Skip to content

Avoid publishing interpreter frame with invalid IP - #129795

Merged
BrzVlad merged 3 commits into
dotnet:mainfrom
BrzVlad:fix-clrinterp-stack-overflow
Jun 26, 2026
Merged

Avoid publishing interpreter frame with invalid IP#129795
BrzVlad merged 3 commits into
dotnet:mainfrom
BrzVlad:fix-clrinterp-stack-overflow

Conversation

@BrzVlad

@BrzVladBrzVlad commented Jun 24, 2026

Copy link
Copy Markdown
Member

When we need to obtain a new InterpMethodContextFrame for called method execution, we try to obtain a preallocated one from the list. If there is none, then we just allocate a new one with alloca and initialize the fields, including the ip to 0 initially. The problem is that the compiler is free to reorder this initialization in whichever way it considers optimal. If a stack overflow gets triggered at some point during execution (at a location that we don't normally expect), the unwinder might actually observe a pushed interp frame that has a non-null junk ip. We fix this by making sure the ip is properly zeroed before we publish the new interpreter frame on the list. Order is achieved just via compiler barriers.

Should fix stackoverflowtester on win-arm64.

"Assert failure(PID 46068 [0x0000b3f4], Thread: 46860 [0xb70c]): m_crawl.GetCodeInfo()->IsValid()"
CORECLR! StackFrameIterator::NextRaw + 0x764 (0x00007ff8`157b6e04)"
CORECLR! StackFrameIterator::Filter + 0xBD4 (0x00007ff8`157b57b4)"
CORECLR! StackFrameIterator::Init + 0x258 (0x00007ff8`157b60d8)"
CORECLR! Thread::StackWalkFramesEx + 0x178 (0x00007ff8`157b7e78)"
CORECLR! Thread::StackWalkFrames + 0x1A8 (0x00007ff8`157b7cd8)"
CORECLR! LogCallstackForLogWorker + 0x19C (0x00007ff8`1585139c)"
CORECLR! LogStackOverflowStackTraceThread + 0x10 (0x00007ff8`15851fe0)"
KERNEL32! BaseThreadInitThunk + 0x40 (0x00007ff8`8f128740)"
<no module>! <no symbol> + 0x0 (0x392cfff8`8fe64594)"
File: D:\a\_work\1\s\src\coreclr\vm\stackwalk.cpp:2306"
Image: C:\h\w\BD470A90\p\corerun.exe"

CopilotAI review requested due to automatic review settings June 24, 2026 11:41
@BrzVlad

Copy link
Copy Markdown
MemberAuthor

/azp run runtime-interpreter

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

@dotnet-policy-service

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @JulieLeeMSFT, @BrzVlad, @janvorli, @kg
See info in area-owners.md if you want to be subscribed.

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@BrzVlad

Copy link
Copy Markdown
MemberAuthor

/azp run runtime-interpreter

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

@BrzVlad

Copy link
Copy Markdown
MemberAuthor

@janvorli Miraculously, this actually fixed the failing test. It would be great if you could reproduce the failure and validate the theory, but I believe the fix is simplistic enough anyway and it doesn't impact any hot path.

Comment threadsrc/coreclr/vm/interpexec.cpp Outdated
@BrzVlad

Copy link
Copy Markdown
MemberAuthor

/azp run runtime-interpreter

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

@janvorlijanvorli left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thank you!

CopilotAI review requested due to automatic review settings June 25, 2026 14:19

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comment threadsrc/coreclr/vm/interpexec.cpp
@BrzVlad

Copy link
Copy Markdown
MemberAuthor

/azp run runtime-interpreter

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines successfully started running 1 pipeline(s).

@BrzVlad

Copy link
Copy Markdown
MemberAuthor

@janvorli Had to move the definition from volatile.h, since it was breaking windows build due to some ASSERTE conflicts. Ended up defining the method only in interpexec.cpp for now. Your approval is now stale.

@BrzVlad

Copy link
Copy Markdown
MemberAuthor

/ba-g unrelated build timeouts

@BrzVlad
BrzVlad merged commit 99eb16b into dotnet:mainJun 26, 2026
120 of 124 checks passed
@dotnet-milestone-botdotnet-milestone-botBot added this to the 11.0-preview7 milestone Jun 28, 2026
eiriktsarpalis pushed a commit that referenced this pull request Jul 15, 2026
When we need to obtain a new `InterpMethodContextFrame` for called
method execution, we try to obtain a preallocated one from the list. If
there is none, then we just allocate a new one with `alloca` and
initialize the fields, including the `ip` to 0 initially. The problem is
that the compiler is free to reorder this initialization in whichever
way it considers optimal. If a stack overflow gets triggered at some
point during execution (at a location that we don't normally expect),
the unwinder might actually observe a pushed interp frame that has a
non-null junk ip. We fix this by making sure the ip is properly zeroed
before we publish the new interpreter frame on the list. Order is
achieved just via compiler barriers.
Should fix `stackoverflowtester` on win-arm64.
```
"Assert failure(PID 46068 [0x0000b3f4], Thread: 46860 [0xb70c]): m_crawl.GetCodeInfo()->IsValid()"
CORECLR! StackFrameIterator::NextRaw + 0x764 (0x00007ff8`157b6e04)"
CORECLR! StackFrameIterator::Filter + 0xBD4 (0x00007ff8`157b57b4)"
CORECLR! StackFrameIterator::Init + 0x258 (0x00007ff8`157b60d8)"
CORECLR! Thread::StackWalkFramesEx + 0x178 (0x00007ff8`157b7e78)"
CORECLR! Thread::StackWalkFrames + 0x1A8 (0x00007ff8`157b7cd8)"
CORECLR! LogCallstackForLogWorker + 0x19C (0x00007ff8`1585139c)"
CORECLR! LogStackOverflowStackTraceThread + 0x10 (0x00007ff8`15851fe0)"
KERNEL32! BaseThreadInitThunk + 0x40 (0x00007ff8`8f128740)"
<no module>! <no symbol> + 0x0 (0x392cfff8`8fe64594)"
File: D:\a\_work\1\s\src\coreclr\vm\stackwalk.cpp:2306"
Image: C:\h\w\BD470A90\p\corerun.exe"
```
@github-actionsgithub-actionsBot locked and limited conversation to collaborators Jul 29, 2026
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@BrzVlad@janvorli