppleMobile/CoreCLR test exclusions (re-enables several Serialization test projects).
src/coreclr/vm/interpexec.cpp	Adds a NULL-targetIp open-virtual delegate path that avoids GetTarget() and dispatches the resolved MethodDesc directly.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/coreclr/vm/interpexec.cpp:3224

• In the open-virtual + compiled-target path, the tailcall case adjusts callArgsOffset by one slot and then jumps to CALL_INTERP_METHOD. If CALL_INTERP_METHOD ends up invoking a compiled method (targetIp == NULL), the call stub expects the argument block to follow interpreter stack alignment rules from offset 0 (including 16-byte alignment for V128). Bumping the base pointer by 8 can violate those assumptions. Consider either applying the same alignment-preserving shift for this tailcall case (which likely means carrying the size metadata on INTOP_CALLDELEGATE_TAIL too), or falling back to the normal delegate invoke/shuffle-thunk path for tail calls when the resolved target is compiled.

if ((targetMethod = NonVirtualEntry2MethodDesc(targetAddress)) != NULL)
{
// In this case targetMethod holds a pointer to the MethodDesc that will be called by using targetMethodObj as
// the this pointer. This may be the final method (in the case of instance method delegates), or it may be a

[janvorli]

LGTM, thank you!

[kotlarmilos]

Description

Fix a crash when the interpreter invokes a compiled open virtual delegate target.

When the interpreter's call delegate handler detects an open virtual delegate whose resolved target is compiled (targetIp == NULL), the code previously fell through to a generic path that called GetTarget() on the delegate. For open delegates, GetTarget() returns null, which corrupted the argument slot and caused a SIGSEGV.

The fix adds a dedicated path for open virtual delegates with compiled targets. It uses memmove to shift the call arguments down by one slot (removing the delegate object) while preserving 16-byte alignment for V128 arguments, then jumps to CALL_INTERP_METHOD to invoke the resolved targetMethod directly. The same shifting is applied for interpreted targets in the non-tail-call path. The alignment-preserving shift logic is extracted into a ShiftDelegateCallArgs() helper to avoid duplication.

Additionally, this re-enables test suites previously excluded under #124325 (except System.Runtime.Serialization.Xml.Tests, which hits a native stack overflow unrelated to this fix).

[dotnet-policy-service]

Tagging subscribers to this area: @BrzVlad, @janvorli, @kg
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Fixes an interpreter crash on iOS when invoking compiled open virtual delegate targets, and updates AppleMobile/CoreCLR libraries test selection.

Changes:

• Handle open virtual delegates whose resolved target has no interpreter bytecode (targetIp == NULL) by skipping the delegate argument slot and directly dispatching via CALL_INTERP_METHOD.
• Remove several AppleMobile/CoreCLR test project exclusions from src/libraries/tests.proj.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/tests.proj	Removes previously-added AppleMobile/CoreCLR test exclusions (re-enables several Serialization test projects).
src/coreclr/vm/interpexec.cpp	Adds a NULL-targetIp open-virtual delegate path that avoids GetTarget() and dispatches the resolved MethodDesc directly.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/coreclr/vm/interpexec.cpp:3224

• In the open-virtual + compiled-target path, the tailcall case adjusts callArgsOffset by one slot and then jumps to CALL_INTERP_METHOD. If CALL_INTERP_METHOD ends up invoking a compiled method (targetIp == NULL), the call stub expects the argument block to follow interpreter stack alignment rules from offset 0 (including 16-byte alignment for V128). Bumping the base pointer by 8 can violate those assumptions. Consider either applying the same alignment-preserving shift for this tailcall case (which likely means carrying the size metadata on INTOP_CALLDELEGATE_TAIL too), or falling back to the normal delegate invoke/shuffle-thunk path for tail calls when the resolved target is compiled.

if ((targetMethod = NonVirtualEntry2MethodDesc(targetAddress)) != NULL)
{
// In this case targetMethod holds a pointer to the MethodDesc that will be called by using targetMethodObj as
// the this pointer. This may be the final method (in the case of instance method delegates), or it may be a

[janvorli]

LGTM, thank you!

[kotlarmilos]

Description

Fix a crash when the interpreter invokes a compiled open virtual delegate target.

When the interpreter's call delegate handler detects an open virtual delegate whose resolved target is compiled (targetIp == NULL), the code previously fell through to a generic path that called GetTarget() on the delegate. For open delegates, GetTarget() returns null, which corrupted the argument slot and caused a SIGSEGV.

