[release/10.0] Backport #127638: Fix !m_RedirectContextInUse assert in RestoreContextSimulated on win-x86

[Copilot]

main PR #127638

Description

On x86 Windows lacking RtlRestoreContext, Thread::RestoreContextSimulated called HandleThreadAbort() while m_RedirectContextInUse was still true. Constructing the ThreadAbortException runs managed code, during which a concurrent GC redirect fires MarkRedirectContextInUse() and hits the !m_RedirectContextInUse assert (and can corrupt the saved context).

Backport of #127638 to release/10.0 (src/coreclr/vm/threadsuspend.cpp, +10/-12):

• Removed the inlined HandleThreadAbort() from RestoreContextSimulated.
• Moved the #ifdef TARGET_X86RestoreContextSimulated call in RedirectedHandledJITCase to after the existing COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share a single abort-check path.

Byte-for-byte identical to the merged main fix except for preserving release/10.0's __UNREACHABLE() spelling.

Customer Impact

Any x86 .NET 10 process where ntdll lacks RtlRestoreContext (x86 Win7, WOW64 on Win7, and similar) can hit a double-redirect race that corrupts the saved thread context, causing random, hard-to-diagnose crashes. .NET 10 is LTS (supported through Nov 2028).

Regression

No. Pre-existing bug in the x86 RestoreContextSimulated path, not introduced in a recent release.

Testing

Manual review confirming the diff matches the merged main change. The affected code is entirely under #ifdef TARGET_X86, so it is not exercised by non-Windows-x86 build/test configurations.

Risk

Low. Minimal, localized reordering of an existing abort check; already reviewed and shipping on main since 2026-05-01.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[azure-pipelines]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.

...

⚠️ This PR's base branch needs to be changed to release/10.0

I've prepared the backport of #127638, but I cannot push it because this PR currently targets main as its base branch (base = main @ 0f08396), whereas this is a request to backport the fix to release/10.0.

Two consequences of the wrong base:

1. main already contains the fix. PR Fix !m_RedirectContextInUse assert in RestoreContextSimulated on win-x86 #127638 was merged to main on 2026-05-01 (bd9e85e4). There is no diff to apply against main, so a backport cannot be represented while the base stays main.
2. The automation rebases the working branch onto the (main-based) PR head, which replays the entire release/10.0 history and conflicts, so the release/10.0-based backport commit can't be pushed.

What needs to happen

Please change the base branch of this PR from main to release/10.0 (Edit → base dropdown). Once retargeted, the backport commit can be pushed cleanly.

The prepared change (identical to #127638, minimal +10/-12 in src/coreclr/vm/threadsuspend.cpp)

• Remove the inlined pThread->HandleThreadAbort(); from Thread::RestoreContextSimulated.
• Move the #ifdef TARGET_X86RestoreContextSimulated(...) call in RedirectedHandledJITCase to after the COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share one abort-check path.

 void Thread::RestoreContextSimulated(Thread* pThread, CONTEXT* pCtx, void* pFrame, DWORD dwLastError)
{
- pThread->HandleThreadAbort(); // Might throw an exception.-
// A counter to avoid a nasty case where an
// up-stack filter throws another exception
// causing our filter to be run again for
@@ RedirectedHandledJITCase @@
// Once we get here the suspension is over!
// We will restore the state as it was at the point of redirection
// and continue normal execution.
-#ifdef TARGET_X86- if (!g_pfnRtlRestoreContext)- {- RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);-- // we never return to the caller.- __UNREACHABLE();- }-#endif // TARGET_X86-
UINT_PTR uAbortAddr;
UINT_PTR uResumePC = (UINT_PTR)GetIP(pCtx);
@@ @@
SetIP(pCtx, uAbortAddr);
}
+#ifdef TARGET_X86+ if (!g_pfnRtlRestoreContext)+ {+ RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);++ // we never return to the caller.+ __UNREACHABLE();+ }+#endif // TARGET_X86+
// Unlink the frame in preparation for resuming in managed code
frame.Pop();

(The only difference vs the main commit is preserving release/10.0's __UNREACHABLE() spelling.)

Note

This comment was generated by GitHub Copilot.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke
See info in area-owners.md if you want to be subscribed.

