GCRoot: Report GCFrame and in-flight exception objects

docs/design/datacontracts/StackWalk.md

@@ -149,6 +149,10 @@ This contract depends on the following descriptors:
 | `ExceptionInfo` | `PassNumber` | Exception handling pass (1 or 2) |
 | `ExceptionInfo` | `ClauseForCatchHandlerStartPC` | Start PC offset of the catch handler clause, used for interruptible offset override |
 | `ExceptionInfo` | `ClauseForCatchHandlerEndPC` | End PC offset of the catch handler clause, used for interruptible offset override |
+| `GCFrame` | `Next` | Pointer to the next `GCFrame` toward the top of the chain |
+| `GCFrame` | `ObjRefs` | Pointer to the array of protected object reference slots |
+| `GCFrame` | `NumObjRefs` | Count of protected object reference slots starting at `ObjRefs` |
+| `GCFrame` | `GCFlags` | `GC_CALL_*` promotion flags applied when reporting the protected slots |
 
 Global variables used:
 | Global Name | Type | Purpose |
@@ -168,6 +172,7 @@ Contracts used:
 | `Thread` |
 | `RuntimeTypeSystem` |
 | `GCInfo` |
+| `Exception` |
 
 
 ### Stackwalk Algorithm
@@ -594,7 +599,7 @@ If no Frame in the chain produces a usable context (thread is not running manage
 
 ### GC Stack Reference Scanning
 
-`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers. The native equivalent is `DacStackReferenceWalker` which calls `GcStackCrawlCallBack` at each frame.
+`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers, then reporting the thread's GCFrame (GCPROTECT) chain and in-flight exception (ExInfo) chain. This mirrors the GC's own root enumeration, `ScanStackRoots`.
 
 #### Stack Walk Integration
 
@@ -628,6 +633,15 @@ At each frame yielded by `Filter`, the walk determines whether to scan for GC re
 
 See [GCRefMap Format and Resolution](#gcrefmap-format-and-resolution) for the GCRefMap scanning path. The signature-based scanning fallback (`PromoteCallerStack`) is currently a stub awaiting an `ICallingConvention` contract port; the stress harness handles the resulting gaps via a deferred-frame sentinel (see [tests/StressTests/known-issues.md](../../../src/native/managed/cdac/tests/StressTests/known-issues.md) and tracking issue [dotnet/runtime#127765](https://github.com/dotnet/runtime/issues/127765)).
 
+#### GCFrame and Exception Tracker Roots
+
+After walking the thread's frames, `WalkStackReferences` reports two additional sets of roots that the GC keeps alive but that are not surfaced by per-frame GC info (matching native `gcenv.ee.cpp` `ScanStackRoots`):
+
+- **GCFrame (GCPROTECT) chain**: starting from `Thread.GCFrame` (obtained via the `Thread` contract's `GetThreadData`), each `GCFrame` is walked via its `Next` pointer until TargetPointer.Null is reached. For each node, the `NumObjRefs` slots starting at `ObjRefs` are reported, applying the node's `GCFlags` (`GC_CALL_INTERIOR` / `GC_CALL_PINNED`) as the promotion flags. This mirrors native `GCFrame::GcScanRoots`.
+- **Exception tracker (ExInfo) chain**: starting from the thread's exception tracker, each in-flight exception object (the current one and any superseded/nested ones reached via `PreviousNestedInfo`) is reported through its thrown-object slot.
+
+Both sets carry a non-zero, stack-resident `Source` and `StackPointer` set to the GCFrame / ExInfo node address (the node lives on the stack). A `GCFrame` node belongs to a separate chain from the explicit `Frame` chain, and an ExInfo node is likewise not a capital-F `Frame`, so neither is reported with the `Frame` source type. Both use the `Other` source type, which marks a root reported outside the per-frame walk.
+
 ### GCRefMap Format and Resolution
 
 A **GCRefMap** is a compact per-callsite encoding that describes which stack slots in a `TransitionBlock` contain GC references. GCRefMaps are pre-computed by the ReadyToRun compiler and stored in the PE image's import section auxiliary data.

docs/design/datacontracts/Thread.md

@@ -55,6 +55,7 @@ record struct ThreadData (
  TargetPointer ThreadHandle;
  bool IsInteropDebuggingHijacked;
  TargetPointer DebuggerFilterContext;
+ TargetPointer GCFrame;
 );
 ```
 
@@ -123,6 +124,7 @@ The contract additionally depends on these data descriptors
 | `Thread` | `DebuggerControlledThreadState` | Thread state flags controlled by the debugger |
 | `Thread` | `PreemptiveGCDisabled` | Flag indicating if preemptive GC is disabled |
 | `Thread` | `Frame` | Pointer to current frame |
+| `Thread` | `GCFrame` | Pointer to the head of the thread's GCFrame chain. |
 | `Thread` | `CachedStackBase` | Pointer to the base of the stack |
 | `Thread` | `CachedStackLimit` | Pointer to the limit of the stack |
 | `Thread` | `ExposedObject` | Handle to the managed `Thread` object exposed to the debugger |
@@ -237,6 +239,7 @@ ThreadData GetThreadData(TargetPointer address)
  LastThrownObjectHandle : lastThrownObjectHandle,
  FirstNestedException : firstNestedException,
  NextThread: target.ReadPointer(address + /* Thread::LinkNext offset */) - threadLinkOffset;
+ GCFrame: target.ReadPointer(address + /* Thread::GCFrame offset */),
  );
 }
 

src/coreclr/inc/sospriv.idl

@@ -111,6 +111,7 @@ typedef enum SOSStackSourceType
 {
  SOS_StackSourceIP, // Instruction pointer in managed code
  SOS_StackSourceFrame, // clr!Frame
+ SOS_StackSourceOther, // Roots which do not come from managed code or Frames
 } SOSStackSourceType;
 
 typedef enum SOSRefFlags

src/coreclr/pal/prebuilt/inc/sospriv.h

@@ -462,7 +462,8 @@ typedef
 enum SOSStackSourceType
  {
  SOS_StackSourceIP = 0,
- SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 )
+ SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 ),
+ SOS_StackSourceOther = ( SOS_StackSourceFrame + 1 )
  } SOSStackSourceType;
 
 typedef

src/coreclr/vm/cdacstress.cpp

@@ -76,7 +76,7 @@ struct StackRef
  CLRDATA_ADDRESS Object; // The object pointer value
  unsigned int Flags; // SOSRefFlags (interior, pinned)
  CLRDATA_ADDRESS Source; // IP or Frame that owns this ref
- int SourceType; // SOS_StackSourceIPor SOS_StackSourceFrame
+ int SourceType; // SOS_StackSourceIP, SOS_StackSourceFrame, or SOS_StackSourceOther
  int Register; // Processor-encoding reg number, -1 for stack slots
  // (cDAC populates from GcInfo; runtime populates
  // by inverting GetRegisterSlot on supported arches)
@@ -721,7 +721,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  collectCtx.refs = outRefs;
  collectCtx.overflow = false;
  collectCtx.currentFrameSource = 0;
- collectCtx.currentFrameSourceType = 0;
+ collectCtx.currentFrameSourceType = SOS_StackSourceIP;
  collectCtx.currentRegDisplay = nullptr;
 
  GCCONTEXT gcctx = {};
@@ -780,7 +780,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // safepoint (matches DAC SOS_StackSourceIP convention).
  collectCtx->currentFrameSource =
  (CLRDATA_ADDRESS)PCODEToPINSTR(GetControlPC(pCF->GetRegisterSet()));
- collectCtx->currentFrameSourceType = 0; // SOS_StackSourceIP
+ collectCtx->currentFrameSourceType = SOS_StackSourceIP;
  collectCtx->currentRegDisplay = pCF->GetRegisterSet();
 
  ICodeManager* pCM = pCF->GetCodeManager();
@@ -801,7 +801,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // emit register-resident refs, so leave currentRegDisplay null.
  Frame* pFrame = pCF->GetFrame();
  collectCtx->currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pFrame);
- collectCtx->currentFrameSourceType = 1; // SOS_StackSourceFrame
+ collectCtx->currentFrameSourceType = SOS_StackSourceFrame;
 
  pFrame->GcScanRoots(gcctx->f, gcctx->sc);
  }
@@ -812,10 +812,36 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
 
  pThread->StackWalkFrames(dacLikeCallback, &diagCtx, flagsStackWalk);
 
- // NOTE: ScanStackRoots also scans the separate GCFrame linked list
- // (Thread::GetGCFrame), but the DAC's GetStackReferences / DacStackReferenceWalker
- // does NOT include those. We intentionally omit GCFrame scanning here so our
- // runtime-side collection matches what the cDAC is expected to produce.
+ // ScanStackRoots also scans two root sets that are not part of the frame walk: the
+ // GCFrame (GCPROTECT) chain and the in-flight ExInfo chain. GetStackReferences reports
+ // both, so mirror them here to keep the runtime-side collection in parity. See
+ // ScanStackRoots in gcenv.ee.cpp.
+ GCFrame* pGCFrame = pThread->GetGCFrame();
+ while (pGCFrame != nullptr)
+ {
+ // A GCFrame node is a separate chain from the explicit Frame chain, so it is not a
+ // capital-F Frame. Report it with the Other source type and the GCFrame node address as
+ // the Source, matching cDAC (GcScanContext stamps Source = GCFrame node, SourceType = Other).
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pGCFrame);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ pGCFrame->GcScanRoots(gcctx.f, gcctx.sc);
+ pGCFrame = pGCFrame->PtrNextFrame();
+ }
+
+ PTR_ExInfo pExInfo = pThread->GetExceptionState()->GetCurrentExceptionTracker();
+ while (pExInfo != NULL)
+ {
+ // The ExInfo is not a Frame either; GetStackReferences surfaces the in-flight exception
+ // object with the Other source type and the ExInfo node address as the Source, the same
+ // way it reports a GCFrame root. Mirror that here so the runtime-side collection matches cDAC.
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pExInfo);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ PTR_PTR_Object pRef = dac_cast<PTR_PTR_Object>(&pExInfo->m_exception);
+ gcctx.f(pRef, gcctx.sc, 0);
+ pExInfo = pExInfo->GetPreviousExceptionTracker();
+ }
 
  return collectCtx.overflow ? S_FALSE : S_OK;
 }
@@ -867,7 +893,7 @@ static void ReportMismatch(const char* message, Thread* pThread, PCONTEXT regs)
 struct FrameRefGroup
 {
  CLRDATA_ADDRESS Source;
- int SourceType; // 0 = IP, 1 = Frame
+ int SourceType; // 0 = IP, 1 = Frame, 2 = Other
  int StartIdx; // Index into the original ref array
  int Count; // Number of refs in this group
 };
@@ -1624,7 +1650,15 @@ static void ResolveMethodName(CLRDATA_ADDRESS source, int sourceType, char* buf,
  if (bufLen <= 0)
  return;
 
- if (sourceType != 0) // SOS_StackSourceFrame
+ if (sourceType == SOS_StackSourceOther)
+ {
+ // A root reported outside the frame walk (GCFrame/GCPROTECT or ExInfo chain). Source is a
+ // node address, not a capital-F Frame, so do not dereference it as a Frame*.
+ snprintf(buf, bufLen, "<other 0x%llx>", (unsigned long long)source);
+ return;
+ }
+
+ if (sourceType == SOS_StackSourceFrame)
  {
  Frame* pFrame = reinterpret_cast<Frame*>(source);
  LPCSTR typeName = Frame::GetFrameTypeName(pFrame->GetFrameIdentifier());

src/coreclr/vm/datadescriptor/datadescriptor.inc

@@ -41,6 +41,7 @@ CDAC_TYPE_FIELD(Thread, T_UINT32, State, cdac_data<Thread>::State)
 CDAC_TYPE_FIELD(Thread, T_UINT32, PreemptiveGCDisabled, cdac_data<Thread>::PreemptiveGCDisabled)
 CDAC_TYPE_FIELD(Thread, T_POINTER, RuntimeThreadLocals, cdac_data<Thread>::RuntimeThreadLocals)
 CDAC_TYPE_FIELD(Thread, T_POINTER, Frame, cdac_data<Thread>::Frame)
+CDAC_TYPE_FIELD(Thread, T_POINTER, GCFrame, cdac_data<Thread>::GCFrame)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackBase, cdac_data<Thread>::CachedStackBase)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackLimit, cdac_data<Thread>::CachedStackLimit)
 CDAC_TYPE_FIELD(Thread, T_POINTER, ExceptionTracker, cdac_data<Thread>::ExceptionTracker)
@@ -71,6 +72,14 @@ CDAC_TYPE_FIELD(ThreadStore, T_INT32, PendingCount, cdac_data<ThreadStore>::Pend
 CDAC_TYPE_FIELD(ThreadStore, T_INT32, DeadCount, cdac_data<ThreadStore>::DeadCount)
 CDAC_TYPE_END(ThreadStore)
 
+CDAC_TYPE_BEGIN(GCFrame)
+CDAC_TYPE_INDETERMINATE(GCFrame)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, Next, cdac_data<GCFrame>::Next)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, ObjRefs, cdac_data<GCFrame>::ObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, NumObjRefs, cdac_data<GCFrame>::NumObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, GCFlags, cdac_data<GCFrame>::GCFlags)
+CDAC_TYPE_END(GCFrame)
+
 CDAC_TYPE_BEGIN(RuntimeThreadLocals)
 CDAC_TYPE_INDETERMINATE(RuntimeThreadLocals)
 CDAC_TYPE_FIELD(RuntimeThreadLocals, TYPE(EEAllocContext), AllocContext, offsetof(RuntimeThreadLocals, alloc_context))

src/coreclr/vm/exceptionhandling.cpp

@@ -512,7 +512,7 @@ static void PopExplicitFrames(Thread *pThread, void *targetSp, void *targetCalle
  if (popGCFrames)
  {
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while ((pGCFrame != GCFRAME_TOP) && pGCFrame->GetOSStackLocation() < targetSp)
+ while ((pGCFrame != nullptr) && pGCFrame->GetOSStackLocation() < targetSp)
  {
  pGCFrame->Pop();
  pGCFrame = pThread->GetGCFrame();

src/coreclr/vm/frames.cpp

@@ -1185,28 +1185,29 @@ GCFrame::~GCFrame()
  NOTHROW;
  GC_NOTRIGGER;
  MODE_ANY;
- PRECONDITION(m_pCurThread != NULL);
  }
  CONTRACTL_END;
 
- // m_pNext is NULL when the frame was already popped from the stack.
- if (m_Next != NULL)
+ // Normally the destructor performs the pop for a GCPROTECT_BEGIN/END scope, so the frame is
+ // still linked when we get here. If it was already popped explicitly - by PopExplicitFrames
+ // during EH unwind, or by the interpreter's GCReporting::Unregister - then m_pCurThread is
+ // NULL and there is nothing left to do.
+ if (m_pCurThread != NULL)
  {
- // This is a GCFrame that was not popped. This is a problem.
- // We should have popped it before we destruct
  // Do a manual switch to the GC cooperative mode instead of using the GCX_COOP_THREAD_EXISTS
  // macro so that this function isn't slowed down by having to deal with FS:0 chain on x86 Windows.
- BOOL wasCoop = m_pCurThread->PreemptiveGCDisabled();
+ Thread *pThread = m_pCurThread;
+ BOOL wasCoop = pThread->PreemptiveGCDisabled();
  if (!wasCoop)
  {
-m_pCurThread->DisablePreemptiveGC();
+pThread->DisablePreemptiveGC();
  }
 
  Pop();
 
  if (!wasCoop)
  {
-m_pCurThread->EnablePreemptiveGC();
+pThread->EnablePreemptiveGC();
  }
  }
 }
@@ -1233,7 +1234,7 @@ void GCFrame::Push(Thread* pThread)
  // in which the compiler will lay them out in the stack frame.
  // So minipal_getpagesize() is a guess of the maximum stack frame size of any method
  // with multiple GCFrames in coreclr.dll
- _ASSERTE(((m_Next == GCFRAME_TOP) ||
+ _ASSERTE(((m_Next == NULL) ||
  (PBYTE(m_Next->GetOSStackLocation()) + (2 * minipal_getpagesize())) > PBYTE(this->GetOSStackLocation())) &&
  "Pushing a GCFrame out of order ?");
 
@@ -1258,13 +1259,15 @@ void GCFrame::Pop()
  _ASSERTE(m_pCurThread->GetGCFrame() == this && "Popping a GCFrame out of order ?");
 
  m_pCurThread->SetGCFrame(m_Next);
- m_Next = NULL;
 
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
  Thread::ObjectRefNew(&m_pObjRefs[i]); // Unprotect them
 #endif
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 void GCFrame::Remove()
@@ -1280,7 +1283,7 @@ void GCFrame::Remove()
 
  GCFrame *pPrevFrame = NULL;
  GCFrame *pFrame = m_pCurThread->GetGCFrame();
- while (pFrame != GCFRAME_TOP)
+ while (pFrame != NULL)
  {
  if (pFrame == this)
  {
@@ -1293,8 +1296,6 @@ void GCFrame::Remove()
  m_pCurThread->SetGCFrame(m_Next);
  }
 
- m_Next = NULL;
-
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
@@ -1308,6 +1309,9 @@ void GCFrame::Remove()
  }
 
  _ASSERTE_MSG(pFrame != NULL, "GCFrame not found in the current thread's stack");
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 #endif // !DACCESS_COMPILE
@@ -1393,7 +1397,7 @@ BOOL IsProtectedByGCFrame(OBJECTREF *ppObjectRef)
  GetThread()->StackWalkFrames(IsProtectedByGCFrameStackWalkFramesCallback, &d);
 
  GCFrame* pGCFrame = GetThread()->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  if (pGCFrame->Protects(ppObjectRef)) {
  d.count++;

src/coreclr/vm/frames.h

@@ -184,7 +184,6 @@ class DacDbiInterfaceImpl;
 // whenever we compare it to a PTR_Frame value (the usual use of the value).
 #define FRAME_TOP_VALUE ~0 // we want to say -1 here, but gcc has trouble with the signed value
 #define FRAME_TOP (PTR_Frame(FRAME_TOP_VALUE))
-#define GCFRAME_TOP (PTR_GCFrame(FRAME_TOP_VALUE))
 
 
 enum class FrameIdentifier : TADDR
@@ -1808,6 +1807,17 @@ class GCFrame
 #ifdef FEATURE_INTERPRETER
  PTR_VOID m_osStackLocation;
 #endif
+
+ friend struct ::cdac_data<GCFrame>;
+};
+
+template<>
+struct cdac_data<GCFrame>
+{
+ static constexpr size_t Next = offsetof(GCFrame, m_Next);
+ static constexpr size_t ObjRefs = offsetof(GCFrame, m_pObjRefs);
+ static constexpr size_t NumObjRefs = offsetof(GCFrame, m_numObjRefs);
+ static constexpr size_t GCFlags = offsetof(GCFrame, m_gcFlags);
 };
 
 //-----------------------------------------------------------------------------

src/coreclr/vm/gcenv.ee.cpp

@@ -200,7 +200,7 @@ static void ScanStackRoots(Thread * pThread, promote_func* fn, ScanContext* sc)
  }
 
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  pGCFrame->GcScanRoots(fn, sc);
  pGCFrame = pGCFrame->PtrNextFrame();

src/coreclr/vm/threads.cpp

@@ -1185,7 +1185,7 @@ Thread::Thread()
  CONTRACTL_END;
 
  m_pFrame = FRAME_TOP;
- m_pGCFrame = GCFRAME_TOP;
+ m_pGCFrame = NULL;
 
  m_fPreemptiveGCDisabled = 0;
 
@@ -6752,7 +6752,7 @@ PTR_GCFrame Thread::GetGCFrame()
  {
  void* curSP;
  curSP = (void *)GetCurrentSP();
- _ASSERTE((m_pGCFrame == (GCFrame*)-1) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
+ _ASSERTE((m_pGCFrame == NULL) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
  }
 #endif
 

src/coreclr/vm/threads.h

@@ -3769,6 +3769,7 @@ struct cdac_data<Thread>
  static constexpr size_t PreemptiveGCDisabled = offsetof(Thread, m_fPreemptiveGCDisabled);
  static constexpr size_t RuntimeThreadLocals = offsetof(Thread, m_pRuntimeThreadLocals);
  static constexpr size_t Frame = offsetof(Thread, m_pFrame);
+ static constexpr size_t GCFrame = offsetof(Thread, m_pGCFrame);
  static constexpr size_t CachedStackBase = offsetof(Thread, m_CacheStackBase);
  static constexpr size_t CachedStackLimit = offsetof(Thread, m_CacheStackLimit);
  static constexpr size_t ExposedObject = offsetof(Thread, m_ExposedObject);

docs/design/datacontracts/StackWalk.md

@@ -149,6 +149,10 @@ This contract depends on the following descriptors:
 | `ExceptionInfo` | `PassNumber` | Exception handling pass (1 or 2) |
 | `ExceptionInfo` | `ClauseForCatchHandlerStartPC` | Start PC offset of the catch handler clause, used for interruptible offset override |
 | `ExceptionInfo` | `ClauseForCatchHandlerEndPC` | End PC offset of the catch handler clause, used for interruptible offset override |
+| `GCFrame` | `Next` | Pointer to the next `GCFrame` toward the top of the chain |
+| `GCFrame` | `ObjRefs` | Pointer to the array of protected object reference slots |
+| `GCFrame` | `NumObjRefs` | Count of protected object reference slots starting at `ObjRefs` |
+| `GCFrame` | `GCFlags` | `GC_CALL_*` promotion flags applied when reporting the protected slots |
 
 Global variables used:
 | Global Name | Type | Purpose |
@@ -168,6 +172,7 @@ Contracts used:
 | `Thread` |
 | `RuntimeTypeSystem` |
 | `GCInfo` |
+| `Exception` |
 
 
 ### Stackwalk Algorithm
@@ -594,7 +599,7 @@ If no Frame in the chain produces a usable context (thread is not running manage
 
 ### GC Stack Reference Scanning
 
-`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers. The native equivalent is `DacStackReferenceWalker` which calls `GcStackCrawlCallBack` at each frame.
+`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers, then reporting the thread's GCFrame (GCPROTECT) chain and in-flight exception (ExInfo) chain. This mirrors the GC's own root enumeration, `ScanStackRoots`.
 
 #### Stack Walk Integration
 
@@ -628,6 +633,15 @@ At each frame yielded by `Filter`, the walk determines whether to scan for GC re
 
 See [GCRefMap Format and Resolution](#gcrefmap-format-and-resolution) for the GCRefMap scanning path. The signature-based scanning fallback (`PromoteCallerStack`) is currently a stub awaiting an `ICallingConvention` contract port; the stress harness handles the resulting gaps via a deferred-frame sentinel (see [tests/StressTests/known-issues.md](../../../src/native/managed/cdac/tests/StressTests/known-issues.md) and tracking issue [dotnet/runtime#127765](https://github.com/dotnet/runtime/issues/127765)).
 
+#### GCFrame and Exception Tracker Roots
+
+After walking the thread's frames, `WalkStackReferences` reports two additional sets of roots that the GC keeps alive but that are not surfaced by per-frame GC info (matching native `gcenv.ee.cpp` `ScanStackRoots`):
+
+- **GCFrame (GCPROTECT) chain**: starting from `Thread.GCFrame` (obtained via the `Thread` contract's `GetThreadData`), each `GCFrame` is walked via its `Next` pointer until TargetPointer.Null is reached. For each node, the `NumObjRefs` slots starting at `ObjRefs` are reported, applying the node's `GCFlags` (`GC_CALL_INTERIOR` / `GC_CALL_PINNED`) as the promotion flags. This mirrors native `GCFrame::GcScanRoots`.
+- **Exception tracker (ExInfo) chain**: starting from the thread's exception tracker, each in-flight exception object (the current one and any superseded/nested ones reached via `PreviousNestedInfo`) is reported through its thrown-object slot.
+
+Both sets carry a non-zero, stack-resident `Source` and `StackPointer` set to the GCFrame / ExInfo node address (the node lives on the stack). A `GCFrame` node belongs to a separate chain from the explicit `Frame` chain, and an ExInfo node is likewise not a capital-F `Frame`, so neither is reported with the `Frame` source type. Both use the `Other` source type, which marks a root reported outside the per-frame walk.
+
 ### GCRefMap Format and Resolution
 
 A **GCRefMap** is a compact per-callsite encoding that describes which stack slots in a `TransitionBlock` contain GC references. GCRefMaps are pre-computed by the ReadyToRun compiler and stored in the PE image's import section auxiliary data.

docs/design/datacontracts/Thread.md

@@ -55,6 +55,7 @@ record struct ThreadData (
  TargetPointer ThreadHandle;
  bool IsInteropDebuggingHijacked;
  TargetPointer DebuggerFilterContext;
+ TargetPointer GCFrame;
 );
 ```
 