The fix adds a dedicated path for open virtual delegates with compiled targets. It uses memmove to shift the call arguments down by one slot (removing the delegate object) while preserving 16-byte alignment for V128 arguments, then jumps to CALL_INTERP_METHOD to invoke the resolved targetMethod directly. The same shifting is applied for interpreted targets in the non-tail-call path. The alignment-preserving shift logic is extracted into a ShiftDelegateCallArgs() helper to avoid duplication.

Additionally, this re-enables test suites previously excluded under #124325 (except System.Runtime.Serialization.Xml.Tests, which hits a native stack overflow unrelated to this fix).

[dotnet-policy-service]

Tagging subscribers to this area: @BrzVlad, @janvorli, @kg
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Fixes an interpreter crash on iOS when invoking compiled open virtual delegate targets, and updates AppleMobile/CoreCLR libraries test selection.

Changes:

• Handle open virtual delegates whose resolved target has no interpreter bytecode (targetIp == NULL) by skipping the delegate argument slot and directly dispatching via CALL_INTERP_METHOD.
• Remove several AppleMobile/CoreCLR test project exclusions from src/libraries/tests.proj.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/tests.proj	Removes previously-added AppleMobile/CoreCLR test exclusions (re-enables several Serialization test projects).
src/coreclr/vm/interpexec.cpp	Adds a NULL-targetIp open-virtual delegate path that avoids GetTarget() and dispatches the resolved MethodDesc directly.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/coreclr/vm/interpexec.cpp:3224

• In the open-virtual + compiled-target path, the tailcall case adjusts callArgsOffset by one slot and then jumps to CALL_INTERP_METHOD. If CALL_INTERP_METHOD ends up invoking a compiled method (targetIp == NULL), the call stub expects the argument block to follow interpreter stack alignment rules from offset 0 (including 16-byte alignment for V128). Bumping the base pointer by 8 can violate those assumptions. Consider either applying the same alignment-preserving shift for this tailcall case (which likely means carrying the size metadata on INTOP_CALLDELEGATE_TAIL too), or falling back to the normal delegate invoke/shuffle-thunk path for tail calls when the resolved target is compiled.

if ((targetMethod = NonVirtualEntry2MethodDesc(targetAddress)) != NULL)
{
// In this case targetMethod holds a pointer to the MethodDesc that will be called by using targetMethodObj as
// the this pointer. This may be the final method (in the case of instance method delegates), or it may be a

[janvorli]

LGTM, thank you!

[kotlarmilos]

Description

Fix a crash when the interpreter invokes a compiled open virtual delegate target.

When the interpreter's call delegate handler detects an open virtual delegate whose resolved target is compiled (targetIp == NULL), the code previously fell through to a generic path that called GetTarget() on the delegate. For open delegates, GetTarget() returns null, which corrupted the argument slot and caused a SIGSEGV.

The fix adds a dedicated path for open virtual delegates with compiled targets. It uses memmove to shift the call arguments down by one slot (removing the delegate object) while preserving 16-byte alignment for V128 arguments, then jumps to CALL_INTERP_METHOD to invoke the resolved targetMethod directly. The same shifting is applied for interpreted targets in the non-tail-call path. The alignment-preserving shift logic is extracted into a ShiftDelegateCallArgs() helper to avoid duplication.

Additionally, this re-enables test suites previously excluded under #124325 (except System.Runtime.Serialization.Xml.Tests, which hits a native stack overflow unrelated to this fix).

[dotnet-policy-service]

Tagging subscribers to this area: @BrzVlad, @janvorli, @kg
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Fixes an interpreter crash on iOS when invoking compiled open virtual delegate targets, and updates AppleMobile/CoreCLR libraries test selection.

Changes:

• Handle open virtual delegates whose resolved target has no interpreter bytecode (targetIp == NULL) by skipping the delegate argument slot and directly dispatching via CALL_INTERP_METHOD.
• Remove several AppleMobile/CoreCLR test project exclusions from src/libraries/tests.proj.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/tests.proj	Removes previously-added AppleMobile/CoreCLR test exclusions (re-enables several Serialization test projects).
src/coreclr/vm/interpexec.cpp	Adds a NULL-targetIp open-virtual delegate path that avoids GetTarget() and dispatches the resolved MethodDesc directly.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/coreclr/vm/interpexec.cpp:3224

• In the open-virtual + compiled-target path, the tailcall case adjusts callArgsOffset by one slot and then jumps to CALL_INTERP_METHOD. If CALL_INTERP_METHOD ends up invoking a compiled method (targetIp == NULL), the call stub expects the argument block to follow interpreter stack alignment rules from offset 0 (including 16-byte alignment for V128). Bumping the base pointer by 8 can violate those assumptions. Consider either applying the same alignment-preserving shift for this tailcall case (which likely means carrying the size metadata on INTOP_CALLDELEGATE_TAIL too), or falling back to the normal delegate invoke/shuffle-thunk path for tail calls when the resolved target is compiled.

if ((targetMethod = NonVirtualEntry2MethodDesc(targetAddress)) != NULL)
{
// In this case targetMethod holds a pointer to the MethodDesc that will be called by using targetMethodObj as
// the this pointer. This may be the final method (in the case of instance method delegates), or it may be a

[janvorli]

LGTM, thank you!