[Copilot]

main PR #127638

Description

On x86 Windows lacking RtlRestoreContext, Thread::RestoreContextSimulated called HandleThreadAbort() while m_RedirectContextInUse was still true. Constructing the ThreadAbortException runs managed code, during which a concurrent GC redirect fires MarkRedirectContextInUse() and hits the !m_RedirectContextInUse assert (and can corrupt the saved context).

Backport of #127638 to release/10.0 (src/coreclr/vm/threadsuspend.cpp, +10/-12):

• Removed the inlined HandleThreadAbort() from RestoreContextSimulated.
• Moved the #ifdef TARGET_X86RestoreContextSimulated call in RedirectedHandledJITCase to after the existing COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share a single abort-check path.

Byte-for-byte identical to the merged main fix except for preserving release/10.0's __UNREACHABLE() spelling.

Customer Impact

Any x86 .NET 10 process where ntdll lacks RtlRestoreContext (x86 Win7, WOW64 on Win7, and similar) can hit a double-redirect race that corrupts the saved thread context, causing random, hard-to-diagnose crashes. .NET 10 is LTS (supported through Nov 2028).

Regression

No. Pre-existing bug in the x86 RestoreContextSimulated path, not introduced in a recent release.

Testing

Manual review confirming the diff matches the merged main change. The affected code is entirely under #ifdef TARGET_X86, so it is not exercised by non-Windows-x86 build/test configurations.

Risk

Low. Minimal, localized reordering of an existing abort check; already reviewed and shipping on main since 2026-05-01.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[azure-pipelines]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.

...

⚠️ This PR's base branch needs to be changed to release/10.0

I've prepared the backport of #127638, but I cannot push it because this PR currently targets main as its base branch (base = main @ 0f08396), whereas this is a request to backport the fix to release/10.0.

Two consequences of the wrong base:

1. main already contains the fix. PR Fix !m_RedirectContextInUse assert in RestoreContextSimulated on win-x86 #127638 was merged to main on 2026-05-01 (bd9e85e4). There is no diff to apply against main, so a backport cannot be represented while the base stays main.
2. The automation rebases the working branch onto the (main-based) PR head, which replays the entire release/10.0 history and conflicts, so the release/10.0-based backport commit can't be pushed.

What needs to happen

Please change the base branch of this PR from main to release/10.0 (Edit → base dropdown). Once retargeted, the backport commit can be pushed cleanly.

The prepared change (identical to #127638, minimal +10/-12 in src/coreclr/vm/threadsuspend.cpp)

• Remove the inlined pThread->HandleThreadAbort(); from Thread::RestoreContextSimulated.
• Move the #ifdef TARGET_X86RestoreContextSimulated(...) call in RedirectedHandledJITCase to after the COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share one abort-check path.

 void Thread::RestoreContextSimulated(Thread* pThread, CONTEXT* pCtx, void* pFrame, DWORD dwLastError)
{
- pThread->HandleThreadAbort(); // Might throw an exception.-
// A counter to avoid a nasty case where an
// up-stack filter throws another exception
// causing our filter to be run again for
@@ RedirectedHandledJITCase @@
// Once we get here the suspension is over!
// We will restore the state as it was at the point of redirection
// and continue normal execution.
-#ifdef TARGET_X86- if (!g_pfnRtlRestoreContext)- {- RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);-- // we never return to the caller.- __UNREACHABLE();- }-#endif // TARGET_X86-
UINT_PTR uAbortAddr;
UINT_PTR uResumePC = (UINT_PTR)GetIP(pCtx);
@@ @@
SetIP(pCtx, uAbortAddr);
}
+#ifdef TARGET_X86+ if (!g_pfnRtlRestoreContext)+ {+ RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);++ // we never return to the caller.+ __UNREACHABLE();+ }+#endif // TARGET_X86+
// Unlink the frame in preparation for resuming in managed code
frame.Pop();

(The only difference vs the main commit is preserving release/10.0's __UNREACHABLE() spelling.)

Note

This comment was generated by GitHub Copilot.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke
See info in area-owners.md if you want to be subscribed.

[Copilot]

main PR #127638

Description

On x86 Windows lacking RtlRestoreContext, Thread::RestoreContextSimulated called HandleThreadAbort() while m_RedirectContextInUse was still true. Constructing the ThreadAbortException runs managed code, during which a concurrent GC redirect fires MarkRedirectContextInUse() and hits the !m_RedirectContextInUse assert (and can corrupt the saved context).