@@ -123,6 +124,7 @@ The contract additionally depends on these data descriptors
 | `Thread` | `DebuggerControlledThreadState` | Thread state flags controlled by the debugger |
 | `Thread` | `PreemptiveGCDisabled` | Flag indicating if preemptive GC is disabled |
 | `Thread` | `Frame` | Pointer to current frame |
+| `Thread` | `GCFrame` | Pointer to the head of the thread's GCFrame chain. |
 | `Thread` | `CachedStackBase` | Pointer to the base of the stack |
 | `Thread` | `CachedStackLimit` | Pointer to the limit of the stack |
 | `Thread` | `ExposedObject` | Handle to the managed `Thread` object exposed to the debugger |
@@ -237,6 +239,7 @@ ThreadData GetThreadData(TargetPointer address)
  LastThrownObjectHandle : lastThrownObjectHandle,
  FirstNestedException : firstNestedException,
  NextThread: target.ReadPointer(address + /* Thread::LinkNext offset */) - threadLinkOffset;
+ GCFrame: target.ReadPointer(address + /* Thread::GCFrame offset */),
  );
 }
 

src/coreclr/inc/sospriv.idl

@@ -111,6 +111,7 @@ typedef enum SOSStackSourceType
 {
  SOS_StackSourceIP, // Instruction pointer in managed code
  SOS_StackSourceFrame, // clr!Frame
+ SOS_StackSourceOther, // Roots which do not come from managed code or Frames
 } SOSStackSourceType;
 
 typedef enum SOSRefFlags

src/coreclr/pal/prebuilt/inc/sospriv.h

@@ -462,7 +462,8 @@ typedef
 enum SOSStackSourceType
  {
  SOS_StackSourceIP = 0,
- SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 )
+ SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 ),
+ SOS_StackSourceOther = ( SOS_StackSourceFrame + 1 )
  } SOSStackSourceType;
 
 typedef

src/coreclr/vm/cdacstress.cpp

@@ -76,7 +76,7 @@ struct StackRef
  CLRDATA_ADDRESS Object; // The object pointer value
  unsigned int Flags; // SOSRefFlags (interior, pinned)
  CLRDATA_ADDRESS Source; // IP or Frame that owns this ref
- int SourceType; // SOS_StackSourceIPor SOS_StackSourceFrame
+ int SourceType; // SOS_StackSourceIP, SOS_StackSourceFrame, or SOS_StackSourceOther
  int Register; // Processor-encoding reg number, -1 for stack slots
  // (cDAC populates from GcInfo; runtime populates
  // by inverting GetRegisterSlot on supported arches)
@@ -721,7 +721,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  collectCtx.refs = outRefs;
  collectCtx.overflow = false;
  collectCtx.currentFrameSource = 0;
- collectCtx.currentFrameSourceType = 0;
+ collectCtx.currentFrameSourceType = SOS_StackSourceIP;
  collectCtx.currentRegDisplay = nullptr;
 
  GCCONTEXT gcctx = {};
@@ -780,7 +780,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // safepoint (matches DAC SOS_StackSourceIP convention).
  collectCtx->currentFrameSource =
  (CLRDATA_ADDRESS)PCODEToPINSTR(GetControlPC(pCF->GetRegisterSet()));
- collectCtx->currentFrameSourceType = 0; // SOS_StackSourceIP
+ collectCtx->currentFrameSourceType = SOS_StackSourceIP;
  collectCtx->currentRegDisplay = pCF->GetRegisterSet();
 
  ICodeManager* pCM = pCF->GetCodeManager();
@@ -801,7 +801,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // emit register-resident refs, so leave currentRegDisplay null.
  Frame* pFrame = pCF->GetFrame();
  collectCtx->currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pFrame);
- collectCtx->currentFrameSourceType = 1; // SOS_StackSourceFrame
+ collectCtx->currentFrameSourceType = SOS_StackSourceFrame;
 
  pFrame->GcScanRoots(gcctx->f, gcctx->sc);
  }
@@ -812,10 +812,36 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
 
  pThread->StackWalkFrames(dacLikeCallback, &diagCtx, flagsStackWalk);
 
- // NOTE: ScanStackRoots also scans the separate GCFrame linked list
- // (Thread::GetGCFrame), but the DAC's GetStackReferences / DacStackReferenceWalker
- // does NOT include those. We intentionally omit GCFrame scanning here so our
- // runtime-side collection matches what the cDAC is expected to produce.
+ // ScanStackRoots also scans two root sets that are not part of the frame walk: the
+ // GCFrame (GCPROTECT) chain and the in-flight ExInfo chain. GetStackReferences reports
+ // both, so mirror them here to keep the runtime-side collection in parity. See
+ // ScanStackRoots in gcenv.ee.cpp.
+ GCFrame* pGCFrame = pThread->GetGCFrame();
+ while (pGCFrame != nullptr)
+ {
+ // A GCFrame node is a separate chain from the explicit Frame chain, so it is not a
+ // capital-F Frame. Report it with the Other source type and the GCFrame node address as
+ // the Source, matching cDAC (GcScanContext stamps Source = GCFrame node, SourceType = Other).
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pGCFrame);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ pGCFrame->GcScanRoots(gcctx.f, gcctx.sc);
+ pGCFrame = pGCFrame->PtrNextFrame();
+ }
+
+ PTR_ExInfo pExInfo = pThread->GetExceptionState()->GetCurrentExceptionTracker();
+ while (pExInfo != NULL)
+ {
+ // The ExInfo is not a Frame either; GetStackReferences surfaces the in-flight exception
+ // object with the Other source type and the ExInfo node address as the Source, the same
+ // way it reports a GCFrame root. Mirror that here so the runtime-side collection matches cDAC.
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pExInfo);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ PTR_PTR_Object pRef = dac_cast<PTR_PTR_Object>(&pExInfo->m_exception);
+ gcctx.f(pRef, gcctx.sc, 0);
+ pExInfo = pExInfo->GetPreviousExceptionTracker();
+ }
 
  return collectCtx.overflow ? S_FALSE : S_OK;
 }
@@ -867,7 +893,7 @@ static void ReportMismatch(const char* message, Thread* pThread, PCONTEXT regs)
 struct FrameRefGroup
 {
  CLRDATA_ADDRESS Source;
- int SourceType; // 0 = IP, 1 = Frame
+ int SourceType; // 0 = IP, 1 = Frame, 2 = Other
  int StartIdx; // Index into the original ref array
  int Count; // Number of refs in this group
 };
@@ -1624,7 +1650,15 @@ static void ResolveMethodName(CLRDATA_ADDRESS source, int sourceType, char* buf,
  if (bufLen <= 0)
  return;
 
- if (sourceType != 0) // SOS_StackSourceFrame
+ if (sourceType == SOS_StackSourceOther)
+ {
+ // A root reported outside the frame walk (GCFrame/GCPROTECT or ExInfo chain). Source is a
+ // node address, not a capital-F Frame, so do not dereference it as a Frame*.
+ snprintf(buf, bufLen, "<other 0x%llx>", (unsigned long long)source);
+ return;
+ }
+
+ if (sourceType == SOS_StackSourceFrame)
  {
  Frame* pFrame = reinterpret_cast<Frame*>(source);
  LPCSTR typeName = Frame::GetFrameTypeName(pFrame->GetFrameIdentifier());

src/coreclr/vm/datadescriptor/datadescriptor.inc

@@ -41,6 +41,7 @@ CDAC_TYPE_FIELD(Thread, T_UINT32, State, cdac_data<Thread>::State)
 CDAC_TYPE_FIELD(Thread, T_UINT32, PreemptiveGCDisabled, cdac_data<Thread>::PreemptiveGCDisabled)
 CDAC_TYPE_FIELD(Thread, T_POINTER, RuntimeThreadLocals, cdac_data<Thread>::RuntimeThreadLocals)
 CDAC_TYPE_FIELD(Thread, T_POINTER, Frame, cdac_data<Thread>::Frame)
+CDAC_TYPE_FIELD(Thread, T_POINTER, GCFrame, cdac_data<Thread>::GCFrame)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackBase, cdac_data<Thread>::CachedStackBase)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackLimit, cdac_data<Thread>::CachedStackLimit)
 CDAC_TYPE_FIELD(Thread, T_POINTER, ExceptionTracker, cdac_data<Thread>::ExceptionTracker)
@@ -71,6 +72,14 @@ CDAC_TYPE_FIELD(ThreadStore, T_INT32, PendingCount, cdac_data<ThreadStore>::Pend
 CDAC_TYPE_FIELD(ThreadStore, T_INT32, DeadCount, cdac_data<ThreadStore>::DeadCount)
 CDAC_TYPE_END(ThreadStore)
 
+CDAC_TYPE_BEGIN(GCFrame)
+CDAC_TYPE_INDETERMINATE(GCFrame)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, Next, cdac_data<GCFrame>::Next)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, ObjRefs, cdac_data<GCFrame>::ObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, NumObjRefs, cdac_data<GCFrame>::NumObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, GCFlags, cdac_data<GCFrame>::GCFlags)
+CDAC_TYPE_END(GCFrame)
+
 CDAC_TYPE_BEGIN(RuntimeThreadLocals)
 CDAC_TYPE_INDETERMINATE(RuntimeThreadLocals)
 CDAC_TYPE_FIELD(RuntimeThreadLocals, TYPE(EEAllocContext), AllocContext, offsetof(RuntimeThreadLocals, alloc_context))

src/coreclr/vm/exceptionhandling.cpp

@@ -512,7 +512,7 @@ static void PopExplicitFrames(Thread *pThread, void *targetSp, void *targetCalle
  if (popGCFrames)
  {
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while ((pGCFrame != GCFRAME_TOP) && pGCFrame->GetOSStackLocation() < targetSp)
+ while ((pGCFrame != nullptr) && pGCFrame->GetOSStackLocation() < targetSp)
  {
  pGCFrame->Pop();
  pGCFrame = pThread->GetGCFrame();

src/coreclr/vm/frames.cpp

@@ -1185,28 +1185,29 @@ GCFrame::~GCFrame()
  NOTHROW;
  GC_NOTRIGGER;
  MODE_ANY;
- PRECONDITION(m_pCurThread != NULL);
  }
  CONTRACTL_END;
 
- // m_pNext is NULL when the frame was already popped from the stack.
- if (m_Next != NULL)
+ // Normally the destructor performs the pop for a GCPROTECT_BEGIN/END scope, so the frame is
+ // still linked when we get here. If it was already popped explicitly - by PopExplicitFrames
+ // during EH unwind, or by the interpreter's GCReporting::Unregister - then m_pCurThread is
+ // NULL and there is nothing left to do.
+ if (m_pCurThread != NULL)
  {
- // This is a GCFrame that was not popped. This is a problem.
- // We should have popped it before we destruct
  // Do a manual switch to the GC cooperative mode instead of using the GCX_COOP_THREAD_EXISTS
  // macro so that this function isn't slowed down by having to deal with FS:0 chain on x86 Windows.
- BOOL wasCoop = m_pCurThread->PreemptiveGCDisabled();
+ Thread *pThread = m_pCurThread;
+ BOOL wasCoop = pThread->PreemptiveGCDisabled();
  if (!wasCoop)
  {
-m_pCurThread->DisablePreemptiveGC();
+pThread->DisablePreemptiveGC();
  }
 
  Pop();
 
  if (!wasCoop)
  {
-m_pCurThread->EnablePreemptiveGC();
+pThread->EnablePreemptiveGC();
  }
  }
 }
@@ -1233,7 +1234,7 @@ void GCFrame::Push(Thread* pThread)
  // in which the compiler will lay them out in the stack frame.
  // So minipal_getpagesize() is a guess of the maximum stack frame size of any method
  // with multiple GCFrames in coreclr.dll
- _ASSERTE(((m_Next == GCFRAME_TOP) ||
+ _ASSERTE(((m_Next == NULL) ||
  (PBYTE(m_Next->GetOSStackLocation()) + (2 * minipal_getpagesize())) > PBYTE(this->GetOSStackLocation())) &&
  "Pushing a GCFrame out of order ?");
 
@@ -1258,13 +1259,15 @@ void GCFrame::Pop()
  _ASSERTE(m_pCurThread->GetGCFrame() == this && "Popping a GCFrame out of order ?");
 
  m_pCurThread->SetGCFrame(m_Next);
- m_Next = NULL;
 
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
  Thread::ObjectRefNew(&m_pObjRefs[i]); // Unprotect them
 #endif
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 void GCFrame::Remove()
@@ -1280,7 +1283,7 @@ void GCFrame::Remove()
 
  GCFrame *pPrevFrame = NULL;
  GCFrame *pFrame = m_pCurThread->GetGCFrame();
- while (pFrame != GCFRAME_TOP)
+ while (pFrame != NULL)
  {
  if (pFrame == this)
  {
@@ -1293,8 +1296,6 @@ void GCFrame::Remove()
  m_pCurThread->SetGCFrame(m_Next);
  }
 
- m_Next = NULL;
-
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
@@ -1308,6 +1309,9 @@ void GCFrame::Remove()
  }
 
  _ASSERTE_MSG(pFrame != NULL, "GCFrame not found in the current thread's stack");
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 #endif // !DACCESS_COMPILE
@@ -1393,7 +1397,7 @@ BOOL IsProtectedByGCFrame(OBJECTREF *ppObjectRef)
  GetThread()->StackWalkFrames(IsProtectedByGCFrameStackWalkFramesCallback, &d);
 
  GCFrame* pGCFrame = GetThread()->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  if (pGCFrame->Protects(ppObjectRef)) {
  d.count++;

src/coreclr/vm/frames.h

@@ -184,7 +184,6 @@ class DacDbiInterfaceImpl;
 // whenever we compare it to a PTR_Frame value (the usual use of the value).
 #define FRAME_TOP_VALUE ~0 // we want to say -1 here, but gcc has trouble with the signed value
 #define FRAME_TOP (PTR_Frame(FRAME_TOP_VALUE))
-#define GCFRAME_TOP (PTR_GCFrame(FRAME_TOP_VALUE))
 
 
 enum class FrameIdentifier : TADDR
@@ -1808,6 +1807,17 @@ class GCFrame
 #ifdef FEATURE_INTERPRETER
  PTR_VOID m_osStackLocation;
 #endif
+
+ friend struct ::cdac_data<GCFrame>;
+};
+
+template<>
+struct cdac_data<GCFrame>
+{
+ static constexpr size_t Next = offsetof(GCFrame, m_Next);
+ static constexpr size_t ObjRefs = offsetof(GCFrame, m_pObjRefs);
+ static constexpr size_t NumObjRefs = offsetof(GCFrame, m_numObjRefs);
+ static constexpr size_t GCFlags = offsetof(GCFrame, m_gcFlags);
 };
 
 //-----------------------------------------------------------------------------

src/coreclr/vm/gcenv.ee.cpp

@@ -200,7 +200,7 @@ static void ScanStackRoots(Thread * pThread, promote_func* fn, ScanContext* sc)
  }
 
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  pGCFrame->GcScanRoots(fn, sc);
  pGCFrame = pGCFrame->PtrNextFrame();

src/coreclr/vm/threads.cpp

@@ -1185,7 +1185,7 @@ Thread::Thread()
  CONTRACTL_END;
 
  m_pFrame = FRAME_TOP;
- m_pGCFrame = GCFRAME_TOP;
+ m_pGCFrame = NULL;
 
  m_fPreemptiveGCDisabled = 0;
 
@@ -6752,7 +6752,7 @@ PTR_GCFrame Thread::GetGCFrame()
  {
  void* curSP;
  curSP = (void *)GetCurrentSP();
- _ASSERTE((m_pGCFrame == (GCFrame*)-1) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
+ _ASSERTE((m_pGCFrame == NULL) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
  }
 #endif
 

src/coreclr/vm/threads.h

@@ -3769,6 +3769,7 @@ struct cdac_data<Thread>
  static constexpr size_t PreemptiveGCDisabled = offsetof(Thread, m_fPreemptiveGCDisabled);
  static constexpr size_t RuntimeThreadLocals = offsetof(Thread, m_pRuntimeThreadLocals);
  static constexpr size_t Frame = offsetof(Thread, m_pFrame);
+ static constexpr size_t GCFrame = offsetof(Thread, m_pGCFrame);
  static constexpr size_t CachedStackBase = offsetof(Thread, m_CacheStackBase);
  static constexpr size_t CachedStackLimit = offsetof(Thread, m_CacheStackLimit);
  static constexpr size_t ExposedObject = offsetof(Thread, m_ExposedObject);

docs/design/datacontracts/StackWalk.md

@@ -149,6 +149,10 @@ This contract depends on the following descriptors:
 | `ExceptionInfo` | `PassNumber` | Exception handling pass (1 or 2) |
 | `ExceptionInfo` | `ClauseForCatchHandlerStartPC` | Start PC offset of the catch handler clause, used for interruptible offset override |
 | `ExceptionInfo` | `ClauseForCatchHandlerEndPC` | End PC offset of the catch handler clause, used for interruptible offset override |
+| `GCFrame` | `Next` | Pointer to the next `GCFrame` toward the top of the chain |
+| `GCFrame` | `ObjRefs` | Pointer to the array of protected object reference slots |
+| `GCFrame` | `NumObjRefs` | Count of protected object reference slots starting at `ObjRefs` |
+| `GCFrame` | `GCFlags` | `GC_CALL_*` promotion flags applied when reporting the protected slots |
 
 Global variables used:
 | Global Name | Type | Purpose |
@@ -168,6 +172,7 @@ Contracts used:
 | `Thread` |
 | `RuntimeTypeSystem` |
 | `GCInfo` |
+| `Exception` |
 
 
 ### Stackwalk Algorithm
@@ -594,7 +599,7 @@ If no Frame in the chain produces a usable context (thread is not running manage
 
 ### GC Stack Reference Scanning
 
-`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers. The native equivalent is `DacStackReferenceWalker` which calls `GcStackCrawlCallBack` at each frame.
+`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers, then reporting the thread's GCFrame (GCPROTECT) chain and in-flight exception (ExInfo) chain. This mirrors the GC's own root enumeration, `ScanStackRoots`.
 