[kotlarmilos]

Description

Fix a crash when the interpreter invokes a compiled open virtual delegate target.

When the interpreter's call delegate handler detects an open virtual delegate whose resolved target is compiled (targetIp == NULL), the code previously fell through to a generic path that called GetTarget() on the delegate. For open delegates, GetTarget() returns null, which corrupted the argument slot and caused a SIGSEGV.

The fix adds a dedicated path for open virtual delegates with compiled targets. It uses memmove to shift the call arguments down by one slot (removing the delegate object) while preserving 16-byte alignment for V128 arguments, then jumps to CALL_INTERP_METHOD to invoke the resolved targetMethod directly. The same shifting is applied for interpreted targets in the non-tail-call path. The alignment-preserving shift logic is extracted into a ShiftDelegateCallArgs() helper to avoid duplication.

Additionally, this re-enables test suites previously excluded under #124325 (except System.Runtime.Serialization.Xml.Tests, which hits a native stack overflow unrelated to this fix).

[dotnet-policy-service]

Tagging subscribers to this area: @BrzVlad, @janvorli, @kg
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Fixes an interpreter crash on iOS when invoking compiled open virtual delegate targets, and updates AppleMobile/CoreCLR libraries test selection.

Changes:

• Handle open virtual delegates whose resolved target has no interpreter bytecode (targetIp == NULL) by skipping the delegate argument slot and directly dispatching via CALL_INTERP_METHOD.
• Remove several AppleMobile/CoreCLR test project exclusions from src/libraries/tests.proj.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/tests.proj	Removes previously-added AppleMobile/CoreCLR test exclusions (re-enables several Serialization test projects).
src/coreclr/vm/interpexec.cpp	Adds a NULL-targetIp open-virtual delegate path that avoids GetTarget() and dispatches the resolved MethodDesc directly.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/coreclr/vm/interpexec.cpp:3224

• In the open-virtual + compiled-target path, the tailcall case adjusts callArgsOffset by one slot and then jumps to CALL_INTERP_METHOD. If CALL_INTERP_METHOD ends up invoking a compiled method (targetIp == NULL), the call stub expects the argument block to follow interpreter stack alignment rules from offset 0 (including 16-byte alignment for V128). Bumping the base pointer by 8 can violate those assumptions. Consider either applying the same alignment-preserving shift for this tailcall case (which likely means carrying the size metadata on INTOP_CALLDELEGATE_TAIL too), or falling back to the normal delegate invoke/shuffle-thunk path for tail calls when the resolved target is compiled.

if ((targetMethod = NonVirtualEntry2MethodDesc(targetAddress)) != NULL)
{
// In this case targetMethod holds a pointer to the MethodDesc that will be called by using targetMethodObj as
// the this pointer. This may be the final method (in the case of instance method delegates), or it may be a

[janvorli]

LGTM, thank you!

[kotlarmilos]

Description

Fix a crash when the interpreter invokes a compiled open virtual delegate target.

When the interpreter's call delegate handler detects an open virtual delegate whose resolved target is compiled (targetIp == NULL), the code previously fell through to a generic path that called GetTarget() on the delegate. For open delegates, GetTarget() returns null, which corrupted the argument slot and caused a SIGSEGV.

The fix adds a dedicated path for open virtual delegates with compiled targets. It uses memmove to shift the call arguments down by one slot (removing the delegate object) while preserving 16-byte alignment for V128 arguments, then jumps to CALL_INTERP_METHOD to invoke the resolved targetMethod directly. The same shifting is applied for interpreted targets in the non-tail-call path. The alignment-preserving shift logic is extracted into a ShiftDelegateCallArgs() helper to avoid duplication.

Additionally, this re-enables test suites previously excluded under #124325 (except System.Runtime.Serialization.Xml.Tests, which hits a native stack overflow unrelated to this fix).

[dotnet-policy-service]

Tagging subscribers to this area: @BrzVlad, @janvorli, @kg
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Fixes an interpreter crash on iOS when invoking compiled open virtual delegate targets, and updates AppleMobile/CoreCLR libraries test selection.