Backport of #127638 to release/10.0 (src/coreclr/vm/threadsuspend.cpp, +10/-12):

• Removed the inlined HandleThreadAbort() from RestoreContextSimulated.
• Moved the #ifdef TARGET_X86RestoreContextSimulated call in RedirectedHandledJITCase to after the existing COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share a single abort-check path.

Byte-for-byte identical to the merged main fix except for preserving release/10.0's __UNREACHABLE() spelling.

Customer Impact

Any x86 .NET 10 process where ntdll lacks RtlRestoreContext (x86 Win7, WOW64 on Win7, and similar) can hit a double-redirect race that corrupts the saved thread context, causing random, hard-to-diagnose crashes. .NET 10 is LTS (supported through Nov 2028).

Regression

No. Pre-existing bug in the x86 RestoreContextSimulated path, not introduced in a recent release.

Testing

Manual review confirming the diff matches the merged main change. The affected code is entirely under #ifdef TARGET_X86, so it is not exercised by non-Windows-x86 build/test configurations.

Risk

Low. Minimal, localized reordering of an existing abort check; already reviewed and shipping on main since 2026-05-01.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[azure-pipelines]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.

...

⚠️ This PR's base branch needs to be changed to release/10.0

I've prepared the backport of #127638, but I cannot push it because this PR currently targets main as its base branch (base = main @ 0f08396), whereas this is a request to backport the fix to release/10.0.

Two consequences of the wrong base:

1. main already contains the fix. PR Fix !m_RedirectContextInUse assert in RestoreContextSimulated on win-x86 #127638 was merged to main on 2026-05-01 (bd9e85e4). There is no diff to apply against main, so a backport cannot be represented while the base stays main.
2. The automation rebases the working branch onto the (main-based) PR head, which replays the entire release/10.0 history and conflicts, so the release/10.0-based backport commit can't be pushed.

What needs to happen

Please change the base branch of this PR from main to release/10.0 (Edit → base dropdown). Once retargeted, the backport commit can be pushed cleanly.

The prepared change (identical to #127638, minimal +10/-12 in src/coreclr/vm/threadsuspend.cpp)

• Remove the inlined pThread->HandleThreadAbort(); from Thread::RestoreContextSimulated.
• Move the #ifdef TARGET_X86RestoreContextSimulated(...) call in RedirectedHandledJITCase to after the COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share one abort-check path.

 void Thread::RestoreContextSimulated(Thread* pThread, CONTEXT* pCtx, void* pFrame, DWORD dwLastError)
{
- pThread->HandleThreadAbort(); // Might throw an exception.-
// A counter to avoid a nasty case where an
// up-stack filter throws another exception
// causing our filter to be run again for
@@ RedirectedHandledJITCase @@
// Once we get here the suspension is over!
// We will restore the state as it was at the point of redirection
// and continue normal execution.
-#ifdef TARGET_X86- if (!g_pfnRtlRestoreContext)- {- RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);-- // we never return to the caller.- __UNREACHABLE();- }-#endif // TARGET_X86-
UINT_PTR uAbortAddr;
UINT_PTR uResumePC = (UINT_PTR)GetIP(pCtx);
@@ @@
SetIP(pCtx, uAbortAddr);
}
+#ifdef TARGET_X86+ if (!g_pfnRtlRestoreContext)+ {+ RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);++ // we never return to the caller.+ __UNREACHABLE();+ }+#endif // TARGET_X86+
// Unlink the frame in preparation for resuming in managed code
frame.Pop();

(The only difference vs the main commit is preserving release/10.0's __UNREACHABLE() spelling.)

Note

This comment was generated by GitHub Copilot.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke
See info in area-owners.md if you want to be subscribed.

[Copilot]

main PR #127638

Description

On x86 Windows lacking RtlRestoreContext, Thread::RestoreContextSimulated called HandleThreadAbort() while m_RedirectContextInUse was still true. Constructing the ThreadAbortException runs managed code, during which a concurrent GC redirect fires MarkRedirectContextInUse() and hits the !m_RedirectContextInUse assert (and can corrupt the saved context).