 #### Stack Walk Integration
 
@@ -628,6 +633,15 @@ At each frame yielded by `Filter`, the walk determines whether to scan for GC re
 
 See [GCRefMap Format and Resolution](#gcrefmap-format-and-resolution) for the GCRefMap scanning path. The signature-based scanning fallback (`PromoteCallerStack`) is currently a stub awaiting an `ICallingConvention` contract port; the stress harness handles the resulting gaps via a deferred-frame sentinel (see [tests/StressTests/known-issues.md](../../../src/native/managed/cdac/tests/StressTests/known-issues.md) and tracking issue [dotnet/runtime#127765](https://github.com/dotnet/runtime/issues/127765)).
 
+#### GCFrame and Exception Tracker Roots
+
+After walking the thread's frames, `WalkStackReferences` reports two additional sets of roots that the GC keeps alive but that are not surfaced by per-frame GC info (matching native `gcenv.ee.cpp` `ScanStackRoots`):
+
+- **GCFrame (GCPROTECT) chain**: starting from `Thread.GCFrame` (obtained via the `Thread` contract's `GetThreadData`), each `GCFrame` is walked via its `Next` pointer until TargetPointer.Null is reached. For each node, the `NumObjRefs` slots starting at `ObjRefs` are reported, applying the node's `GCFlags` (`GC_CALL_INTERIOR` / `GC_CALL_PINNED`) as the promotion flags. This mirrors native `GCFrame::GcScanRoots`.
+- **Exception tracker (ExInfo) chain**: starting from the thread's exception tracker, each in-flight exception object (the current one and any superseded/nested ones reached via `PreviousNestedInfo`) is reported through its thrown-object slot.
+
+Both sets carry a non-zero, stack-resident `Source` and `StackPointer` set to the GCFrame / ExInfo node address (the node lives on the stack). A `GCFrame` node belongs to a separate chain from the explicit `Frame` chain, and an ExInfo node is likewise not a capital-F `Frame`, so neither is reported with the `Frame` source type. Both use the `Other` source type, which marks a root reported outside the per-frame walk.
+
 ### GCRefMap Format and Resolution
 
 A **GCRefMap** is a compact per-callsite encoding that describes which stack slots in a `TransitionBlock` contain GC references. GCRefMaps are pre-computed by the ReadyToRun compiler and stored in the PE image's import section auxiliary data.

docs/design/datacontracts/Thread.md

@@ -55,6 +55,7 @@ record struct ThreadData (
  TargetPointer ThreadHandle;
  bool IsInteropDebuggingHijacked;
  TargetPointer DebuggerFilterContext;
+ TargetPointer GCFrame;
 );
 ```
 
@@ -123,6 +124,7 @@ The contract additionally depends on these data descriptors
 | `Thread` | `DebuggerControlledThreadState` | Thread state flags controlled by the debugger |
 | `Thread` | `PreemptiveGCDisabled` | Flag indicating if preemptive GC is disabled |
 | `Thread` | `Frame` | Pointer to current frame |
+| `Thread` | `GCFrame` | Pointer to the head of the thread's GCFrame chain. |
 | `Thread` | `CachedStackBase` | Pointer to the base of the stack |
 | `Thread` | `CachedStackLimit` | Pointer to the limit of the stack |
 | `Thread` | `ExposedObject` | Handle to the managed `Thread` object exposed to the debugger |
@@ -237,6 +239,7 @@ ThreadData GetThreadData(TargetPointer address)
  LastThrownObjectHandle : lastThrownObjectHandle,
  FirstNestedException : firstNestedException,
  NextThread: target.ReadPointer(address + /* Thread::LinkNext offset */) - threadLinkOffset;
+ GCFrame: target.ReadPointer(address + /* Thread::GCFrame offset */),
  );
 }
 

src/coreclr/inc/sospriv.idl

@@ -111,6 +111,7 @@ typedef enum SOSStackSourceType
 {
  SOS_StackSourceIP, // Instruction pointer in managed code
  SOS_StackSourceFrame, // clr!Frame
+ SOS_StackSourceOther, // Roots which do not come from managed code or Frames
 } SOSStackSourceType;
 
 typedef enum SOSRefFlags

src/coreclr/pal/prebuilt/inc/sospriv.h

@@ -462,7 +462,8 @@ typedef
 enum SOSStackSourceType
  {
  SOS_StackSourceIP = 0,
- SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 )
+ SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 ),
+ SOS_StackSourceOther = ( SOS_StackSourceFrame + 1 )
  } SOSStackSourceType;
 
 typedef

src/coreclr/vm/cdacstress.cpp

@@ -76,7 +76,7 @@ struct StackRef
  CLRDATA_ADDRESS Object; // The object pointer value
  unsigned int Flags; // SOSRefFlags (interior, pinned)
  CLRDATA_ADDRESS Source; // IP or Frame that owns this ref
- int SourceType; // SOS_StackSourceIPor SOS_StackSourceFrame
+ int SourceType; // SOS_StackSourceIP, SOS_StackSourceFrame, or SOS_StackSourceOther
  int Register; // Processor-encoding reg number, -1 for stack slots
  // (cDAC populates from GcInfo; runtime populates
  // by inverting GetRegisterSlot on supported arches)
@@ -721,7 +721,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  collectCtx.refs = outRefs;
  collectCtx.overflow = false;
  collectCtx.currentFrameSource = 0;
- collectCtx.currentFrameSourceType = 0;
+ collectCtx.currentFrameSourceType = SOS_StackSourceIP;
  collectCtx.currentRegDisplay = nullptr;
 
  GCCONTEXT gcctx = {};
@@ -780,7 +780,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // safepoint (matches DAC SOS_StackSourceIP convention).
  collectCtx->currentFrameSource =
  (CLRDATA_ADDRESS)PCODEToPINSTR(GetControlPC(pCF->GetRegisterSet()));
- collectCtx->currentFrameSourceType = 0; // SOS_StackSourceIP
+ collectCtx->currentFrameSourceType = SOS_StackSourceIP;
  collectCtx->currentRegDisplay = pCF->GetRegisterSet();
 
  ICodeManager* pCM = pCF->GetCodeManager();
@@ -801,7 +801,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // emit register-resident refs, so leave currentRegDisplay null.
  Frame* pFrame = pCF->GetFrame();
  collectCtx->currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pFrame);
- collectCtx->currentFrameSourceType = 1; // SOS_StackSourceFrame
+ collectCtx->currentFrameSourceType = SOS_StackSourceFrame;
 
  pFrame->GcScanRoots(gcctx->f, gcctx->sc);
  }
@@ -812,10 +812,36 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
 
  pThread->StackWalkFrames(dacLikeCallback, &diagCtx, flagsStackWalk);
 
- // NOTE: ScanStackRoots also scans the separate GCFrame linked list
- // (Thread::GetGCFrame), but the DAC's GetStackReferences / DacStackReferenceWalker
- // does NOT include those. We intentionally omit GCFrame scanning here so our
- // runtime-side collection matches what the cDAC is expected to produce.
+ // ScanStackRoots also scans two root sets that are not part of the frame walk: the
+ // GCFrame (GCPROTECT) chain and the in-flight ExInfo chain. GetStackReferences reports
+ // both, so mirror them here to keep the runtime-side collection in parity. See
+ // ScanStackRoots in gcenv.ee.cpp.
+ GCFrame* pGCFrame = pThread->GetGCFrame();
+ while (pGCFrame != nullptr)
+ {
+ // A GCFrame node is a separate chain from the explicit Frame chain, so it is not a
+ // capital-F Frame. Report it with the Other source type and the GCFrame node address as
+ // the Source, matching cDAC (GcScanContext stamps Source = GCFrame node, SourceType = Other).
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pGCFrame);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ pGCFrame->GcScanRoots(gcctx.f, gcctx.sc);
+ pGCFrame = pGCFrame->PtrNextFrame();
+ }
+
+ PTR_ExInfo pExInfo = pThread->GetExceptionState()->GetCurrentExceptionTracker();
+ while (pExInfo != NULL)
+ {
+ // The ExInfo is not a Frame either; GetStackReferences surfaces the in-flight exception
+ // object with the Other source type and the ExInfo node address as the Source, the same
+ // way it reports a GCFrame root. Mirror that here so the runtime-side collection matches cDAC.
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pExInfo);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ PTR_PTR_Object pRef = dac_cast<PTR_PTR_Object>(&pExInfo->m_exception);
+ gcctx.f(pRef, gcctx.sc, 0);
+ pExInfo = pExInfo->GetPreviousExceptionTracker();
+ }
 
  return collectCtx.overflow ? S_FALSE : S_OK;
 }
@@ -867,7 +893,7 @@ static void ReportMismatch(const char* message, Thread* pThread, PCONTEXT regs)
 struct FrameRefGroup
 {
  CLRDATA_ADDRESS Source;
- int SourceType; // 0 = IP, 1 = Frame
+ int SourceType; // 0 = IP, 1 = Frame, 2 = Other
  int StartIdx; // Index into the original ref array
  int Count; // Number of refs in this group
 };
@@ -1624,7 +1650,15 @@ static void ResolveMethodName(CLRDATA_ADDRESS source, int sourceType, char* buf,
  if (bufLen <= 0)
  return;
 
- if (sourceType != 0) // SOS_StackSourceFrame
+ if (sourceType == SOS_StackSourceOther)
+ {
+ // A root reported outside the frame walk (GCFrame/GCPROTECT or ExInfo chain). Source is a
+ // node address, not a capital-F Frame, so do not dereference it as a Frame*.
+ snprintf(buf, bufLen, "<other 0x%llx>", (unsigned long long)source);
+ return;
+ }
+
+ if (sourceType == SOS_StackSourceFrame)
  {
  Frame* pFrame = reinterpret_cast<Frame*>(source);
  LPCSTR typeName = Frame::GetFrameTypeName(pFrame->GetFrameIdentifier());

src/coreclr/vm/datadescriptor/datadescriptor.inc

@@ -41,6 +41,7 @@ CDAC_TYPE_FIELD(Thread, T_UINT32, State, cdac_data<Thread>::State)
 CDAC_TYPE_FIELD(Thread, T_UINT32, PreemptiveGCDisabled, cdac_data<Thread>::PreemptiveGCDisabled)
 CDAC_TYPE_FIELD(Thread, T_POINTER, RuntimeThreadLocals, cdac_data<Thread>::RuntimeThreadLocals)
 CDAC_TYPE_FIELD(Thread, T_POINTER, Frame, cdac_data<Thread>::Frame)
+CDAC_TYPE_FIELD(Thread, T_POINTER, GCFrame, cdac_data<Thread>::GCFrame)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackBase, cdac_data<Thread>::CachedStackBase)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackLimit, cdac_data<Thread>::CachedStackLimit)
 CDAC_TYPE_FIELD(Thread, T_POINTER, ExceptionTracker, cdac_data<Thread>::ExceptionTracker)
@@ -71,6 +72,14 @@ CDAC_TYPE_FIELD(ThreadStore, T_INT32, PendingCount, cdac_data<ThreadStore>::Pend
 CDAC_TYPE_FIELD(ThreadStore, T_INT32, DeadCount, cdac_data<ThreadStore>::DeadCount)
 CDAC_TYPE_END(ThreadStore)
 
+CDAC_TYPE_BEGIN(GCFrame)
+CDAC_TYPE_INDETERMINATE(GCFrame)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, Next, cdac_data<GCFrame>::Next)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, ObjRefs, cdac_data<GCFrame>::ObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, NumObjRefs, cdac_data<GCFrame>::NumObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, GCFlags, cdac_data<GCFrame>::GCFlags)
+CDAC_TYPE_END(GCFrame)
+
 CDAC_TYPE_BEGIN(RuntimeThreadLocals)
 CDAC_TYPE_INDETERMINATE(RuntimeThreadLocals)
 CDAC_TYPE_FIELD(RuntimeThreadLocals, TYPE(EEAllocContext), AllocContext, offsetof(RuntimeThreadLocals, alloc_context))

src/coreclr/vm/exceptionhandling.cpp

@@ -512,7 +512,7 @@ static void PopExplicitFrames(Thread *pThread, void *targetSp, void *targetCalle
  if (popGCFrames)
  {
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while ((pGCFrame != GCFRAME_TOP) && pGCFrame->GetOSStackLocation() < targetSp)
+ while ((pGCFrame != nullptr) && pGCFrame->GetOSStackLocation() < targetSp)
  {
  pGCFrame->Pop();
  pGCFrame = pThread->GetGCFrame();

src/coreclr/vm/frames.cpp

@@ -1185,28 +1185,29 @@ GCFrame::~GCFrame()
  NOTHROW;
  GC_NOTRIGGER;
  MODE_ANY;
- PRECONDITION(m_pCurThread != NULL);
  }
  CONTRACTL_END;
 
- // m_pNext is NULL when the frame was already popped from the stack.
- if (m_Next != NULL)
+ // Normally the destructor performs the pop for a GCPROTECT_BEGIN/END scope, so the frame is
+ // still linked when we get here. If it was already popped explicitly - by PopExplicitFrames
+ // during EH unwind, or by the interpreter's GCReporting::Unregister - then m_pCurThread is
+ // NULL and there is nothing left to do.
+ if (m_pCurThread != NULL)
  {
- // This is a GCFrame that was not popped. This is a problem.
- // We should have popped it before we destruct
  // Do a manual switch to the GC cooperative mode instead of using the GCX_COOP_THREAD_EXISTS
  // macro so that this function isn't slowed down by having to deal with FS:0 chain on x86 Windows.
- BOOL wasCoop = m_pCurThread->PreemptiveGCDisabled();
+ Thread *pThread = m_pCurThread;
+ BOOL wasCoop = pThread->PreemptiveGCDisabled();
  if (!wasCoop)
  {
-m_pCurThread->DisablePreemptiveGC();
+pThread->DisablePreemptiveGC();
  }
 
  Pop();
 
  if (!wasCoop)
  {
-m_pCurThread->EnablePreemptiveGC();
+pThread->EnablePreemptiveGC();
  }
  }
 }
@@ -1233,7 +1234,7 @@ void GCFrame::Push(Thread* pThread)
  // in which the compiler will lay them out in the stack frame.
  // So minipal_getpagesize() is a guess of the maximum stack frame size of any method
  // with multiple GCFrames in coreclr.dll
- _ASSERTE(((m_Next == GCFRAME_TOP) ||
+ _ASSERTE(((m_Next == NULL) ||
  (PBYTE(m_Next->GetOSStackLocation()) + (2 * minipal_getpagesize())) > PBYTE(this->GetOSStackLocation())) &&
  "Pushing a GCFrame out of order ?");
 
@@ -1258,13 +1259,15 @@ void GCFrame::Pop()
  _ASSERTE(m_pCurThread->GetGCFrame() == this && "Popping a GCFrame out of order ?");
 
  m_pCurThread->SetGCFrame(m_Next);
- m_Next = NULL;
 
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
  Thread::ObjectRefNew(&m_pObjRefs[i]); // Unprotect them
 #endif
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 void GCFrame::Remove()
@@ -1280,7 +1283,7 @@ void GCFrame::Remove()
 
  GCFrame *pPrevFrame = NULL;
  GCFrame *pFrame = m_pCurThread->GetGCFrame();
- while (pFrame != GCFRAME_TOP)
+ while (pFrame != NULL)
  {
  if (pFrame == this)
  {
@@ -1293,8 +1296,6 @@ void GCFrame::Remove()
  m_pCurThread->SetGCFrame(m_Next);
  }
 
- m_Next = NULL;
-
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
@@ -1308,6 +1309,9 @@ void GCFrame::Remove()
  }
 
  _ASSERTE_MSG(pFrame != NULL, "GCFrame not found in the current thread's stack");
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 #endif // !DACCESS_COMPILE
@@ -1393,7 +1397,7 @@ BOOL IsProtectedByGCFrame(OBJECTREF *ppObjectRef)
  GetThread()->StackWalkFrames(IsProtectedByGCFrameStackWalkFramesCallback, &d);
 
  GCFrame* pGCFrame = GetThread()->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  if (pGCFrame->Protects(ppObjectRef)) {
  d.count++;

src/coreclr/vm/frames.h

@@ -184,7 +184,6 @@ class DacDbiInterfaceImpl;
 // whenever we compare it to a PTR_Frame value (the usual use of the value).
 #define FRAME_TOP_VALUE ~0 // we want to say -1 here, but gcc has trouble with the signed value
 #define FRAME_TOP (PTR_Frame(FRAME_TOP_VALUE))
-#define GCFRAME_TOP (PTR_GCFrame(FRAME_TOP_VALUE))
 
 
 enum class FrameIdentifier : TADDR
@@ -1808,6 +1807,17 @@ class GCFrame
 #ifdef FEATURE_INTERPRETER
  PTR_VOID m_osStackLocation;
 #endif
+
+ friend struct ::cdac_data<GCFrame>;
+};
+
+template<>
+struct cdac_data<GCFrame>
+{
+ static constexpr size_t Next = offsetof(GCFrame, m_Next);
+ static constexpr size_t ObjRefs = offsetof(GCFrame, m_pObjRefs);
+ static constexpr size_t NumObjRefs = offsetof(GCFrame, m_numObjRefs);
+ static constexpr size_t GCFlags = offsetof(GCFrame, m_gcFlags);
 };
 
 //-----------------------------------------------------------------------------

src/coreclr/vm/gcenv.ee.cpp

@@ -200,7 +200,7 @@ static void ScanStackRoots(Thread * pThread, promote_func* fn, ScanContext* sc)
  }
 
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  pGCFrame->GcScanRoots(fn, sc);
  pGCFrame = pGCFrame->PtrNextFrame();

src/coreclr/vm/threads.cpp

@@ -1185,7 +1185,7 @@ Thread::Thread()
  CONTRACTL_END;
 
  m_pFrame = FRAME_TOP;
- m_pGCFrame = GCFRAME_TOP;
+ m_pGCFrame = NULL;
 
  m_fPreemptiveGCDisabled = 0;
 
@@ -6752,7 +6752,7 @@ PTR_GCFrame Thread::GetGCFrame()
  {
  void* curSP;
  curSP = (void *)GetCurrentSP();
- _ASSERTE((m_pGCFrame == (GCFrame*)-1) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
+ _ASSERTE((m_pGCFrame == NULL) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
  }
 #endif
 

src/coreclr/vm/threads.h

@@ -3769,6 +3769,7 @@ struct cdac_data<Thread>
  static constexpr size_t PreemptiveGCDisabled = offsetof(Thread, m_fPreemptiveGCDisabled);
  static constexpr size_t RuntimeThreadLocals = offsetof(Thread, m_pRuntimeThreadLocals);
  static constexpr size_t Frame = offsetof(Thread, m_pFrame);
+ static constexpr size_t GCFrame = offsetof(Thread, m_pGCFrame);
  static constexpr size_t CachedStackBase = offsetof(Thread, m_CacheStackBase);
  static constexpr size_t CachedStackLimit = offsetof(Thread, m_CacheStackLimit);
  static constexpr size_t ExposedObject = offsetof(Thread, m_ExposedObject);

docs/design/datacontracts/StackWalk.md

@@ -149,6 +149,10 @@ This contract depends on the following descriptors:
 | `ExceptionInfo` | `PassNumber` | Exception handling pass (1 or 2) |
 | `ExceptionInfo` | `ClauseForCatchHandlerStartPC` | Start PC offset of the catch handler clause, used for interruptible offset override |
 | `ExceptionInfo` | `ClauseForCatchHandlerEndPC` | End PC offset of the catch handler clause, used for interruptible offset override |
+| `GCFrame` | `Next` | Pointer to the next `GCFrame` toward the top of the chain |
+| `GCFrame` | `ObjRefs` | Pointer to the array of protected object reference slots |
+| `GCFrame` | `NumObjRefs` | Count of protected object reference slots starting at `ObjRefs` |
+| `GCFrame` | `GCFlags` | `GC_CALL_*` promotion flags applied when reporting the protected slots |
 
 Global variables used:
 | Global Name | Type | Purpose |
@@ -168,6 +172,7 @@ Contracts used:
 | `Thread` |
 | `RuntimeTypeSystem` |
 | `GCInfo` |
+| `Exception` |
 
 
 ### Stackwalk Algorithm
@@ -594,7 +599,7 @@ If no Frame in the chain produces a usable context (thread is not running manage
 
 ### GC Stack Reference Scanning
 
-`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers. The native equivalent is `DacStackReferenceWalker` which calls `GcStackCrawlCallBack` at each frame.
+`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers, then reporting the thread's GCFrame (GCPROTECT) chain and in-flight exception (ExInfo) chain. This mirrors the GC's own root enumeration, `ScanStackRoots`.
 
 #### Stack Walk Integration
 
@@ -628,6 +633,15 @@ At each frame yielded by `Filter`, the walk determines whether to scan for GC re
 
 See [GCRefMap Format and Resolution](#gcrefmap-format-and-resolution) for the GCRefMap scanning path. The signature-based scanning fallback (`PromoteCallerStack`) is currently a stub awaiting an `ICallingConvention` contract port; the stress harness handles the resulting gaps via a deferred-frame sentinel (see [tests/StressTests/known-issues.md](../../../src/native/managed/cdac/tests/StressTests/known-issues.md) and tracking issue [dotnet/runtime#127765](https://github.com/dotnet/runtime/issues/127765)).
 
+#### GCFrame and Exception Tracker Roots
+
+After walking the thread's frames, `WalkStackReferences` reports two additional sets of roots that the GC keeps alive but that are not surfaced by per-frame GC info (matching native `gcenv.ee.cpp` `ScanStackRoots`):
+
+- **GCFrame (GCPROTECT) chain**: starting from `Thread.GCFrame` (obtained via the `Thread` contract's `GetThreadData`), each `GCFrame` is walked via its `Next` pointer until TargetPointer.Null is reached. For each node, the `NumObjRefs` slots starting at `ObjRefs` are reported, applying the node's `GCFlags` (`GC_CALL_INTERIOR` / `GC_CALL_PINNED`) as the promotion flags. This mirrors native `GCFrame::GcScanRoots`.
+- **Exception tracker (ExInfo) chain**: starting from the thread's exception tracker, each in-flight exception object (the current one and any superseded/nested ones reached via `PreviousNestedInfo`) is reported through its thrown-object slot.
+
+Both sets carry a non-zero, stack-resident `Source` and `StackPointer` set to the GCFrame / ExInfo node address (the node lives on the stack). A `GCFrame` node belongs to a separate chain from the explicit `Frame` chain, and an ExInfo node is likewise not a capital-F `Frame`, so neither is reported with the `Frame` source type. Both use the `Other` source type, which marks a root reported outside the per-frame walk.
+
 ### GCRefMap Format and Resolution
 
 A **GCRefMap** is a compact per-callsite encoding that describes which stack slots in a `TransitionBlock` contain GC references. GCRefMaps are pre-computed by the ReadyToRun compiler and stored in the PE image's import section auxiliary data.

docs/design/datacontracts/Thread.md

@@ -55,6 +55,7 @@ record struct ThreadData (
  TargetPointer ThreadHandle;
  bool IsInteropDebuggingHijacked;
  TargetPointer DebuggerFilterContext;
+ TargetPointer GCFrame;
 );
 ```
 