Changes:

• Handle open virtual delegates whose resolved target has no interpreter bytecode (targetIp == NULL) by skipping the delegate argument slot and directly dispatching via CALL_INTERP_METHOD.
• Remove several AppleMobile/CoreCLR test project exclusions from src/libraries/tests.proj.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/tests.proj	Removes previously-added AppleMobile/CoreCLR test exclusions (re-enables several Serialization test projects).
src/coreclr/vm/interpexec.cpp	Adds a NULL-targetIp open-virtual delegate path that avoids GetTarget() and dispatches the resolved MethodDesc directly.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/coreclr/vm/interpexec.cpp:3224

• In the open-virtual + compiled-target path, the tailcall case adjusts callArgsOffset by one slot and then jumps to CALL_INTERP_METHOD. If CALL_INTERP_METHOD ends up invoking a compiled method (targetIp == NULL), the call stub expects the argument block to follow interpreter stack alignment rules from offset 0 (including 16-byte alignment for V128). Bumping the base pointer by 8 can violate those assumptions. Consider either applying the same alignment-preserving shift for this tailcall case (which likely means carrying the size metadata on INTOP_CALLDELEGATE_TAIL too), or falling back to the normal delegate invoke/shuffle-thunk path for tail calls when the resolved target is compiled.

if ((targetMethod = NonVirtualEntry2MethodDesc(targetAddress)) != NULL)
{
// In this case targetMethod holds a pointer to the MethodDesc that will be called by using targetMethodObj as
// the this pointer. This may be the final method (in the case of instance method delegates), or it may be a

[janvorli]

LGTM, thank you!

[kotlarmilos]

Description

Fix a crash when the interpreter invokes a compiled open virtual delegate target.

When the interpreter's call delegate handler detects an open virtual delegate whose resolved target is compiled (targetIp == NULL), the code previously fell through to a generic path that called GetTarget() on the delegate. For open delegates, GetTarget() returns null, which corrupted the argument slot and caused a SIGSEGV.

The fix adds a dedicated path for open virtual delegates with compiled targets. It uses memmove to shift the call arguments down by one slot (removing the delegate object) while preserving 16-byte alignment for V128 arguments, then jumps to CALL_INTERP_METHOD to invoke the resolved targetMethod directly. The same shifting is applied for interpreted targets in the non-tail-call path. The alignment-preserving shift logic is extracted into a ShiftDelegateCallArgs() helper to avoid duplication.

Additionally, this re-enables test suites previously excluded under #124325 (except System.Runtime.Serialization.Xml.Tests, which hits a native stack overflow unrelated to this fix).

[dotnet-policy-service]

Tagging subscribers to this area: @BrzVlad, @janvorli, @kg
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Fixes an interpreter crash on iOS when invoking compiled open virtual delegate targets, and updates AppleMobile/CoreCLR libraries test selection.

Changes:

• Handle open virtual delegates whose resolved target has no interpreter bytecode (targetIp == NULL) by skipping the delegate argument slot and directly dispatching via CALL_INTERP_METHOD.
• Remove several AppleMobile/CoreCLR test project exclusions from src/libraries/tests.proj.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/libraries/tests.proj	Removes previously-added AppleMobile/CoreCLR test exclusions (re-enables several Serialization test projects).
src/coreclr/vm/interpexec.cpp	Adds a NULL-targetIp open-virtual delegate path that avoids GetTarget() and dispatches the resolved MethodDesc directly.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

[kotlarmilos]

/azp run runtime-ioslike

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/coreclr/vm/interpexec.cpp:3224

• In the open-virtual + compiled-target path, the tailcall case adjusts callArgsOffset by one slot and then jumps to CALL_INTERP_METHOD. If CALL_INTERP_METHOD ends up invoking a compiled method (targetIp == NULL), the call stub expects the argument block to follow interpreter stack alignment rules from offset 0 (including 16-byte alignment for V128). Bumping the base pointer by 8 can violate those assumptions. Consider either applying the same alignment-preserving shift for this tailcall case (which likely means carrying the size metadata on INTOP_CALLDELEGATE_TAIL too), or falling back to the normal delegate invoke/shuffle-thunk path for tail calls when the resolved target is compiled.

if ((targetMethod = NonVirtualEntry2MethodDesc(targetAddress)) != NULL)
{
// In this case targetMethod holds a pointer to the MethodDesc that will be called by using targetMethodObj as
// the this pointer. This may be the final method (in the case of instance method delegates), or it may be a

[janvorli]

LGTM, thank you!