Backport of #127638 to release/10.0 (src/coreclr/vm/threadsuspend.cpp, +10/-12):

• Removed the inlined HandleThreadAbort() from RestoreContextSimulated.
• Moved the #ifdef TARGET_X86RestoreContextSimulated call in RedirectedHandledJITCase to after the existing COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share a single abort-check path.

Byte-for-byte identical to the merged main fix except for preserving release/10.0's __UNREACHABLE() spelling.

Customer Impact

Any x86 .NET 10 process where ntdll lacks RtlRestoreContext (x86 Win7, WOW64 on Win7, and similar) can hit a double-redirect race that corrupts the saved thread context, causing random, hard-to-diagnose crashes. .NET 10 is LTS (supported through Nov 2028).

Regression

No. Pre-existing bug in the x86 RestoreContextSimulated path, not introduced in a recent release.

Testing

Manual review confirming the diff matches the merged main change. The affected code is entirely under #ifdef TARGET_X86, so it is not exercised by non-Windows-x86 build/test configurations.

Risk

Low. Minimal, localized reordering of an existing abort check; already reviewed and shipping on main since 2026-05-01.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[azure-pipelines]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.

...

⚠️ This PR's base branch needs to be changed to release/10.0

I've prepared the backport of #127638, but I cannot push it because this PR currently targets main as its base branch (base = main @ 0f08396), whereas this is a request to backport the fix to release/10.0.

Two consequences of the wrong base:

1. main already contains the fix. PR Fix !m_RedirectContextInUse assert in RestoreContextSimulated on win-x86 #127638 was merged to main on 2026-05-01 (bd9e85e4). There is no diff to apply against main, so a backport cannot be represented while the base stays main.
2. The automation rebases the working branch onto the (main-based) PR head, which replays the entire release/10.0 history and conflicts, so the release/10.0-based backport commit can't be pushed.

What needs to happen

Please change the base branch of this PR from main to release/10.0 (Edit → base dropdown). Once retargeted, the backport commit can be pushed cleanly.

The prepared change (identical to #127638, minimal +10/-12 in src/coreclr/vm/threadsuspend.cpp)

• Remove the inlined pThread->HandleThreadAbort(); from Thread::RestoreContextSimulated.
• Move the #ifdef TARGET_X86RestoreContextSimulated(...) call in RedirectedHandledJITCase to after the COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share one abort-check path.

 void Thread::RestoreContextSimulated(Thread* pThread, CONTEXT* pCtx, void* pFrame, DWORD dwLastError)
{
- pThread->HandleThreadAbort(); // Might throw an exception.-
// A counter to avoid a nasty case where an
// up-stack filter throws another exception
// causing our filter to be run again for
@@ RedirectedHandledJITCase @@
// Once we get here the suspension is over!
// We will restore the state as it was at the point of redirection
// and continue normal execution.
-#ifdef TARGET_X86- if (!g_pfnRtlRestoreContext)- {- RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);-- // we never return to the caller.- __UNREACHABLE();- }-#endif // TARGET_X86-
UINT_PTR uAbortAddr;
UINT_PTR uResumePC = (UINT_PTR)GetIP(pCtx);
@@ @@
SetIP(pCtx, uAbortAddr);
}
+#ifdef TARGET_X86+ if (!g_pfnRtlRestoreContext)+ {+ RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);++ // we never return to the caller.+ __UNREACHABLE();+ }+#endif // TARGET_X86+
// Unlink the frame in preparation for resuming in managed code
frame.Pop();

(The only difference vs the main commit is preserving release/10.0's __UNREACHABLE() spelling.)

Note

This comment was generated by GitHub Copilot.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke
See info in area-owners.md if you want to be subscribed.

[Copilot]

main PR #127638

Description

On x86 Windows lacking RtlRestoreContext, Thread::RestoreContextSimulated called HandleThreadAbort() while m_RedirectContextInUse was still true. Constructing the ThreadAbortException runs managed code, during which a concurrent GC redirect fires MarkRedirectContextInUse() and hits the !m_RedirectContextInUse assert (and can corrupt the saved context).

Backport of #127638 to release/10.0 (src/coreclr/vm/threadsuspend.cpp, +10/-12):

• Removed the inlined HandleThreadAbort() from RestoreContextSimulated.
• Moved the #ifdef TARGET_X86RestoreContextSimulated call in RedirectedHandledJITCase to after the existing COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share a single abort-check path.