@@ -123,6 +124,7 @@ The contract additionally depends on these data descriptors
 | `Thread` | `DebuggerControlledThreadState` | Thread state flags controlled by the debugger |
 | `Thread` | `PreemptiveGCDisabled` | Flag indicating if preemptive GC is disabled |
 | `Thread` | `Frame` | Pointer to current frame |
+| `Thread` | `GCFrame` | Pointer to the head of the thread's GCFrame chain. |
 | `Thread` | `CachedStackBase` | Pointer to the base of the stack |
 | `Thread` | `CachedStackLimit` | Pointer to the limit of the stack |
 | `Thread` | `ExposedObject` | Handle to the managed `Thread` object exposed to the debugger |
@@ -237,6 +239,7 @@ ThreadData GetThreadData(TargetPointer address)
  LastThrownObjectHandle : lastThrownObjectHandle,
  FirstNestedException : firstNestedException,
  NextThread: target.ReadPointer(address + /* Thread::LinkNext offset */) - threadLinkOffset;
+ GCFrame: target.ReadPointer(address + /* Thread::GCFrame offset */),
  );
 }
 

src/coreclr/inc/sospriv.idl

@@ -111,6 +111,7 @@ typedef enum SOSStackSourceType
 {
  SOS_StackSourceIP, // Instruction pointer in managed code
  SOS_StackSourceFrame, // clr!Frame
+ SOS_StackSourceOther, // Roots which do not come from managed code or Frames
 } SOSStackSourceType;
 
 typedef enum SOSRefFlags

src/coreclr/pal/prebuilt/inc/sospriv.h

@@ -462,7 +462,8 @@ typedef
 enum SOSStackSourceType
  {
  SOS_StackSourceIP = 0,
- SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 )
+ SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 ),
+ SOS_StackSourceOther = ( SOS_StackSourceFrame + 1 )
  } SOSStackSourceType;
 
 typedef

src/coreclr/vm/cdacstress.cpp

@@ -76,7 +76,7 @@ struct StackRef
  CLRDATA_ADDRESS Object; // The object pointer value
  unsigned int Flags; // SOSRefFlags (interior, pinned)
  CLRDATA_ADDRESS Source; // IP or Frame that owns this ref
- int SourceType; // SOS_StackSourceIPor SOS_StackSourceFrame
+ int SourceType; // SOS_StackSourceIP, SOS_StackSourceFrame, or SOS_StackSourceOther
  int Register; // Processor-encoding reg number, -1 for stack slots
  // (cDAC populates from GcInfo; runtime populates
  // by inverting GetRegisterSlot on supported arches)
@@ -721,7 +721,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  collectCtx.refs = outRefs;
  collectCtx.overflow = false;
  collectCtx.currentFrameSource = 0;
- collectCtx.currentFrameSourceType = 0;
+ collectCtx.currentFrameSourceType = SOS_StackSourceIP;
  collectCtx.currentRegDisplay = nullptr;
 
  GCCONTEXT gcctx = {};
@@ -780,7 +780,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // safepoint (matches DAC SOS_StackSourceIP convention).
  collectCtx->currentFrameSource =
  (CLRDATA_ADDRESS)PCODEToPINSTR(GetControlPC(pCF->GetRegisterSet()));
- collectCtx->currentFrameSourceType = 0; // SOS_StackSourceIP
+ collectCtx->currentFrameSourceType = SOS_StackSourceIP;
  collectCtx->currentRegDisplay = pCF->GetRegisterSet();
 
  ICodeManager* pCM = pCF->GetCodeManager();
@@ -801,7 +801,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // emit register-resident refs, so leave currentRegDisplay null.
  Frame* pFrame = pCF->GetFrame();
  collectCtx->currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pFrame);
- collectCtx->currentFrameSourceType = 1; // SOS_StackSourceFrame
+ collectCtx->currentFrameSourceType = SOS_StackSourceFrame;
 
  pFrame->GcScanRoots(gcctx->f, gcctx->sc);
  }
@@ -812,10 +812,36 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
 
  pThread->StackWalkFrames(dacLikeCallback, &diagCtx, flagsStackWalk);
 
- // NOTE: ScanStackRoots also scans the separate GCFrame linked list
- // (Thread::GetGCFrame), but the DAC's GetStackReferences / DacStackReferenceWalker
- // does NOT include those. We intentionally omit GCFrame scanning here so our
- // runtime-side collection matches what the cDAC is expected to produce.
+ // ScanStackRoots also scans two root sets that are not part of the frame walk: the
+ // GCFrame (GCPROTECT) chain and the in-flight ExInfo chain. GetStackReferences reports
+ // both, so mirror them here to keep the runtime-side collection in parity. See
+ // ScanStackRoots in gcenv.ee.cpp.
+ GCFrame* pGCFrame = pThread->GetGCFrame();
+ while (pGCFrame != nullptr)
+ {
+ // A GCFrame node is a separate chain from the explicit Frame chain, so it is not a
+ // capital-F Frame. Report it with the Other source type and the GCFrame node address as
+ // the Source, matching cDAC (GcScanContext stamps Source = GCFrame node, SourceType = Other).
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pGCFrame);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ pGCFrame->GcScanRoots(gcctx.f, gcctx.sc);
+ pGCFrame = pGCFrame->PtrNextFrame();
+ }
+
+ PTR_ExInfo pExInfo = pThread->GetExceptionState()->GetCurrentExceptionTracker();
+ while (pExInfo != NULL)
+ {
+ // The ExInfo is not a Frame either; GetStackReferences surfaces the in-flight exception
+ // object with the Other source type and the ExInfo node address as the Source, the same
+ // way it reports a GCFrame root. Mirror that here so the runtime-side collection matches cDAC.
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pExInfo);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ PTR_PTR_Object pRef = dac_cast<PTR_PTR_Object>(&pExInfo->m_exception);
+ gcctx.f(pRef, gcctx.sc, 0);
+ pExInfo = pExInfo->GetPreviousExceptionTracker();
+ }
 
  return collectCtx.overflow ? S_FALSE : S_OK;
 }
@@ -867,7 +893,7 @@ static void ReportMismatch(const char* message, Thread* pThread, PCONTEXT regs)
 struct FrameRefGroup
 {
  CLRDATA_ADDRESS Source;
- int SourceType; // 0 = IP, 1 = Frame
+ int SourceType; // 0 = IP, 1 = Frame, 2 = Other
  int StartIdx; // Index into the original ref array
  int Count; // Number of refs in this group
 };
@@ -1624,7 +1650,15 @@ static void ResolveMethodName(CLRDATA_ADDRESS source, int sourceType, char* buf,
  if (bufLen <= 0)
  return;
 
- if (sourceType != 0) // SOS_StackSourceFrame
+ if (sourceType == SOS_StackSourceOther)
+ {
+ // A root reported outside the frame walk (GCFrame/GCPROTECT or ExInfo chain). Source is a
+ // node address, not a capital-F Frame, so do not dereference it as a Frame*.
+ snprintf(buf, bufLen, "<other 0x%llx>", (unsigned long long)source);
+ return;
+ }
+
+ if (sourceType == SOS_StackSourceFrame)
  {
  Frame* pFrame = reinterpret_cast<Frame*>(source);
  LPCSTR typeName = Frame::GetFrameTypeName(pFrame->GetFrameIdentifier());

src/coreclr/vm/datadescriptor/datadescriptor.inc

@@ -41,6 +41,7 @@ CDAC_TYPE_FIELD(Thread, T_UINT32, State, cdac_data<Thread>::State)
 CDAC_TYPE_FIELD(Thread, T_UINT32, PreemptiveGCDisabled, cdac_data<Thread>::PreemptiveGCDisabled)
 CDAC_TYPE_FIELD(Thread, T_POINTER, RuntimeThreadLocals, cdac_data<Thread>::RuntimeThreadLocals)
 CDAC_TYPE_FIELD(Thread, T_POINTER, Frame, cdac_data<Thread>::Frame)
+CDAC_TYPE_FIELD(Thread, T_POINTER, GCFrame, cdac_data<Thread>::GCFrame)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackBase, cdac_data<Thread>::CachedStackBase)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackLimit, cdac_data<Thread>::CachedStackLimit)
 CDAC_TYPE_FIELD(Thread, T_POINTER, ExceptionTracker, cdac_data<Thread>::ExceptionTracker)
@@ -71,6 +72,14 @@ CDAC_TYPE_FIELD(ThreadStore, T_INT32, PendingCount, cdac_data<ThreadStore>::Pend
 CDAC_TYPE_FIELD(ThreadStore, T_INT32, DeadCount, cdac_data<ThreadStore>::DeadCount)
 CDAC_TYPE_END(ThreadStore)
 
+CDAC_TYPE_BEGIN(GCFrame)
+CDAC_TYPE_INDETERMINATE(GCFrame)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, Next, cdac_data<GCFrame>::Next)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, ObjRefs, cdac_data<GCFrame>::ObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, NumObjRefs, cdac_data<GCFrame>::NumObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, GCFlags, cdac_data<GCFrame>::GCFlags)
+CDAC_TYPE_END(GCFrame)
+
 CDAC_TYPE_BEGIN(RuntimeThreadLocals)
 CDAC_TYPE_INDETERMINATE(RuntimeThreadLocals)
 CDAC_TYPE_FIELD(RuntimeThreadLocals, TYPE(EEAllocContext), AllocContext, offsetof(RuntimeThreadLocals, alloc_context))

src/coreclr/vm/exceptionhandling.cpp

@@ -512,7 +512,7 @@ static void PopExplicitFrames(Thread *pThread, void *targetSp, void *targetCalle
  if (popGCFrames)
  {
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while ((pGCFrame != GCFRAME_TOP) && pGCFrame->GetOSStackLocation() < targetSp)
+ while ((pGCFrame != nullptr) && pGCFrame->GetOSStackLocation() < targetSp)
  {
  pGCFrame->Pop();
  pGCFrame = pThread->GetGCFrame();

src/coreclr/vm/frames.cpp

@@ -1185,28 +1185,29 @@ GCFrame::~GCFrame()
  NOTHROW;
  GC_NOTRIGGER;
  MODE_ANY;
- PRECONDITION(m_pCurThread != NULL);
  }
  CONTRACTL_END;
 
- // m_pNext is NULL when the frame was already popped from the stack.
- if (m_Next != NULL)
+ // Normally the destructor performs the pop for a GCPROTECT_BEGIN/END scope, so the frame is
+ // still linked when we get here. If it was already popped explicitly - by PopExplicitFrames
+ // during EH unwind, or by the interpreter's GCReporting::Unregister - then m_pCurThread is
+ // NULL and there is nothing left to do.
+ if (m_pCurThread != NULL)
  {
- // This is a GCFrame that was not popped. This is a problem.
- // We should have popped it before we destruct
  // Do a manual switch to the GC cooperative mode instead of using the GCX_COOP_THREAD_EXISTS
  // macro so that this function isn't slowed down by having to deal with FS:0 chain on x86 Windows.
- BOOL wasCoop = m_pCurThread->PreemptiveGCDisabled();
+ Thread *pThread = m_pCurThread;
+ BOOL wasCoop = pThread->PreemptiveGCDisabled();
  if (!wasCoop)
  {
-m_pCurThread->DisablePreemptiveGC();
+pThread->DisablePreemptiveGC();
  }
 
  Pop();
 
  if (!wasCoop)
  {
-m_pCurThread->EnablePreemptiveGC();
+pThread->EnablePreemptiveGC();
  }
  }
 }
@@ -1233,7 +1234,7 @@ void GCFrame::Push(Thread* pThread)
  // in which the compiler will lay them out in the stack frame.
  // So minipal_getpagesize() is a guess of the maximum stack frame size of any method
  // with multiple GCFrames in coreclr.dll
- _ASSERTE(((m_Next == GCFRAME_TOP) ||
+ _ASSERTE(((m_Next == NULL) ||
  (PBYTE(m_Next->GetOSStackLocation()) + (2 * minipal_getpagesize())) > PBYTE(this->GetOSStackLocation())) &&
  "Pushing a GCFrame out of order ?");
 
@@ -1258,13 +1259,15 @@ void GCFrame::Pop()
  _ASSERTE(m_pCurThread->GetGCFrame() == this && "Popping a GCFrame out of order ?");
 
  m_pCurThread->SetGCFrame(m_Next);
- m_Next = NULL;
 
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
  Thread::ObjectRefNew(&m_pObjRefs[i]); // Unprotect them
 #endif
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 void GCFrame::Remove()
@@ -1280,7 +1283,7 @@ void GCFrame::Remove()
 
  GCFrame *pPrevFrame = NULL;
  GCFrame *pFrame = m_pCurThread->GetGCFrame();
- while (pFrame != GCFRAME_TOP)
+ while (pFrame != NULL)
  {
  if (pFrame == this)
  {
@@ -1293,8 +1296,6 @@ void GCFrame::Remove()
  m_pCurThread->SetGCFrame(m_Next);
  }
 
- m_Next = NULL;
-
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
@@ -1308,6 +1309,9 @@ void GCFrame::Remove()
  }
 
  _ASSERTE_MSG(pFrame != NULL, "GCFrame not found in the current thread's stack");
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 #endif // !DACCESS_COMPILE
@@ -1393,7 +1397,7 @@ BOOL IsProtectedByGCFrame(OBJECTREF *ppObjectRef)
  GetThread()->StackWalkFrames(IsProtectedByGCFrameStackWalkFramesCallback, &d);
 
  GCFrame* pGCFrame = GetThread()->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  if (pGCFrame->Protects(ppObjectRef)) {
  d.count++;

src/coreclr/vm/frames.h

@@ -184,7 +184,6 @@ class DacDbiInterfaceImpl;
 // whenever we compare it to a PTR_Frame value (the usual use of the value).
 #define FRAME_TOP_VALUE ~0 // we want to say -1 here, but gcc has trouble with the signed value
 #define FRAME_TOP (PTR_Frame(FRAME_TOP_VALUE))
-#define GCFRAME_TOP (PTR_GCFrame(FRAME_TOP_VALUE))
 
 
 enum class FrameIdentifier : TADDR
@@ -1808,6 +1807,17 @@ class GCFrame
 #ifdef FEATURE_INTERPRETER
  PTR_VOID m_osStackLocation;
 #endif
+
+ friend struct ::cdac_data<GCFrame>;
+};
+
+template<>
+struct cdac_data<GCFrame>
+{
+ static constexpr size_t Next = offsetof(GCFrame, m_Next);
+ static constexpr size_t ObjRefs = offsetof(GCFrame, m_pObjRefs);
+ static constexpr size_t NumObjRefs = offsetof(GCFrame, m_numObjRefs);
+ static constexpr size_t GCFlags = offsetof(GCFrame, m_gcFlags);
 };
 
 //-----------------------------------------------------------------------------

src/coreclr/vm/gcenv.ee.cpp

@@ -200,7 +200,7 @@ static void ScanStackRoots(Thread * pThread, promote_func* fn, ScanContext* sc)
  }
 
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  pGCFrame->GcScanRoots(fn, sc);
  pGCFrame = pGCFrame->PtrNextFrame();

src/coreclr/vm/threads.cpp

@@ -1185,7 +1185,7 @@ Thread::Thread()
  CONTRACTL_END;
 
  m_pFrame = FRAME_TOP;
- m_pGCFrame = GCFRAME_TOP;
+ m_pGCFrame = NULL;
 
  m_fPreemptiveGCDisabled = 0;
 
@@ -6752,7 +6752,7 @@ PTR_GCFrame Thread::GetGCFrame()
  {
  void* curSP;
  curSP = (void *)GetCurrentSP();
- _ASSERTE((m_pGCFrame == (GCFrame*)-1) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
+ _ASSERTE((m_pGCFrame == NULL) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
  }
 #endif
 

src/coreclr/vm/threads.h

@@ -3769,6 +3769,7 @@ struct cdac_data<Thread>
  static constexpr size_t PreemptiveGCDisabled = offsetof(Thread, m_fPreemptiveGCDisabled);
  static constexpr size_t RuntimeThreadLocals = offsetof(Thread, m_pRuntimeThreadLocals);
  static constexpr size_t Frame = offsetof(Thread, m_pFrame);
+ static constexpr size_t GCFrame = offsetof(Thread, m_pGCFrame);
  static constexpr size_t CachedStackBase = offsetof(Thread, m_CacheStackBase);
  static constexpr size_t CachedStackLimit = offsetof(Thread, m_CacheStackLimit);
  static constexpr size_t ExposedObject = offsetof(Thread, m_ExposedObject);

docs/design/datacontracts/StackWalk.md

@@ -149,6 +149,10 @@ This contract depends on the following descriptors:
 | `ExceptionInfo` | `PassNumber` | Exception handling pass (1 or 2) |
 | `ExceptionInfo` | `ClauseForCatchHandlerStartPC` | Start PC offset of the catch handler clause, used for interruptible offset override |
 | `ExceptionInfo` | `ClauseForCatchHandlerEndPC` | End PC offset of the catch handler clause, used for interruptible offset override |
+| `GCFrame` | `Next` | Pointer to the next `GCFrame` toward the top of the chain |
+| `GCFrame` | `ObjRefs` | Pointer to the array of protected object reference slots |
+| `GCFrame` | `NumObjRefs` | Count of protected object reference slots starting at `ObjRefs` |
+| `GCFrame` | `GCFlags` | `GC_CALL_*` promotion flags applied when reporting the protected slots |
 
 Global variables used:
 | Global Name | Type | Purpose |
@@ -168,6 +172,7 @@ Contracts used:
 | `Thread` |
 | `RuntimeTypeSystem` |
 | `GCInfo` |
+| `Exception` |
 
 
 ### Stackwalk Algorithm
@@ -594,7 +599,7 @@ If no Frame in the chain produces a usable context (thread is not running manage
 
 ### GC Stack Reference Scanning
 
-`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers. The native equivalent is `DacStackReferenceWalker` which calls `GcStackCrawlCallBack` at each frame.
+`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers, then reporting the thread's GCFrame (GCPROTECT) chain and in-flight exception (ExInfo) chain. This mirrors the GC's own root enumeration, `ScanStackRoots`.
 
 #### Stack Walk Integration
 
@@ -628,6 +633,15 @@ At each frame yielded by `Filter`, the walk determines whether to scan for GC re
 
 See [GCRefMap Format and Resolution](#gcrefmap-format-and-resolution) for the GCRefMap scanning path. The signature-based scanning fallback (`PromoteCallerStack`) is currently a stub awaiting an `ICallingConvention` contract port; the stress harness handles the resulting gaps via a deferred-frame sentinel (see [tests/StressTests/known-issues.md](../../../src/native/managed/cdac/tests/StressTests/known-issues.md) and tracking issue [dotnet/runtime#127765](https://github.com/dotnet/runtime/issues/127765)).
 
+#### GCFrame and Exception Tracker Roots
+
+After walking the thread's frames, `WalkStackReferences` reports two additional sets of roots that the GC keeps alive but that are not surfaced by per-frame GC info (matching native `gcenv.ee.cpp` `ScanStackRoots`):
+
+- **GCFrame (GCPROTECT) chain**: starting from `Thread.GCFrame` (obtained via the `Thread` contract's `GetThreadData`), each `GCFrame` is walked via its `Next` pointer until TargetPointer.Null is reached. For each node, the `NumObjRefs` slots starting at `ObjRefs` are reported, applying the node's `GCFlags` (`GC_CALL_INTERIOR` / `GC_CALL_PINNED`) as the promotion flags. This mirrors native `GCFrame::GcScanRoots`.
+- **Exception tracker (ExInfo) chain**: starting from the thread's exception tracker, each in-flight exception object (the current one and any superseded/nested ones reached via `PreviousNestedInfo`) is reported through its thrown-object slot.
+
+Both sets carry a non-zero, stack-resident `Source` and `StackPointer` set to the GCFrame / ExInfo node address (the node lives on the stack). A `GCFrame` node belongs to a separate chain from the explicit `Frame` chain, and an ExInfo node is likewise not a capital-F `Frame`, so neither is reported with the `Frame` source type. Both use the `Other` source type, which marks a root reported outside the per-frame walk.
+
 ### GCRefMap Format and Resolution
 
 A **GCRefMap** is a compact per-callsite encoding that describes which stack slots in a `TransitionBlock` contain GC references. GCRefMaps are pre-computed by the ReadyToRun compiler and stored in the PE image's import section auxiliary data.

docs/design/datacontracts/Thread.md

@@ -55,6 +55,7 @@ record struct ThreadData (
  TargetPointer ThreadHandle;
  bool IsInteropDebuggingHijacked;
  TargetPointer DebuggerFilterContext;
+ TargetPointer GCFrame;
 );
 ```
 
@@ -123,6 +124,7 @@ The contract additionally depends on these data descriptors
 | `Thread` | `DebuggerControlledThreadState` | Thread state flags controlled by the debugger |
 | `Thread` | `PreemptiveGCDisabled` | Flag indicating if preemptive GC is disabled |
 | `Thread` | `Frame` | Pointer to current frame |
+| `Thread` | `GCFrame` | Pointer to the head of the thread's GCFrame chain. |
 | `Thread` | `CachedStackBase` | Pointer to the base of the stack |
 | `Thread` | `CachedStackLimit` | Pointer to the limit of the stack |
 | `Thread` | `ExposedObject` | Handle to the managed `Thread` object exposed to the debugger |
@@ -237,6 +239,7 @@ ThreadData GetThreadData(TargetPointer address)
  LastThrownObjectHandle : lastThrownObjectHandle,
  FirstNestedException : firstNestedException,
  NextThread: target.ReadPointer(address + /* Thread::LinkNext offset */) - threadLinkOffset;
+ GCFrame: target.ReadPointer(address + /* Thread::GCFrame offset */),
  );
 }
 

src/coreclr/inc/sospriv.idl

@@ -111,6 +111,7 @@ typedef enum SOSStackSourceType
 {
  SOS_StackSourceIP, // Instruction pointer in managed code
  SOS_StackSourceFrame, // clr!Frame
+ SOS_StackSourceOther, // Roots which do not come from managed code or Frames
 } SOSStackSourceType;
 
 typedef enum SOSRefFlags

src/coreclr/pal/prebuilt/inc/sospriv.h

@@ -462,7 +462,8 @@ typedef
 enum SOSStackSourceType
  {
  SOS_StackSourceIP = 0,
- SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 )
+ SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 ),
+ SOS_StackSourceOther = ( SOS_StackSourceFrame + 1 )
  } SOSStackSourceType;
 
 typedef

src/coreclr/vm/cdacstress.cpp

@@ -76,7 +76,7 @@ struct StackRef
  CLRDATA_ADDRESS Object; // The object pointer value
  unsigned int Flags; // SOSRefFlags (interior, pinned)
  CLRDATA_ADDRESS Source; // IP or Frame that owns this ref
- int SourceType; // SOS_StackSourceIPor SOS_StackSourceFrame
+ int SourceType; // SOS_StackSourceIP, SOS_StackSourceFrame, or SOS_StackSourceOther
  int Register; // Processor-encoding reg number, -1 for stack slots
  // (cDAC populates from GcInfo; runtime populates
  // by inverting GetRegisterSlot on supported arches)
@@ -721,7 +721,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  collectCtx.refs = outRefs;
  collectCtx.overflow = false;
  collectCtx.currentFrameSource = 0;
- collectCtx.currentFrameSourceType = 0;
+ collectCtx.currentFrameSourceType = SOS_StackSourceIP;
  collectCtx.currentRegDisplay = nullptr;
 
  GCCONTEXT gcctx = {};
@@ -780,7 +780,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // safepoint (matches DAC SOS_StackSourceIP convention).
  collectCtx->currentFrameSource =
  (CLRDATA_ADDRESS)PCODEToPINSTR(GetControlPC(pCF->GetRegisterSet()));
- collectCtx->currentFrameSourceType = 0; // SOS_StackSourceIP
+ collectCtx->currentFrameSourceType = SOS_StackSourceIP;
  collectCtx->currentRegDisplay = pCF->GetRegisterSet();
 
  ICodeManager* pCM = pCF->GetCodeManager();
@@ -801,7 +801,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // emit register-resident refs, so leave currentRegDisplay null.
  Frame* pFrame = pCF->GetFrame();
  collectCtx->currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pFrame);
- collectCtx->currentFrameSourceType = 1; // SOS_StackSourceFrame
+ collectCtx->currentFrameSourceType = SOS_StackSourceFrame;
 
  pFrame->GcScanRoots(gcctx->f, gcctx->sc);
  }
@@ -812,10 +812,36 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
 
  pThread->StackWalkFrames(dacLikeCallback, &diagCtx, flagsStackWalk);
 
- // NOTE: ScanStackRoots also scans the separate GCFrame linked list
- // (Thread::GetGCFrame), but the DAC's GetStackReferences / DacStackReferenceWalker
- // does NOT include those. We intentionally omit GCFrame scanning here so our
- // runtime-side collection matches what the cDAC is expected to produce.
+ // ScanStackRoots also scans two root sets that are not part of the frame walk: the
+ // GCFrame (GCPROTECT) chain and the in-flight ExInfo chain. GetStackReferences reports
+ // both, so mirror them here to keep the runtime-side collection in parity. See
+ // ScanStackRoots in gcenv.ee.cpp.
+ GCFrame* pGCFrame = pThread->GetGCFrame();
+ while (pGCFrame != nullptr)
+ {
+ // A GCFrame node is a separate chain from the explicit Frame chain, so it is not a
+ // capital-F Frame. Report it with the Other source type and the GCFrame node address as
+ // the Source, matching cDAC (GcScanContext stamps Source = GCFrame node, SourceType = Other).
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pGCFrame);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ pGCFrame->GcScanRoots(gcctx.f, gcctx.sc);
+ pGCFrame = pGCFrame->PtrNextFrame();
+ }
+
+ PTR_ExInfo pExInfo = pThread->GetExceptionState()->GetCurrentExceptionTracker();
+ while (pExInfo != NULL)
+ {
+ // The ExInfo is not a Frame either; GetStackReferences surfaces the in-flight exception
+ // object with the Other source type and the ExInfo node address as the Source, the same
+ // way it reports a GCFrame root. Mirror that here so the runtime-side collection matches cDAC.
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pExInfo);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ PTR_PTR_Object pRef = dac_cast<PTR_PTR_Object>(&pExInfo->m_exception);
+ gcctx.f(pRef, gcctx.sc, 0);
+ pExInfo = pExInfo->GetPreviousExceptionTracker();
+ }
 
  return collectCtx.overflow ? S_FALSE : S_OK;
 }
@@ -867,7 +893,7 @@ static void ReportMismatch(const char* message, Thread* pThread, PCONTEXT regs)
 struct FrameRefGroup
 {
  CLRDATA_ADDRESS Source;
- int SourceType; // 0 = IP, 1 = Frame
+ int SourceType; // 0 = IP, 1 = Frame, 2 = Other
  int StartIdx; // Index into the original ref array
  int Count; // Number of refs in this group
 };
@@ -1624,7 +1650,15 @@ static void ResolveMethodName(CLRDATA_ADDRESS source, int sourceType, char* buf,
  if (bufLen <= 0)
  return;
 
- if (sourceType != 0) // SOS_StackSourceFrame
+ if (sourceType == SOS_StackSourceOther)
+ {
+ // A root reported outside the frame walk (GCFrame/GCPROTECT or ExInfo chain). Source is a
+ // node address, not a capital-F Frame, so do not dereference it as a Frame*.
+ snprintf(buf, bufLen, "<other 0x%llx>", (unsigned long long)source);
+ return;
+ }
+
+ if (sourceType == SOS_StackSourceFrame)
  {
  Frame* pFrame = reinterpret_cast<Frame*>(source);
  LPCSTR typeName = Frame::GetFrameTypeName(pFrame->GetFrameIdentifier());

src/coreclr/vm/datadescriptor/datadescriptor.inc

@@ -41,6 +41,7 @@ CDAC_TYPE_FIELD(Thread, T_UINT32, State, cdac_data<Thread>::State)
 CDAC_TYPE_FIELD(Thread, T_UINT32, PreemptiveGCDisabled, cdac_data<Thread>::PreemptiveGCDisabled)
 CDAC_TYPE_FIELD(Thread, T_POINTER, RuntimeThreadLocals, cdac_data<Thread>::RuntimeThreadLocals)
 CDAC_TYPE_FIELD(Thread, T_POINTER, Frame, cdac_data<Thread>::Frame)
+CDAC_TYPE_FIELD(Thread, T_POINTER, GCFrame, cdac_data<Thread>::GCFrame)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackBase, cdac_data<Thread>::CachedStackBase)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackLimit, cdac_data<Thread>::CachedStackLimit)
 CDAC_TYPE_FIELD(Thread, T_POINTER, ExceptionTracker, cdac_data<Thread>::ExceptionTracker)
@@ -71,6 +72,14 @@ CDAC_TYPE_FIELD(ThreadStore, T_INT32, PendingCount, cdac_data<ThreadStore>::Pend
 CDAC_TYPE_FIELD(ThreadStore, T_INT32, DeadCount, cdac_data<ThreadStore>::DeadCount)
 CDAC_TYPE_END(ThreadStore)
 
+CDAC_TYPE_BEGIN(GCFrame)
+CDAC_TYPE_INDETERMINATE(GCFrame)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, Next, cdac_data<GCFrame>::Next)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, ObjRefs, cdac_data<GCFrame>::ObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, NumObjRefs, cdac_data<GCFrame>::NumObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, GCFlags, cdac_data<GCFrame>::GCFlags)
+CDAC_TYPE_END(GCFrame)
+
 CDAC_TYPE_BEGIN(RuntimeThreadLocals)
 CDAC_TYPE_INDETERMINATE(RuntimeThreadLocals)
 CDAC_TYPE_FIELD(RuntimeThreadLocals, TYPE(EEAllocContext), AllocContext, offsetof(RuntimeThreadLocals, alloc_context))

src/coreclr/vm/exceptionhandling.cpp

@@ -512,7 +512,7 @@ static void PopExplicitFrames(Thread *pThread, void *targetSp, void *targetCalle
  if (popGCFrames)
  {
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while ((pGCFrame != GCFRAME_TOP) && pGCFrame->GetOSStackLocation() < targetSp)
+ while ((pGCFrame != nullptr) && pGCFrame->GetOSStackLocation() < targetSp)
  {
  pGCFrame->Pop();
  pGCFrame = pThread->GetGCFrame();

src/coreclr/vm/frames.cpp

@@ -1185,28 +1185,29 @@ GCFrame::~GCFrame()
  NOTHROW;
  GC_NOTRIGGER;
  MODE_ANY;
- PRECONDITION(m_pCurThread != NULL);
  }
  CONTRACTL_END;
 
- // m_pNext is NULL when the frame was already popped from the stack.
- if (m_Next != NULL)
+ // Normally the destructor performs the pop for a GCPROTECT_BEGIN/END scope, so the frame is
+ // still linked when we get here. If it was already popped explicitly - by PopExplicitFrames
+ // during EH unwind, or by the interpreter's GCReporting::Unregister - then m_pCurThread is
+ // NULL and there is nothing left to do.
+ if (m_pCurThread != NULL)
  {
- // This is a GCFrame that was not popped. This is a problem.
- // We should have popped it before we destruct
  // Do a manual switch to the GC cooperative mode instead of using the GCX_COOP_THREAD_EXISTS
  // macro so that this function isn't slowed down by having to deal with FS:0 chain on x86 Windows.
- BOOL wasCoop = m_pCurThread->PreemptiveGCDisabled();
+ Thread *pThread = m_pCurThread;
+ BOOL wasCoop = pThread->PreemptiveGCDisabled();
  if (!wasCoop)
  {
-m_pCurThread->DisablePreemptiveGC();
+pThread->DisablePreemptiveGC();
  }
 
  Pop();
 
  if (!wasCoop)
  {
-m_pCurThread->EnablePreemptiveGC();
+pThread->EnablePreemptiveGC();
  }
  }
 }
@@ -1233,7 +1234,7 @@ void GCFrame::Push(Thread* pThread)
  // in which the compiler will lay them out in the stack frame.
  // So minipal_getpagesize() is a guess of the maximum stack frame size of any method
  // with multiple GCFrames in coreclr.dll
- _ASSERTE(((m_Next == GCFRAME_TOP) ||
+ _ASSERTE(((m_Next == NULL) ||
  (PBYTE(m_Next->GetOSStackLocation()) + (2 * minipal_getpagesize())) > PBYTE(this->GetOSStackLocation())) &&
  "Pushing a GCFrame out of order ?");
 
@@ -1258,13 +1259,15 @@ void GCFrame::Pop()
  _ASSERTE(m_pCurThread->GetGCFrame() == this && "Popping a GCFrame out of order ?");
 
  m_pCurThread->SetGCFrame(m_Next);
- m_Next = NULL;
 
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
  Thread::ObjectRefNew(&m_pObjRefs[i]); // Unprotect them
 #endif
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 void GCFrame::Remove()
@@ -1280,7 +1283,7 @@ void GCFrame::Remove()
 
  GCFrame *pPrevFrame = NULL;
  GCFrame *pFrame = m_pCurThread->GetGCFrame();
- while (pFrame != GCFRAME_TOP)
+ while (pFrame != NULL)
  {
  if (pFrame == this)
  {
@@ -1293,8 +1296,6 @@ void GCFrame::Remove()
  m_pCurThread->SetGCFrame(m_Next);
  }
 
- m_Next = NULL;
-
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
@@ -1308,6 +1309,9 @@ void GCFrame::Remove()
  }
 
  _ASSERTE_MSG(pFrame != NULL, "GCFrame not found in the current thread's stack");
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 #endif // !DACCESS_COMPILE
@@ -1393,7 +1397,7 @@ BOOL IsProtectedByGCFrame(OBJECTREF *ppObjectRef)
  GetThread()->StackWalkFrames(IsProtectedByGCFrameStackWalkFramesCallback, &d);
 
  GCFrame* pGCFrame = GetThread()->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  if (pGCFrame->Protects(ppObjectRef)) {
  d.count++;

src/coreclr/vm/frames.h

@@ -184,7 +184,6 @@ class DacDbiInterfaceImpl;
 // whenever we compare it to a PTR_Frame value (the usual use of the value).
 #define FRAME_TOP_VALUE ~0 // we want to say -1 here, but gcc has trouble with the signed value
 #define FRAME_TOP (PTR_Frame(FRAME_TOP_VALUE))
-#define GCFRAME_TOP (PTR_GCFrame(FRAME_TOP_VALUE))
 
 
 enum class FrameIdentifier : TADDR
@@ -1808,6 +1807,17 @@ class GCFrame
 #ifdef FEATURE_INTERPRETER
  PTR_VOID m_osStackLocation;
 #endif
+
+ friend struct ::cdac_data<GCFrame>;
+};
+
+template<>
+struct cdac_data<GCFrame>
+{
+ static constexpr size_t Next = offsetof(GCFrame, m_Next);
+ static constexpr size_t ObjRefs = offsetof(GCFrame, m_pObjRefs);
+ static constexpr size_t NumObjRefs = offsetof(GCFrame, m_numObjRefs);
+ static constexpr size_t GCFlags = offsetof(GCFrame, m_gcFlags);
 };
 
 //-----------------------------------------------------------------------------

src/coreclr/vm/gcenv.ee.cpp

@@ -200,7 +200,7 @@ static void ScanStackRoots(Thread * pThread, promote_func* fn, ScanContext* sc)
  }
 
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  pGCFrame->GcScanRoots(fn, sc);
  pGCFrame = pGCFrame->PtrNextFrame();

src/coreclr/vm/threads.cpp

@@ -1185,7 +1185,7 @@ Thread::Thread()
  CONTRACTL_END;
 
  m_pFrame = FRAME_TOP;
- m_pGCFrame = GCFRAME_TOP;
+ m_pGCFrame = NULL;
 
  m_fPreemptiveGCDisabled = 0;
 
@@ -6752,7 +6752,7 @@ PTR_GCFrame Thread::GetGCFrame()
  {
  void* curSP;
  curSP = (void *)GetCurrentSP();
- _ASSERTE((m_pGCFrame == (GCFrame*)-1) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
+ _ASSERTE((m_pGCFrame == NULL) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
  }
 #endif
 

src/coreclr/vm/threads.h

@@ -3769,6 +3769,7 @@ struct cdac_data<Thread>
  static constexpr size_t PreemptiveGCDisabled = offsetof(Thread, m_fPreemptiveGCDisabled);
  static constexpr size_t RuntimeThreadLocals = offsetof(Thread, m_pRuntimeThreadLocals);
  static constexpr size_t Frame = offsetof(Thread, m_pFrame);
+ static constexpr size_t GCFrame = offsetof(Thread, m_pGCFrame);
  static constexpr size_t CachedStackBase = offsetof(Thread, m_CacheStackBase);
  static constexpr size_t CachedStackLimit = offsetof(Thread, m_CacheStackLimit);
  static constexpr size_t ExposedObject = offsetof(Thread, m_ExposedObject);

docs/design/datacontracts/StackWalk.md

@@ -149,6 +149,10 @@ This contract depends on the following descriptors:
 | `ExceptionInfo` | `PassNumber` | Exception handling pass (1 or 2) |
 | `ExceptionInfo` | `ClauseForCatchHandlerStartPC` | Start PC offset of the catch handler clause, used for interruptible offset override |
 | `ExceptionInfo` | `ClauseForCatchHandlerEndPC` | End PC offset of the catch handler clause, used for interruptible offset override |
+| `GCFrame` | `Next` | Pointer to the next `GCFrame` toward the top of the chain |
+| `GCFrame` | `ObjRefs` | Pointer to the array of protected object reference slots |
+| `GCFrame` | `NumObjRefs` | Count of protected object reference slots starting at `ObjRefs` |
+| `GCFrame` | `GCFlags` | `GC_CALL_*` promotion flags applied when reporting the protected slots |
 
 Global variables used:
 | Global Name | Type | Purpose |
@@ -168,6 +172,7 @@ Contracts used:
 | `Thread` |
 | `RuntimeTypeSystem` |
 | `GCInfo` |
+| `Exception` |
 
 
 ### Stackwalk Algorithm
@@ -594,7 +599,7 @@ If no Frame in the chain produces a usable context (thread is not running manage
 
 ### GC Stack Reference Scanning
 
-`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers. The native equivalent is `DacStackReferenceWalker` which calls `GcStackCrawlCallBack` at each frame.
+`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers, then reporting the thread's GCFrame (GCPROTECT) chain and in-flight exception (ExInfo) chain. This mirrors the GC's own root enumeration, `ScanStackRoots`.
 
 #### Stack Walk Integration
 
@@ -628,6 +633,15 @@ At each frame yielded by `Filter`, the walk determines whether to scan for GC re
 
 See [GCRefMap Format and Resolution](#gcrefmap-format-and-resolution) for the GCRefMap scanning path. The signature-based scanning fallback (`PromoteCallerStack`) is currently a stub awaiting an `ICallingConvention` contract port; the stress harness handles the resulting gaps via a deferred-frame sentinel (see [tests/StressTests/known-issues.md](../../../src/native/managed/cdac/tests/StressTests/known-issues.md) and tracking issue [dotnet/runtime#127765](https://github.com/dotnet/runtime/issues/127765)).
 
+#### GCFrame and Exception Tracker Roots
+
+After walking the thread's frames, `WalkStackReferences` reports two additional sets of roots that the GC keeps alive but that are not surfaced by per-frame GC info (matching native `gcenv.ee.cpp` `ScanStackRoots`):
+
+- **GCFrame (GCPROTECT) chain**: starting from `Thread.GCFrame` (obtained via the `Thread` contract's `GetThreadData`), each `GCFrame` is walked via its `Next` pointer until TargetPointer.Null is reached. For each node, the `NumObjRefs` slots starting at `ObjRefs` are reported, applying the node's `GCFlags` (`GC_CALL_INTERIOR` / `GC_CALL_PINNED`) as the promotion flags. This mirrors native `GCFrame::GcScanRoots`.
+- **Exception tracker (ExInfo) chain**: starting from the thread's exception tracker, each in-flight exception object (the current one and any superseded/nested ones reached via `PreviousNestedInfo`) is reported through its thrown-object slot.
+
+Both sets carry a non-zero, stack-resident `Source` and `StackPointer` set to the GCFrame / ExInfo node address (the node lives on the stack). A `GCFrame` node belongs to a separate chain from the explicit `Frame` chain, and an ExInfo node is likewise not a capital-F `Frame`, so neither is reported with the `Frame` source type. Both use the `Other` source type, which marks a root reported outside the per-frame walk.
+
 ### GCRefMap Format and Resolution
 
 A **GCRefMap** is a compact per-callsite encoding that describes which stack slots in a `TransitionBlock` contain GC references. GCRefMaps are pre-computed by the ReadyToRun compiler and stored in the PE image's import section auxiliary data.

docs/design/datacontracts/Thread.md

@@ -55,6 +55,7 @@ record struct ThreadData (
  TargetPointer ThreadHandle;
  bool IsInteropDebuggingHijacked;
  TargetPointer DebuggerFilterContext;
+ TargetPointer GCFrame;
 );
 ```
 
@@ -123,6 +124,7 @@ The contract additionally depends on these data descriptors
 | `Thread` | `DebuggerControlledThreadState` | Thread state flags controlled by the debugger |
 | `Thread` | `PreemptiveGCDisabled` | Flag indicating if preemptive GC is disabled |
 | `Thread` | `Frame` | Pointer to current frame |
+| `Thread` | `GCFrame` | Pointer to the head of the thread's GCFrame chain. |
 | `Thread` | `CachedStackBase` | Pointer to the base of the stack |
 | `Thread` | `CachedStackLimit` | Pointer to the limit of the stack |
 | `Thread` | `ExposedObject` | Handle to the managed `Thread` object exposed to the debugger |
@@ -237,6 +239,7 @@ ThreadData GetThreadData(TargetPointer address)
  LastThrownObjectHandle : lastThrownObjectHandle,
  FirstNestedException : firstNestedException,
  NextThread: target.ReadPointer(address + /* Thread::LinkNext offset */) - threadLinkOffset;
+ GCFrame: target.ReadPointer(address + /* Thread::GCFrame offset */),
  );
 }
 

src/coreclr/inc/sospriv.idl

@@ -111,6 +111,7 @@ typedef enum SOSStackSourceType
 {
  SOS_StackSourceIP, // Instruction pointer in managed code
  SOS_StackSourceFrame, // clr!Frame
+ SOS_StackSourceOther, // Roots which do not come from managed code or Frames
 } SOSStackSourceType;
 
 typedef enum SOSRefFlags

src/coreclr/pal/prebuilt/inc/sospriv.h

@@ -462,7 +462,8 @@ typedef
 enum SOSStackSourceType
  {
  SOS_StackSourceIP = 0,
- SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 )
+ SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 ),
+ SOS_StackSourceOther = ( SOS_StackSourceFrame + 1 )
  } SOSStackSourceType;
 
 typedef

src/coreclr/vm/cdacstress.cpp

@@ -76,7 +76,7 @@ struct StackRef
  CLRDATA_ADDRESS Object; // The object pointer value
  unsigned int Flags; // SOSRefFlags (interior, pinned)
  CLRDATA_ADDRESS Source; // IP or Frame that owns this ref
- int SourceType; // SOS_StackSourceIPor SOS_StackSourceFrame
+ int SourceType; // SOS_StackSourceIP, SOS_StackSourceFrame, or SOS_StackSourceOther
  int Register; // Processor-encoding reg number, -1 for stack slots
  // (cDAC populates from GcInfo; runtime populates
  // by inverting GetRegisterSlot on supported arches)
@@ -721,7 +721,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  collectCtx.refs = outRefs;
  collectCtx.overflow = false;
  collectCtx.currentFrameSource = 0;
- collectCtx.currentFrameSourceType = 0;
+ collectCtx.currentFrameSourceType = SOS_StackSourceIP;
  collectCtx.currentRegDisplay = nullptr;
 
  GCCONTEXT gcctx = {};
@@ -780,7 +780,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // safepoint (matches DAC SOS_StackSourceIP convention).
  collectCtx->currentFrameSource =
  (CLRDATA_ADDRESS)PCODEToPINSTR(GetControlPC(pCF->GetRegisterSet()));
- collectCtx->currentFrameSourceType = 0; // SOS_StackSourceIP
+ collectCtx->currentFrameSourceType = SOS_StackSourceIP;
  collectCtx->currentRegDisplay = pCF->GetRegisterSet();
 
  ICodeManager* pCM = pCF->GetCodeManager();
@@ -801,7 +801,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // emit register-resident refs, so leave currentRegDisplay null.
  Frame* pFrame = pCF->GetFrame();
  collectCtx->currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pFrame);
- collectCtx->currentFrameSourceType = 1; // SOS_StackSourceFrame
+ collectCtx->currentFrameSourceType = SOS_StackSourceFrame;
 
  pFrame->GcScanRoots(gcctx->f, gcctx->sc);
  }
@@ -812,10 +812,36 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
 
  pThread->StackWalkFrames(dacLikeCallback, &diagCtx, flagsStackWalk);
 
- // NOTE: ScanStackRoots also scans the separate GCFrame linked list
- // (Thread::GetGCFrame), but the DAC's GetStackReferences / DacStackReferenceWalker
- // does NOT include those. We intentionally omit GCFrame scanning here so our
- // runtime-side collection matches what the cDAC is expected to produce.
+ // ScanStackRoots also scans two root sets that are not part of the frame walk: the
+ // GCFrame (GCPROTECT) chain and the in-flight ExInfo chain. GetStackReferences reports
+ // both, so mirror them here to keep the runtime-side collection in parity. See
+ // ScanStackRoots in gcenv.ee.cpp.
+ GCFrame* pGCFrame = pThread->GetGCFrame();
+ while (pGCFrame != nullptr)
+ {
+ // A GCFrame node is a separate chain from the explicit Frame chain, so it is not a
+ // capital-F Frame. Report it with the Other source type and the GCFrame node address as
+ // the Source, matching cDAC (GcScanContext stamps Source = GCFrame node, SourceType = Other).
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pGCFrame);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ pGCFrame->GcScanRoots(gcctx.f, gcctx.sc);
+ pGCFrame = pGCFrame->PtrNextFrame();
+ }
+
+ PTR_ExInfo pExInfo = pThread->GetExceptionState()->GetCurrentExceptionTracker();
+ while (pExInfo != NULL)
+ {
+ // The ExInfo is not a Frame either; GetStackReferences surfaces the in-flight exception
+ // object with the Other source type and the ExInfo node address as the Source, the same
+ // way it reports a GCFrame root. Mirror that here so the runtime-side collection matches cDAC.
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pExInfo);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ PTR_PTR_Object pRef = dac_cast<PTR_PTR_Object>(&pExInfo->m_exception);
+ gcctx.f(pRef, gcctx.sc, 0);
+ pExInfo = pExInfo->GetPreviousExceptionTracker();
+ }
 
  return collectCtx.overflow ? S_FALSE : S_OK;
 }
@@ -867,7 +893,7 @@ static void ReportMismatch(const char* message, Thread* pThread, PCONTEXT regs)
 struct FrameRefGroup
 {
  CLRDATA_ADDRESS Source;
- int SourceType; // 0 = IP, 1 = Frame
+ int SourceType; // 0 = IP, 1 = Frame, 2 = Other
  int StartIdx; // Index into the original ref array
  int Count; // Number of refs in this group
 };
@@ -1624,7 +1650,15 @@ static void ResolveMethodName(CLRDATA_ADDRESS source, int sourceType, char* buf,
  if (bufLen <= 0)
  return;
 
- if (sourceType != 0) // SOS_StackSourceFrame
+ if (sourceType == SOS_StackSourceOther)
+ {
+ // A root reported outside the frame walk (GCFrame/GCPROTECT or ExInfo chain). Source is a
+ // node address, not a capital-F Frame, so do not dereference it as a Frame*.
+ snprintf(buf, bufLen, "<other 0x%llx>", (unsigned long long)source);
+ return;
+ }
+
+ if (sourceType == SOS_StackSourceFrame)
  {
  Frame* pFrame = reinterpret_cast<Frame*>(source);
  LPCSTR typeName = Frame::GetFrameTypeName(pFrame->GetFrameIdentifier());

src/coreclr/vm/datadescriptor/datadescriptor.inc

@@ -41,6 +41,7 @@ CDAC_TYPE_FIELD(Thread, T_UINT32, State, cdac_data<Thread>::State)
 CDAC_TYPE_FIELD(Thread, T_UINT32, PreemptiveGCDisabled, cdac_data<Thread>::PreemptiveGCDisabled)
 CDAC_TYPE_FIELD(Thread, T_POINTER, RuntimeThreadLocals, cdac_data<Thread>::RuntimeThreadLocals)
 CDAC_TYPE_FIELD(Thread, T_POINTER, Frame, cdac_data<Thread>::Frame)
+CDAC_TYPE_FIELD(Thread, T_POINTER, GCFrame, cdac_data<Thread>::GCFrame)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackBase, cdac_data<Thread>::CachedStackBase)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackLimit, cdac_data<Thread>::CachedStackLimit)
 CDAC_TYPE_FIELD(Thread, T_POINTER, ExceptionTracker, cdac_data<Thread>::ExceptionTracker)
@@ -71,6 +72,14 @@ CDAC_TYPE_FIELD(ThreadStore, T_INT32, PendingCount, cdac_data<ThreadStore>::Pend
 CDAC_TYPE_FIELD(ThreadStore, T_INT32, DeadCount, cdac_data<ThreadStore>::DeadCount)
 CDAC_TYPE_END(ThreadStore)
 
+CDAC_TYPE_BEGIN(GCFrame)
+CDAC_TYPE_INDETERMINATE(GCFrame)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, Next, cdac_data<GCFrame>::Next)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, ObjRefs, cdac_data<GCFrame>::ObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, NumObjRefs, cdac_data<GCFrame>::NumObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, GCFlags, cdac_data<GCFrame>::GCFlags)
+CDAC_TYPE_END(GCFrame)
+
 CDAC_TYPE_BEGIN(RuntimeThreadLocals)
 CDAC_TYPE_INDETERMINATE(RuntimeThreadLocals)
 CDAC_TYPE_FIELD(RuntimeThreadLocals, TYPE(EEAllocContext), AllocContext, offsetof(RuntimeThreadLocals, alloc_context))

src/coreclr/vm/exceptionhandling.cpp

@@ -512,7 +512,7 @@ static void PopExplicitFrames(Thread *pThread, void *targetSp, void *targetCalle
  if (popGCFrames)
  {
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while ((pGCFrame != GCFRAME_TOP) && pGCFrame->GetOSStackLocation() < targetSp)
+ while ((pGCFrame != nullptr) && pGCFrame->GetOSStackLocation() < targetSp)
  {
  pGCFrame->Pop();
  pGCFrame = pThread->GetGCFrame();

src/coreclr/vm/frames.cpp

@@ -1185,28 +1185,29 @@ GCFrame::~GCFrame()
  NOTHROW;
  GC_NOTRIGGER;
  MODE_ANY;
- PRECONDITION(m_pCurThread != NULL);
  }
  CONTRACTL_END;
 
- // m_pNext is NULL when the frame was already popped from the stack.
- if (m_Next != NULL)
+ // Normally the destructor performs the pop for a GCPROTECT_BEGIN/END scope, so the frame is
+ // still linked when we get here. If it was already popped explicitly - by PopExplicitFrames
+ // during EH unwind, or by the interpreter's GCReporting::Unregister - then m_pCurThread is
+ // NULL and there is nothing left to do.
+ if (m_pCurThread != NULL)
  {
- // This is a GCFrame that was not popped. This is a problem.
- // We should have popped it before we destruct
  // Do a manual switch to the GC cooperative mode instead of using the GCX_COOP_THREAD_EXISTS
  // macro so that this function isn't slowed down by having to deal with FS:0 chain on x86 Windows.
- BOOL wasCoop = m_pCurThread->PreemptiveGCDisabled();
+ Thread *pThread = m_pCurThread;
+ BOOL wasCoop = pThread->PreemptiveGCDisabled();
  if (!wasCoop)
  {
-m_pCurThread->DisablePreemptiveGC();
+pThread->DisablePreemptiveGC();
  }
 
  Pop();
 
  if (!wasCoop)
  {
-m_pCurThread->EnablePreemptiveGC();
+pThread->EnablePreemptiveGC();
  }
  }
 }
@@ -1233,7 +1234,7 @@ void GCFrame::Push(Thread* pThread)
  // in which the compiler will lay them out in the stack frame.
  // So minipal_getpagesize() is a guess of the maximum stack frame size of any method
  // with multiple GCFrames in coreclr.dll
- _ASSERTE(((m_Next == GCFRAME_TOP) ||
+ _ASSERTE(((m_Next == NULL) ||
  (PBYTE(m_Next->GetOSStackLocation()) + (2 * minipal_getpagesize())) > PBYTE(this->GetOSStackLocation())) &&
  "Pushing a GCFrame out of order ?");
 
@@ -1258,13 +1259,15 @@ void GCFrame::Pop()
  _ASSERTE(m_pCurThread->GetGCFrame() == this && "Popping a GCFrame out of order ?");
 
  m_pCurThread->SetGCFrame(m_Next);
- m_Next = NULL;
 
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
  Thread::ObjectRefNew(&m_pObjRefs[i]); // Unprotect them
 #endif
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 void GCFrame::Remove()
@@ -1280,7 +1283,7 @@ void GCFrame::Remove()
 
  GCFrame *pPrevFrame = NULL;
  GCFrame *pFrame = m_pCurThread->GetGCFrame();
- while (pFrame != GCFRAME_TOP)
+ while (pFrame != NULL)
  {
  if (pFrame == this)
  {
@@ -1293,8 +1296,6 @@ void GCFrame::Remove()
  m_pCurThread->SetGCFrame(m_Next);
  }
 
- m_Next = NULL;
-
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
@@ -1308,6 +1309,9 @@ void GCFrame::Remove()
  }
 
  _ASSERTE_MSG(pFrame != NULL, "GCFrame not found in the current thread's stack");
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 #endif // !DACCESS_COMPILE
@@ -1393,7 +1397,7 @@ BOOL IsProtectedByGCFrame(OBJECTREF *ppObjectRef)
  GetThread()->StackWalkFrames(IsProtectedByGCFrameStackWalkFramesCallback, &d);
 
  GCFrame* pGCFrame = GetThread()->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  if (pGCFrame->Protects(ppObjectRef)) {
  d.count++;

src/coreclr/vm/frames.h

@@ -184,7 +184,6 @@ class DacDbiInterfaceImpl;
 // whenever we compare it to a PTR_Frame value (the usual use of the value).
 #define FRAME_TOP_VALUE ~0 // we want to say -1 here, but gcc has trouble with the signed value
 #define FRAME_TOP (PTR_Frame(FRAME_TOP_VALUE))
-#define GCFRAME_TOP (PTR_GCFrame(FRAME_TOP_VALUE))
 
 
 enum class FrameIdentifier : TADDR
@@ -1808,6 +1807,17 @@ class GCFrame
 #ifdef FEATURE_INTERPRETER
  PTR_VOID m_osStackLocation;
 #endif
+
+ friend struct ::cdac_data<GCFrame>;
+};
+
+template<>
+struct cdac_data<GCFrame>
+{
+ static constexpr size_t Next = offsetof(GCFrame, m_Next);
+ static constexpr size_t ObjRefs = offsetof(GCFrame, m_pObjRefs);
+ static constexpr size_t NumObjRefs = offsetof(GCFrame, m_numObjRefs);
+ static constexpr size_t GCFlags = offsetof(GCFrame, m_gcFlags);
 };
 
 //-----------------------------------------------------------------------------

src/coreclr/vm/gcenv.ee.cpp

@@ -200,7 +200,7 @@ static void ScanStackRoots(Thread * pThread, promote_func* fn, ScanContext* sc)
  }
 
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  pGCFrame->GcScanRoots(fn, sc);
  pGCFrame = pGCFrame->PtrNextFrame();

src/coreclr/vm/threads.cpp

@@ -1185,7 +1185,7 @@ Thread::Thread()
  CONTRACTL_END;
 
  m_pFrame = FRAME_TOP;
- m_pGCFrame = GCFRAME_TOP;
+ m_pGCFrame = NULL;
 
  m_fPreemptiveGCDisabled = 0;
 
@@ -6752,7 +6752,7 @@ PTR_GCFrame Thread::GetGCFrame()
  {
  void* curSP;
  curSP = (void *)GetCurrentSP();
- _ASSERTE((m_pGCFrame == (GCFrame*)-1) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
+ _ASSERTE((m_pGCFrame == NULL) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
  }
 #endif
 

src/coreclr/vm/threads.h

@@ -3769,6 +3769,7 @@ struct cdac_data<Thread>
  static constexpr size_t PreemptiveGCDisabled = offsetof(Thread, m_fPreemptiveGCDisabled);
  static constexpr size_t RuntimeThreadLocals = offsetof(Thread, m_pRuntimeThreadLocals);
  static constexpr size_t Frame = offsetof(Thread, m_pFrame);
+ static constexpr size_t GCFrame = offsetof(Thread, m_pGCFrame);
  static constexpr size_t CachedStackBase = offsetof(Thread, m_CacheStackBase);
  static constexpr size_t CachedStackLimit = offsetof(Thread, m_CacheStackLimit);
  static constexpr size_t ExposedObject = offsetof(Thread, m_ExposedObject);

docs/design/datacontracts/StackWalk.md

@@ -149,6 +149,10 @@ This contract depends on the following descriptors:
 | `ExceptionInfo` | `PassNumber` | Exception handling pass (1 or 2) |
 | `ExceptionInfo` | `ClauseForCatchHandlerStartPC` | Start PC offset of the catch handler clause, used for interruptible offset override |
 | `ExceptionInfo` | `ClauseForCatchHandlerEndPC` | End PC offset of the catch handler clause, used for interruptible offset override |
+| `GCFrame` | `Next` | Pointer to the next `GCFrame` toward the top of the chain |
+| `GCFrame` | `ObjRefs` | Pointer to the array of protected object reference slots |
+| `GCFrame` | `NumObjRefs` | Count of protected object reference slots starting at `ObjRefs` |
+| `GCFrame` | `GCFlags` | `GC_CALL_*` promotion flags applied when reporting the protected slots |
 
 Global variables used:
 | Global Name | Type | Purpose |
@@ -168,6 +172,7 @@ Contracts used:
 | `Thread` |
 | `RuntimeTypeSystem` |
 | `GCInfo` |
+| `Exception` |
 
 
 ### Stackwalk Algorithm
@@ -594,7 +599,7 @@ If no Frame in the chain produces a usable context (thread is not running manage
 
 ### GC Stack Reference Scanning
 
-`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers. The native equivalent is `DacStackReferenceWalker` which calls `GcStackCrawlCallBack` at each frame.
+`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers, then reporting the thread's GCFrame (GCPROTECT) chain and in-flight exception (ExInfo) chain. This mirrors the GC's own root enumeration, `ScanStackRoots`.
 
 #### Stack Walk Integration
 
@@ -628,6 +633,15 @@ At each frame yielded by `Filter`, the walk determines whether to scan for GC re
 
 See [GCRefMap Format and Resolution](#gcrefmap-format-and-resolution) for the GCRefMap scanning path. The signature-based scanning fallback (`PromoteCallerStack`) is currently a stub awaiting an `ICallingConvention` contract port; the stress harness handles the resulting gaps via a deferred-frame sentinel (see [tests/StressTests/known-issues.md](../../../src/native/managed/cdac/tests/StressTests/known-issues.md) and tracking issue [dotnet/runtime#127765](https://github.com/dotnet/runtime/issues/127765)).
 
+#### GCFrame and Exception Tracker Roots
+
+After walking the thread's frames, `WalkStackReferences` reports two additional sets of roots that the GC keeps alive but that are not surfaced by per-frame GC info (matching native `gcenv.ee.cpp` `ScanStackRoots`):
+
+- **GCFrame (GCPROTECT) chain**: starting from `Thread.GCFrame` (obtained via the `Thread` contract's `GetThreadData`), each `GCFrame` is walked via its `Next` pointer until TargetPointer.Null is reached. For each node, the `NumObjRefs` slots starting at `ObjRefs` are reported, applying the node's `GCFlags` (`GC_CALL_INTERIOR` / `GC_CALL_PINNED`) as the promotion flags. This mirrors native `GCFrame::GcScanRoots`.
+- **Exception tracker (ExInfo) chain**: starting from the thread's exception tracker, each in-flight exception object (the current one and any superseded/nested ones reached via `PreviousNestedInfo`) is reported through its thrown-object slot.
+
+Both sets carry a non-zero, stack-resident `Source` and `StackPointer` set to the GCFrame / ExInfo node address (the node lives on the stack). A `GCFrame` node belongs to a separate chain from the explicit `Frame` chain, and an ExInfo node is likewise not a capital-F `Frame`, so neither is reported with the `Frame` source type. Both use the `Other` source type, which marks a root reported outside the per-frame walk.
+
 ### GCRefMap Format and Resolution
 
 A **GCRefMap** is a compact per-callsite encoding that describes which stack slots in a `TransitionBlock` contain GC references. GCRefMaps are pre-computed by the ReadyToRun compiler and stored in the PE image's import section auxiliary data.

docs/design/datacontracts/Thread.md

@@ -55,6 +55,7 @@ record struct ThreadData (
  TargetPointer ThreadHandle;
  bool IsInteropDebuggingHijacked;
  TargetPointer DebuggerFilterContext;
+ TargetPointer GCFrame;
 );
 ```
 
@@ -123,6 +124,7 @@ The contract additionally depends on these data descriptors
 | `Thread` | `DebuggerControlledThreadState` | Thread state flags controlled by the debugger |
 | `Thread` | `PreemptiveGCDisabled` | Flag indicating if preemptive GC is disabled |
 | `Thread` | `Frame` | Pointer to current frame |
+| `Thread` | `GCFrame` | Pointer to the head of the thread's GCFrame chain. |
 | `Thread` | `CachedStackBase` | Pointer to the base of the stack |
 | `Thread` | `CachedStackLimit` | Pointer to the limit of the stack |
 | `Thread` | `ExposedObject` | Handle to the managed `Thread` object exposed to the debugger |
@@ -237,6 +239,7 @@ ThreadData GetThreadData(TargetPointer address)
  LastThrownObjectHandle : lastThrownObjectHandle,
  FirstNestedException : firstNestedException,
  NextThread: target.ReadPointer(address + /* Thread::LinkNext offset */) - threadLinkOffset;
+ GCFrame: target.ReadPointer(address + /* Thread::GCFrame offset */),
  );
 }
 

src/coreclr/inc/sospriv.idl

@@ -111,6 +111,7 @@ typedef enum SOSStackSourceType
 {
  SOS_StackSourceIP, // Instruction pointer in managed code
  SOS_StackSourceFrame, // clr!Frame
+ SOS_StackSourceOther, // Roots which do not come from managed code or Frames
 } SOSStackSourceType;
 
 typedef enum SOSRefFlags

src/coreclr/pal/prebuilt/inc/sospriv.h

@@ -462,7 +462,8 @@ typedef
 enum SOSStackSourceType
  {
  SOS_StackSourceIP = 0,
- SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 )
+ SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 ),
+ SOS_StackSourceOther = ( SOS_StackSourceFrame + 1 )
  } SOSStackSourceType;
 
 typedef

src/coreclr/vm/cdacstress.cpp

@@ -76,7 +76,7 @@ struct StackRef
  CLRDATA_ADDRESS Object; // The object pointer value
  unsigned int Flags; // SOSRefFlags (interior, pinned)
  CLRDATA_ADDRESS Source; // IP or Frame that owns this ref
- int SourceType; // SOS_StackSourceIPor SOS_StackSourceFrame
+ int SourceType; // SOS_StackSourceIP, SOS_StackSourceFrame, or SOS_StackSourceOther
  int Register; // Processor-encoding reg number, -1 for stack slots
  // (cDAC populates from GcInfo; runtime populates
  // by inverting GetRegisterSlot on supported arches)
@@ -721,7 +721,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  collectCtx.refs = outRefs;
  collectCtx.overflow = false;
  collectCtx.currentFrameSource = 0;
- collectCtx.currentFrameSourceType = 0;
+ collectCtx.currentFrameSourceType = SOS_StackSourceIP;
  collectCtx.currentRegDisplay = nullptr;
 
  GCCONTEXT gcctx = {};
@@ -780,7 +780,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // safepoint (matches DAC SOS_StackSourceIP convention).
  collectCtx->currentFrameSource =
  (CLRDATA_ADDRESS)PCODEToPINSTR(GetControlPC(pCF->GetRegisterSet()));
- collectCtx->currentFrameSourceType = 0; // SOS_StackSourceIP
+ collectCtx->currentFrameSourceType = SOS_StackSourceIP;
  collectCtx->currentRegDisplay = pCF->GetRegisterSet();
 
  ICodeManager* pCM = pCF->GetCodeManager();
@@ -801,7 +801,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // emit register-resident refs, so leave currentRegDisplay null.
  Frame* pFrame = pCF->GetFrame();
  collectCtx->currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pFrame);
- collectCtx->currentFrameSourceType = 1; // SOS_StackSourceFrame
+ collectCtx->currentFrameSourceType = SOS_StackSourceFrame;
 
  pFrame->GcScanRoots(gcctx->f, gcctx->sc);
  }
@@ -812,10 +812,36 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
 
  pThread->StackWalkFrames(dacLikeCallback, &diagCtx, flagsStackWalk);
 
- // NOTE: ScanStackRoots also scans the separate GCFrame linked list
- // (Thread::GetGCFrame), but the DAC's GetStackReferences / DacStackReferenceWalker
- // does NOT include those. We intentionally omit GCFrame scanning here so our
- // runtime-side collection matches what the cDAC is expected to produce.
+ // ScanStackRoots also scans two root sets that are not part of the frame walk: the
+ // GCFrame (GCPROTECT) chain and the in-flight ExInfo chain. GetStackReferences reports
+ // both, so mirror them here to keep the runtime-side collection in parity. See
+ // ScanStackRoots in gcenv.ee.cpp.
+ GCFrame* pGCFrame = pThread->GetGCFrame();
+ while (pGCFrame != nullptr)
+ {
+ // A GCFrame node is a separate chain from the explicit Frame chain, so it is not a
+ // capital-F Frame. Report it with the Other source type and the GCFrame node address as
+ // the Source, matching cDAC (GcScanContext stamps Source = GCFrame node, SourceType = Other).
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pGCFrame);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ pGCFrame->GcScanRoots(gcctx.f, gcctx.sc);
+ pGCFrame = pGCFrame->PtrNextFrame();
+ }
+
+ PTR_ExInfo pExInfo = pThread->GetExceptionState()->GetCurrentExceptionTracker();
+ while (pExInfo != NULL)
+ {
+ // The ExInfo is not a Frame either; GetStackReferences surfaces the in-flight exception
+ // object with the Other source type and the ExInfo node address as the Source, the same
+ // way it reports a GCFrame root. Mirror that here so the runtime-side collection matches cDAC.
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pExInfo);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ PTR_PTR_Object pRef = dac_cast<PTR_PTR_Object>(&pExInfo->m_exception);
+ gcctx.f(pRef, gcctx.sc, 0);
+ pExInfo = pExInfo->GetPreviousExceptionTracker();
+ }
 
  return collectCtx.overflow ? S_FALSE : S_OK;
 }
@@ -867,7 +893,7 @@ static void ReportMismatch(const char* message, Thread* pThread, PCONTEXT regs)
 struct FrameRefGroup
 {
  CLRDATA_ADDRESS Source;
- int SourceType; // 0 = IP, 1 = Frame
+ int SourceType; // 0 = IP, 1 = Frame, 2 = Other
  int StartIdx; // Index into the original ref array
  int Count; // Number of refs in this group
 };
@@ -1624,7 +1650,15 @@ static void ResolveMethodName(CLRDATA_ADDRESS source, int sourceType, char* buf,
  if (bufLen <= 0)
  return;
 
- if (sourceType != 0) // SOS_StackSourceFrame
+ if (sourceType == SOS_StackSourceOther)
+ {
+ // A root reported outside the frame walk (GCFrame/GCPROTECT or ExInfo chain). Source is a
+ // node address, not a capital-F Frame, so do not dereference it as a Frame*.
+ snprintf(buf, bufLen, "<other 0x%llx>", (unsigned long long)source);
+ return;
+ }
+
+ if (sourceType == SOS_StackSourceFrame)
  {
  Frame* pFrame = reinterpret_cast<Frame*>(source);
  LPCSTR typeName = Frame::GetFrameTypeName(pFrame->GetFrameIdentifier());

src/coreclr/vm/datadescriptor/datadescriptor.inc

@@ -41,6 +41,7 @@ CDAC_TYPE_FIELD(Thread, T_UINT32, State, cdac_data<Thread>::State)
 CDAC_TYPE_FIELD(Thread, T_UINT32, PreemptiveGCDisabled, cdac_data<Thread>::PreemptiveGCDisabled)
 CDAC_TYPE_FIELD(Thread, T_POINTER, RuntimeThreadLocals, cdac_data<Thread>::RuntimeThreadLocals)
 CDAC_TYPE_FIELD(Thread, T_POINTER, Frame, cdac_data<Thread>::Frame)
+CDAC_TYPE_FIELD(Thread, T_POINTER, GCFrame, cdac_data<Thread>::GCFrame)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackBase, cdac_data<Thread>::CachedStackBase)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackLimit, cdac_data<Thread>::CachedStackLimit)
 CDAC_TYPE_FIELD(Thread, T_POINTER, ExceptionTracker, cdac_data<Thread>::ExceptionTracker)
@@ -71,6 +72,14 @@ CDAC_TYPE_FIELD(ThreadStore, T_INT32, PendingCount, cdac_data<ThreadStore>::Pend
 CDAC_TYPE_FIELD(ThreadStore, T_INT32, DeadCount, cdac_data<ThreadStore>::DeadCount)
 CDAC_TYPE_END(ThreadStore)
 
+CDAC_TYPE_BEGIN(GCFrame)
+CDAC_TYPE_INDETERMINATE(GCFrame)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, Next, cdac_data<GCFrame>::Next)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, ObjRefs, cdac_data<GCFrame>::ObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, NumObjRefs, cdac_data<GCFrame>::NumObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, GCFlags, cdac_data<GCFrame>::GCFlags)
+CDAC_TYPE_END(GCFrame)
+
 CDAC_TYPE_BEGIN(RuntimeThreadLocals)
 CDAC_TYPE_INDETERMINATE(RuntimeThreadLocals)
 CDAC_TYPE_FIELD(RuntimeThreadLocals, TYPE(EEAllocContext), AllocContext, offsetof(RuntimeThreadLocals, alloc_context))

src/coreclr/vm/exceptionhandling.cpp

@@ -512,7 +512,7 @@ static void PopExplicitFrames(Thread *pThread, void *targetSp, void *targetCalle
  if (popGCFrames)
  {
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while ((pGCFrame != GCFRAME_TOP) && pGCFrame->GetOSStackLocation() < targetSp)
+ while ((pGCFrame != nullptr) && pGCFrame->GetOSStackLocation() < targetSp)
  {
  pGCFrame->Pop();
  pGCFrame = pThread->GetGCFrame();

src/coreclr/vm/frames.cpp

@@ -1185,28 +1185,29 @@ GCFrame::~GCFrame()
  NOTHROW;
  GC_NOTRIGGER;
  MODE_ANY;
- PRECONDITION(m_pCurThread != NULL);
  }
  CONTRACTL_END;
 
- // m_pNext is NULL when the frame was already popped from the stack.
- if (m_Next != NULL)
+ // Normally the destructor performs the pop for a GCPROTECT_BEGIN/END scope, so the frame is
+ // still linked when we get here. If it was already popped explicitly - by PopExplicitFrames
+ // during EH unwind, or by the interpreter's GCReporting::Unregister - then m_pCurThread is
+ // NULL and there is nothing left to do.
+ if (m_pCurThread != NULL)
  {
- // This is a GCFrame that was not popped. This is a problem.
- // We should have popped it before we destruct
  // Do a manual switch to the GC cooperative mode instead of using the GCX_COOP_THREAD_EXISTS
  // macro so that this function isn't slowed down by having to deal with FS:0 chain on x86 Windows.
- BOOL wasCoop = m_pCurThread->PreemptiveGCDisabled();
+ Thread *pThread = m_pCurThread;
+ BOOL wasCoop = pThread->PreemptiveGCDisabled();
  if (!wasCoop)
  {
-m_pCurThread->DisablePreemptiveGC();
+pThread->DisablePreemptiveGC();
  }
 
  Pop();
 
  if (!wasCoop)
  {
-m_pCurThread->EnablePreemptiveGC();
+pThread->EnablePreemptiveGC();
  }
  }
 }
@@ -1233,7 +1234,7 @@ void GCFrame::Push(Thread* pThread)
  // in which the compiler will lay them out in the stack frame.
  // So minipal_getpagesize() is a guess of the maximum stack frame size of any method
  // with multiple GCFrames in coreclr.dll
- _ASSERTE(((m_Next == GCFRAME_TOP) ||
+ _ASSERTE(((m_Next == NULL) ||
  (PBYTE(m_Next->GetOSStackLocation()) + (2 * minipal_getpagesize())) > PBYTE(this->GetOSStackLocation())) &&
  "Pushing a GCFrame out of order ?");
 
@@ -1258,13 +1259,15 @@ void GCFrame::Pop()
  _ASSERTE(m_pCurThread->GetGCFrame() == this && "Popping a GCFrame out of order ?");
 
  m_pCurThread->SetGCFrame(m_Next);
- m_Next = NULL;
 
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
  Thread::ObjectRefNew(&m_pObjRefs[i]); // Unprotect them
 #endif
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 void GCFrame::Remove()
@@ -1280,7 +1283,7 @@ void GCFrame::Remove()
 
  GCFrame *pPrevFrame = NULL;
  GCFrame *pFrame = m_pCurThread->GetGCFrame();
- while (pFrame != GCFRAME_TOP)
+ while (pFrame != NULL)
  {
  if (pFrame == this)
  {
@@ -1293,8 +1296,6 @@ void GCFrame::Remove()
  m_pCurThread->SetGCFrame(m_Next);
  }
 
- m_Next = NULL;
-
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
@@ -1308,6 +1309,9 @@ void GCFrame::Remove()
  }
 
  _ASSERTE_MSG(pFrame != NULL, "GCFrame not found in the current thread's stack");
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 #endif // !DACCESS_COMPILE
@@ -1393,7 +1397,7 @@ BOOL IsProtectedByGCFrame(OBJECTREF *ppObjectRef)
  GetThread()->StackWalkFrames(IsProtectedByGCFrameStackWalkFramesCallback, &d);
 
  GCFrame* pGCFrame = GetThread()->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  if (pGCFrame->Protects(ppObjectRef)) {
  d.count++;

src/coreclr/vm/frames.h

@@ -184,7 +184,6 @@ class DacDbiInterfaceImpl;
 // whenever we compare it to a PTR_Frame value (the usual use of the value).
 #define FRAME_TOP_VALUE ~0 // we want to say -1 here, but gcc has trouble with the signed value
 #define FRAME_TOP (PTR_Frame(FRAME_TOP_VALUE))
-#define GCFRAME_TOP (PTR_GCFrame(FRAME_TOP_VALUE))
 
 
 enum class FrameIdentifier : TADDR
@@ -1808,6 +1807,17 @@ class GCFrame
 #ifdef FEATURE_INTERPRETER
  PTR_VOID m_osStackLocation;
 #endif
+
+ friend struct ::cdac_data<GCFrame>;
+};
+
+template<>
+struct cdac_data<GCFrame>
+{
+ static constexpr size_t Next = offsetof(GCFrame, m_Next);
+ static constexpr size_t ObjRefs = offsetof(GCFrame, m_pObjRefs);
+ static constexpr size_t NumObjRefs = offsetof(GCFrame, m_numObjRefs);
+ static constexpr size_t GCFlags = offsetof(GCFrame, m_gcFlags);
 };
 
 //-----------------------------------------------------------------------------

src/coreclr/vm/gcenv.ee.cpp

@@ -200,7 +200,7 @@ static void ScanStackRoots(Thread * pThread, promote_func* fn, ScanContext* sc)
  }
 
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  pGCFrame->GcScanRoots(fn, sc);
  pGCFrame = pGCFrame->PtrNextFrame();

src/coreclr/vm/threads.cpp

@@ -1185,7 +1185,7 @@ Thread::Thread()
  CONTRACTL_END;
 
  m_pFrame = FRAME_TOP;
- m_pGCFrame = GCFRAME_TOP;
+ m_pGCFrame = NULL;
 
  m_fPreemptiveGCDisabled = 0;
 
@@ -6752,7 +6752,7 @@ PTR_GCFrame Thread::GetGCFrame()
  {
  void* curSP;
  curSP = (void *)GetCurrentSP();
- _ASSERTE((m_pGCFrame == (GCFrame*)-1) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
+ _ASSERTE((m_pGCFrame == NULL) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
  }
 #endif
 

src/coreclr/vm/threads.h

@@ -3769,6 +3769,7 @@ struct cdac_data<Thread>
  static constexpr size_t PreemptiveGCDisabled = offsetof(Thread, m_fPreemptiveGCDisabled);
  static constexpr size_t RuntimeThreadLocals = offsetof(Thread, m_pRuntimeThreadLocals);
  static constexpr size_t Frame = offsetof(Thread, m_pFrame);
+ static constexpr size_t GCFrame = offsetof(Thread, m_pGCFrame);
  static constexpr size_t CachedStackBase = offsetof(Thread, m_CacheStackBase);
  static constexpr size_t CachedStackLimit = offsetof(Thread, m_CacheStackLimit);
  static constexpr size_t ExposedObject = offsetof(Thread, m_ExposedObject);

docs/design/datacontracts/StackWalk.md

@@ -149,6 +149,10 @@ This contract depends on the following descriptors:
 | `ExceptionInfo` | `PassNumber` | Exception handling pass (1 or 2) |
 | `ExceptionInfo` | `ClauseForCatchHandlerStartPC` | Start PC offset of the catch handler clause, used for interruptible offset override |
 | `ExceptionInfo` | `ClauseForCatchHandlerEndPC` | End PC offset of the catch handler clause, used for interruptible offset override |
+| `GCFrame` | `Next` | Pointer to the next `GCFrame` toward the top of the chain |
+| `GCFrame` | `ObjRefs` | Pointer to the array of protected object reference slots |
+| `GCFrame` | `NumObjRefs` | Count of protected object reference slots starting at `ObjRefs` |
+| `GCFrame` | `GCFlags` | `GC_CALL_*` promotion flags applied when reporting the protected slots |
 
 Global variables used:
 | Global Name | Type | Purpose |
@@ -168,6 +172,7 @@ Contracts used:
 | `Thread` |
 | `RuntimeTypeSystem` |
 | `GCInfo` |
+| `Exception` |
 
 
 ### Stackwalk Algorithm
@@ -594,7 +599,7 @@ If no Frame in the chain produces a usable context (thread is not running manage
 
 ### GC Stack Reference Scanning
 
-`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers. The native equivalent is `DacStackReferenceWalker` which calls `GcStackCrawlCallBack` at each frame.
+`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers, then reporting the thread's GCFrame (GCPROTECT) chain and in-flight exception (ExInfo) chain. This mirrors the GC's own root enumeration, `ScanStackRoots`.
 
 #### Stack Walk Integration
 
@@ -628,6 +633,15 @@ At each frame yielded by `Filter`, the walk determines whether to scan for GC re
 
 See [GCRefMap Format and Resolution](#gcrefmap-format-and-resolution) for the GCRefMap scanning path. The signature-based scanning fallback (`PromoteCallerStack`) is currently a stub awaiting an `ICallingConvention` contract port; the stress harness handles the resulting gaps via a deferred-frame sentinel (see [tests/StressTests/known-issues.md](../../../src/native/managed/cdac/tests/StressTests/known-issues.md) and tracking issue [dotnet/runtime#127765](https://github.com/dotnet/runtime/issues/127765)).
 
+#### GCFrame and Exception Tracker Roots
+
+After walking the thread's frames, `WalkStackReferences` reports two additional sets of roots that the GC keeps alive but that are not surfaced by per-frame GC info (matching native `gcenv.ee.cpp` `ScanStackRoots`):
+
+- **GCFrame (GCPROTECT) chain**: starting from `Thread.GCFrame` (obtained via the `Thread` contract's `GetThreadData`), each `GCFrame` is walked via its `Next` pointer until TargetPointer.Null is reached. For each node, the `NumObjRefs` slots starting at `ObjRefs` are reported, applying the node's `GCFlags` (`GC_CALL_INTERIOR` / `GC_CALL_PINNED`) as the promotion flags. This mirrors native `GCFrame::GcScanRoots`.
+- **Exception tracker (ExInfo) chain**: starting from the thread's exception tracker, each in-flight exception object (the current one and any superseded/nested ones reached via `PreviousNestedInfo`) is reported through its thrown-object slot.
+
+Both sets carry a non-zero, stack-resident `Source` and `StackPointer` set to the GCFrame / ExInfo node address (the node lives on the stack). A `GCFrame` node belongs to a separate chain from the explicit `Frame` chain, and an ExInfo node is likewise not a capital-F `Frame`, so neither is reported with the `Frame` source type. Both use the `Other` source type, which marks a root reported outside the per-frame walk.
+
 ### GCRefMap Format and Resolution
 
 A **GCRefMap** is a compact per-callsite encoding that describes which stack slots in a `TransitionBlock` contain GC references. GCRefMaps are pre-computed by the ReadyToRun compiler and stored in the PE image's import section auxiliary data.

docs/design/datacontracts/Thread.md

@@ -55,6 +55,7 @@ record struct ThreadData (
  TargetPointer ThreadHandle;
  bool IsInteropDebuggingHijacked;
  TargetPointer DebuggerFilterContext;
+ TargetPointer GCFrame;
 );
 ```
 
@@ -123,6 +124,7 @@ The contract additionally depends on these data descriptors
 | `Thread` | `DebuggerControlledThreadState` | Thread state flags controlled by the debugger |
 | `Thread` | `PreemptiveGCDisabled` | Flag indicating if preemptive GC is disabled |
 | `Thread` | `Frame` | Pointer to current frame |
+| `Thread` | `GCFrame` | Pointer to the head of the thread's GCFrame chain. |
 | `Thread` | `CachedStackBase` | Pointer to the base of the stack |
 | `Thread` | `CachedStackLimit` | Pointer to the limit of the stack |
 | `Thread` | `ExposedObject` | Handle to the managed `Thread` object exposed to the debugger |
@@ -237,6 +239,7 @@ ThreadData GetThreadData(TargetPointer address)
  LastThrownObjectHandle : lastThrownObjectHandle,
  FirstNestedException : firstNestedException,
  NextThread: target.ReadPointer(address + /* Thread::LinkNext offset */) - threadLinkOffset;
+ GCFrame: target.ReadPointer(address + /* Thread::GCFrame offset */),
  );
 }
 

src/coreclr/inc/sospriv.idl

@@ -111,6 +111,7 @@ typedef enum SOSStackSourceType
 {
  SOS_StackSourceIP, // Instruction pointer in managed code
  SOS_StackSourceFrame, // clr!Frame
+ SOS_StackSourceOther, // Roots which do not come from managed code or Frames
 } SOSStackSourceType;
 
 typedef enum SOSRefFlags

src/coreclr/pal/prebuilt/inc/sospriv.h

@@ -462,7 +462,8 @@ typedef
 enum SOSStackSourceType
  {
  SOS_StackSourceIP = 0,
- SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 )
+ SOS_StackSourceFrame = ( SOS_StackSourceIP + 1 ),
+ SOS_StackSourceOther = ( SOS_StackSourceFrame + 1 )
  } SOSStackSourceType;
 
 typedef

src/coreclr/vm/cdacstress.cpp

@@ -76,7 +76,7 @@ struct StackRef
  CLRDATA_ADDRESS Object; // The object pointer value
  unsigned int Flags; // SOSRefFlags (interior, pinned)
  CLRDATA_ADDRESS Source; // IP or Frame that owns this ref
- int SourceType; // SOS_StackSourceIPor SOS_StackSourceFrame
+ int SourceType; // SOS_StackSourceIP, SOS_StackSourceFrame, or SOS_StackSourceOther
  int Register; // Processor-encoding reg number, -1 for stack slots
  // (cDAC populates from GcInfo; runtime populates
  // by inverting GetRegisterSlot on supported arches)
@@ -721,7 +721,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  collectCtx.refs = outRefs;
  collectCtx.overflow = false;
  collectCtx.currentFrameSource = 0;
- collectCtx.currentFrameSourceType = 0;
+ collectCtx.currentFrameSourceType = SOS_StackSourceIP;
  collectCtx.currentRegDisplay = nullptr;
 
  GCCONTEXT gcctx = {};
@@ -780,7 +780,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // safepoint (matches DAC SOS_StackSourceIP convention).
  collectCtx->currentFrameSource =
  (CLRDATA_ADDRESS)PCODEToPINSTR(GetControlPC(pCF->GetRegisterSet()));
- collectCtx->currentFrameSourceType = 0; // SOS_StackSourceIP
+ collectCtx->currentFrameSourceType = SOS_StackSourceIP;
  collectCtx->currentRegDisplay = pCF->GetRegisterSet();
 
  ICodeManager* pCM = pCF->GetCodeManager();
@@ -801,7 +801,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
  // emit register-resident refs, so leave currentRegDisplay null.
  Frame* pFrame = pCF->GetFrame();
  collectCtx->currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pFrame);
- collectCtx->currentFrameSourceType = 1; // SOS_StackSourceFrame
+ collectCtx->currentFrameSourceType = SOS_StackSourceFrame;
 
  pFrame->GcScanRoots(gcctx->f, gcctx->sc);
  }
@@ -812,10 +812,36 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
 
  pThread->StackWalkFrames(dacLikeCallback, &diagCtx, flagsStackWalk);
 
- // NOTE: ScanStackRoots also scans the separate GCFrame linked list
- // (Thread::GetGCFrame), but the DAC's GetStackReferences / DacStackReferenceWalker
- // does NOT include those. We intentionally omit GCFrame scanning here so our
- // runtime-side collection matches what the cDAC is expected to produce.
+ // ScanStackRoots also scans two root sets that are not part of the frame walk: the
+ // GCFrame (GCPROTECT) chain and the in-flight ExInfo chain. GetStackReferences reports
+ // both, so mirror them here to keep the runtime-side collection in parity. See
+ // ScanStackRoots in gcenv.ee.cpp.
+ GCFrame* pGCFrame = pThread->GetGCFrame();
+ while (pGCFrame != nullptr)
+ {
+ // A GCFrame node is a separate chain from the explicit Frame chain, so it is not a
+ // capital-F Frame. Report it with the Other source type and the GCFrame node address as
+ // the Source, matching cDAC (GcScanContext stamps Source = GCFrame node, SourceType = Other).
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pGCFrame);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ pGCFrame->GcScanRoots(gcctx.f, gcctx.sc);
+ pGCFrame = pGCFrame->PtrNextFrame();
+ }
+
+ PTR_ExInfo pExInfo = pThread->GetExceptionState()->GetCurrentExceptionTracker();
+ while (pExInfo != NULL)
+ {
+ // The ExInfo is not a Frame either; GetStackReferences surfaces the in-flight exception
+ // object with the Other source type and the ExInfo node address as the Source, the same
+ // way it reports a GCFrame root. Mirror that here so the runtime-side collection matches cDAC.
+ collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pExInfo);
+ collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+ collectCtx.currentRegDisplay = nullptr;
+ PTR_PTR_Object pRef = dac_cast<PTR_PTR_Object>(&pExInfo->m_exception);
+ gcctx.f(pRef, gcctx.sc, 0);
+ pExInfo = pExInfo->GetPreviousExceptionTracker();
+ }
 
  return collectCtx.overflow ? S_FALSE : S_OK;
 }
@@ -867,7 +893,7 @@ static void ReportMismatch(const char* message, Thread* pThread, PCONTEXT regs)
 struct FrameRefGroup
 {
  CLRDATA_ADDRESS Source;
- int SourceType; // 0 = IP, 1 = Frame
+ int SourceType; // 0 = IP, 1 = Frame, 2 = Other
  int StartIdx; // Index into the original ref array
  int Count; // Number of refs in this group
 };
@@ -1624,7 +1650,15 @@ static void ResolveMethodName(CLRDATA_ADDRESS source, int sourceType, char* buf,
  if (bufLen <= 0)
  return;
 
- if (sourceType != 0) // SOS_StackSourceFrame
+ if (sourceType == SOS_StackSourceOther)
+ {
+ // A root reported outside the frame walk (GCFrame/GCPROTECT or ExInfo chain). Source is a
+ // node address, not a capital-F Frame, so do not dereference it as a Frame*.
+ snprintf(buf, bufLen, "<other 0x%llx>", (unsigned long long)source);
+ return;
+ }
+
+ if (sourceType == SOS_StackSourceFrame)
  {
  Frame* pFrame = reinterpret_cast<Frame*>(source);
  LPCSTR typeName = Frame::GetFrameTypeName(pFrame->GetFrameIdentifier());

src/coreclr/vm/datadescriptor/datadescriptor.inc

@@ -41,6 +41,7 @@ CDAC_TYPE_FIELD(Thread, T_UINT32, State, cdac_data<Thread>::State)
 CDAC_TYPE_FIELD(Thread, T_UINT32, PreemptiveGCDisabled, cdac_data<Thread>::PreemptiveGCDisabled)
 CDAC_TYPE_FIELD(Thread, T_POINTER, RuntimeThreadLocals, cdac_data<Thread>::RuntimeThreadLocals)
 CDAC_TYPE_FIELD(Thread, T_POINTER, Frame, cdac_data<Thread>::Frame)
+CDAC_TYPE_FIELD(Thread, T_POINTER, GCFrame, cdac_data<Thread>::GCFrame)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackBase, cdac_data<Thread>::CachedStackBase)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackLimit, cdac_data<Thread>::CachedStackLimit)
 CDAC_TYPE_FIELD(Thread, T_POINTER, ExceptionTracker, cdac_data<Thread>::ExceptionTracker)
@@ -71,6 +72,14 @@ CDAC_TYPE_FIELD(ThreadStore, T_INT32, PendingCount, cdac_data<ThreadStore>::Pend
 CDAC_TYPE_FIELD(ThreadStore, T_INT32, DeadCount, cdac_data<ThreadStore>::DeadCount)
 CDAC_TYPE_END(ThreadStore)
 
+CDAC_TYPE_BEGIN(GCFrame)
+CDAC_TYPE_INDETERMINATE(GCFrame)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, Next, cdac_data<GCFrame>::Next)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, ObjRefs, cdac_data<GCFrame>::ObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, NumObjRefs, cdac_data<GCFrame>::NumObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, GCFlags, cdac_data<GCFrame>::GCFlags)
+CDAC_TYPE_END(GCFrame)
+
 CDAC_TYPE_BEGIN(RuntimeThreadLocals)
 CDAC_TYPE_INDETERMINATE(RuntimeThreadLocals)
 CDAC_TYPE_FIELD(RuntimeThreadLocals, TYPE(EEAllocContext), AllocContext, offsetof(RuntimeThreadLocals, alloc_context))

src/coreclr/vm/exceptionhandling.cpp

@@ -512,7 +512,7 @@ static void PopExplicitFrames(Thread *pThread, void *targetSp, void *targetCalle
  if (popGCFrames)
  {
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while ((pGCFrame != GCFRAME_TOP) && pGCFrame->GetOSStackLocation() < targetSp)
+ while ((pGCFrame != nullptr) && pGCFrame->GetOSStackLocation() < targetSp)
  {
  pGCFrame->Pop();
  pGCFrame = pThread->GetGCFrame();

src/coreclr/vm/frames.cpp

@@ -1185,28 +1185,29 @@ GCFrame::~GCFrame()
  NOTHROW;
  GC_NOTRIGGER;
  MODE_ANY;
- PRECONDITION(m_pCurThread != NULL);
  }
  CONTRACTL_END;
 
- // m_pNext is NULL when the frame was already popped from the stack.
- if (m_Next != NULL)
+ // Normally the destructor performs the pop for a GCPROTECT_BEGIN/END scope, so the frame is
+ // still linked when we get here. If it was already popped explicitly - by PopExplicitFrames
+ // during EH unwind, or by the interpreter's GCReporting::Unregister - then m_pCurThread is
+ // NULL and there is nothing left to do.
+ if (m_pCurThread != NULL)
  {
- // This is a GCFrame that was not popped. This is a problem.
- // We should have popped it before we destruct
  // Do a manual switch to the GC cooperative mode instead of using the GCX_COOP_THREAD_EXISTS
  // macro so that this function isn't slowed down by having to deal with FS:0 chain on x86 Windows.
- BOOL wasCoop = m_pCurThread->PreemptiveGCDisabled();
+ Thread *pThread = m_pCurThread;
+ BOOL wasCoop = pThread->PreemptiveGCDisabled();
  if (!wasCoop)
  {
-m_pCurThread->DisablePreemptiveGC();
+pThread->DisablePreemptiveGC();
  }
 
  Pop();
 
  if (!wasCoop)
  {
-m_pCurThread->EnablePreemptiveGC();
+pThread->EnablePreemptiveGC();
  }
  }
 }
@@ -1233,7 +1234,7 @@ void GCFrame::Push(Thread* pThread)
  // in which the compiler will lay them out in the stack frame.
  // So minipal_getpagesize() is a guess of the maximum stack frame size of any method
  // with multiple GCFrames in coreclr.dll
- _ASSERTE(((m_Next == GCFRAME_TOP) ||
+ _ASSERTE(((m_Next == NULL) ||
  (PBYTE(m_Next->GetOSStackLocation()) + (2 * minipal_getpagesize())) > PBYTE(this->GetOSStackLocation())) &&
  "Pushing a GCFrame out of order ?");
 
@@ -1258,13 +1259,15 @@ void GCFrame::Pop()
  _ASSERTE(m_pCurThread->GetGCFrame() == this && "Popping a GCFrame out of order ?");
 
  m_pCurThread->SetGCFrame(m_Next);
- m_Next = NULL;
 
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
  Thread::ObjectRefNew(&m_pObjRefs[i]); // Unprotect them
 #endif
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 void GCFrame::Remove()
@@ -1280,7 +1283,7 @@ void GCFrame::Remove()
 
  GCFrame *pPrevFrame = NULL;
  GCFrame *pFrame = m_pCurThread->GetGCFrame();
- while (pFrame != GCFRAME_TOP)
+ while (pFrame != NULL)
  {
  if (pFrame == this)
  {
@@ -1293,8 +1296,6 @@ void GCFrame::Remove()
  m_pCurThread->SetGCFrame(m_Next);
  }
 
- m_Next = NULL;
-
 #ifdef _DEBUG
  m_pCurThread->EnableStressHeap();
  for(UINT i = 0; i < m_numObjRefs; i++)
@@ -1308,6 +1309,9 @@ void GCFrame::Remove()
  }
 
  _ASSERTE_MSG(pFrame != NULL, "GCFrame not found in the current thread's stack");
+
+ // The frame is no longer linked on the thread's GCFrame chain.
+ m_pCurThread = NULL;
 }
 
 #endif // !DACCESS_COMPILE
@@ -1393,7 +1397,7 @@ BOOL IsProtectedByGCFrame(OBJECTREF *ppObjectRef)
  GetThread()->StackWalkFrames(IsProtectedByGCFrameStackWalkFramesCallback, &d);
 
  GCFrame* pGCFrame = GetThread()->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  if (pGCFrame->Protects(ppObjectRef)) {
  d.count++;

src/coreclr/vm/frames.h

@@ -184,7 +184,6 @@ class DacDbiInterfaceImpl;
 // whenever we compare it to a PTR_Frame value (the usual use of the value).
 #define FRAME_TOP_VALUE ~0 // we want to say -1 here, but gcc has trouble with the signed value
 #define FRAME_TOP (PTR_Frame(FRAME_TOP_VALUE))
-#define GCFRAME_TOP (PTR_GCFrame(FRAME_TOP_VALUE))
 
 
 enum class FrameIdentifier : TADDR
@@ -1808,6 +1807,17 @@ class GCFrame
 #ifdef FEATURE_INTERPRETER
  PTR_VOID m_osStackLocation;
 #endif
+
+ friend struct ::cdac_data<GCFrame>;
+};
+
+template<>
+struct cdac_data<GCFrame>
+{
+ static constexpr size_t Next = offsetof(GCFrame, m_Next);
+ static constexpr size_t ObjRefs = offsetof(GCFrame, m_pObjRefs);
+ static constexpr size_t NumObjRefs = offsetof(GCFrame, m_numObjRefs);
+ static constexpr size_t GCFlags = offsetof(GCFrame, m_gcFlags);
 };
 
 //-----------------------------------------------------------------------------

src/coreclr/vm/gcenv.ee.cpp

@@ -200,7 +200,7 @@ static void ScanStackRoots(Thread * pThread, promote_func* fn, ScanContext* sc)
  }
 
  GCFrame* pGCFrame = pThread->GetGCFrame();
- while (pGCFrame != GCFRAME_TOP)
+ while (pGCFrame != NULL)
  {
  pGCFrame->GcScanRoots(fn, sc);
  pGCFrame = pGCFrame->PtrNextFrame();

src/coreclr/vm/threads.cpp

@@ -1185,7 +1185,7 @@ Thread::Thread()
  CONTRACTL_END;
 
  m_pFrame = FRAME_TOP;
- m_pGCFrame = GCFRAME_TOP;
+ m_pGCFrame = NULL;
 
  m_fPreemptiveGCDisabled = 0;
 
@@ -6752,7 +6752,7 @@ PTR_GCFrame Thread::GetGCFrame()
  {
  void* curSP;
  curSP = (void *)GetCurrentSP();
- _ASSERTE((m_pGCFrame == (GCFrame*)-1) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
+ _ASSERTE((m_pGCFrame == NULL) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
  }
 #endif
 

src/coreclr/vm/threads.h

@@ -3769,6 +3769,7 @@ struct cdac_data<Thread>
  static constexpr size_t PreemptiveGCDisabled = offsetof(Thread, m_fPreemptiveGCDisabled);
  static constexpr size_t RuntimeThreadLocals = offsetof(Thread, m_pRuntimeThreadLocals);
  static constexpr size_t Frame = offsetof(Thread, m_pFrame);
+ static constexpr size_t GCFrame = offsetof(Thread, m_pGCFrame);
  static constexpr size_t CachedStackBase = offsetof(Thread, m_CacheStackBase);
  static constexpr size_t CachedStackLimit = offsetof(Thread, m_CacheStackLimit);
  static constexpr size_t ExposedObject = offsetof(Thread, m_ExposedObject);