Byte-for-byte identical to the merged main fix except for preserving release/10.0's __UNREACHABLE() spelling.

Customer Impact

Any x86 .NET 10 process where ntdll lacks RtlRestoreContext (x86 Win7, WOW64 on Win7, and similar) can hit a double-redirect race that corrupts the saved thread context, causing random, hard-to-diagnose crashes. .NET 10 is LTS (supported through Nov 2028).

Regression

No. Pre-existing bug in the x86 RestoreContextSimulated path, not introduced in a recent release.

Testing

Manual review confirming the diff matches the merged main change. The affected code is entirely under #ifdef TARGET_X86, so it is not exercised by non-Windows-x86 build/test configurations.

Risk

Low. Minimal, localized reordering of an existing abort check; already reviewed and shipping on main since 2026-05-01.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[azure-pipelines]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.

...

⚠️ This PR's base branch needs to be changed to release/10.0

I've prepared the backport of #127638, but I cannot push it because this PR currently targets main as its base branch (base = main @ 0f08396), whereas this is a request to backport the fix to release/10.0.

Two consequences of the wrong base:

1. main already contains the fix. PR Fix !m_RedirectContextInUse assert in RestoreContextSimulated on win-x86 #127638 was merged to main on 2026-05-01 (bd9e85e4). There is no diff to apply against main, so a backport cannot be represented while the base stays main.
2. The automation rebases the working branch onto the (main-based) PR head, which replays the entire release/10.0 history and conflicts, so the release/10.0-based backport commit can't be pushed.

What needs to happen

Please change the base branch of this PR from main to release/10.0 (Edit → base dropdown). Once retargeted, the backport commit can be pushed cleanly.

The prepared change (identical to #127638, minimal +10/-12 in src/coreclr/vm/threadsuspend.cpp)

• Remove the inlined pThread->HandleThreadAbort(); from Thread::RestoreContextSimulated.
• Move the #ifdef TARGET_X86RestoreContextSimulated(...) call in RedirectedHandledJITCase to after the COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share one abort-check path.

 void Thread::RestoreContextSimulated(Thread* pThread, CONTEXT* pCtx, void* pFrame, DWORD dwLastError)
{
- pThread->HandleThreadAbort(); // Might throw an exception.-
// A counter to avoid a nasty case where an
// up-stack filter throws another exception
// causing our filter to be run again for
@@ RedirectedHandledJITCase @@
// Once we get here the suspension is over!
// We will restore the state as it was at the point of redirection
// and continue normal execution.
-#ifdef TARGET_X86- if (!g_pfnRtlRestoreContext)- {- RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);-- // we never return to the caller.- __UNREACHABLE();- }-#endif // TARGET_X86-
UINT_PTR uAbortAddr;
UINT_PTR uResumePC = (UINT_PTR)GetIP(pCtx);
@@ @@
SetIP(pCtx, uAbortAddr);
}
+#ifdef TARGET_X86+ if (!g_pfnRtlRestoreContext)+ {+ RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);++ // we never return to the caller.+ __UNREACHABLE();+ }+#endif // TARGET_X86+
// Unlink the frame in preparation for resuming in managed code
frame.Pop();

(The only difference vs the main commit is preserving release/10.0's __UNREACHABLE() spelling.)

Note

This comment was generated by GitHub Copilot.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke
See info in area-owners.md if you want to be subscribed.

[Copilot]

main PR #127638

Description

On x86 Windows lacking RtlRestoreContext, Thread::RestoreContextSimulated called HandleThreadAbort() while m_RedirectContextInUse was still true. Constructing the ThreadAbortException runs managed code, during which a concurrent GC redirect fires MarkRedirectContextInUse() and hits the !m_RedirectContextInUse assert (and can corrupt the saved context).

Backport of #127638 to release/10.0 (src/coreclr/vm/threadsuspend.cpp, +10/-12):

• Removed the inlined HandleThreadAbort() from RestoreContextSimulated.
• Moved the #ifdef TARGET_X86RestoreContextSimulated call in RedirectedHandledJITCase to after the existing COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share a single abort-check path.

Byte-for-byte identical to the merged main fix except for preserving release/10.0's __UNREACHABLE() spelling.

Customer Impact

Any x86 .NET 10 process where ntdll lacks RtlRestoreContext (x86 Win7, WOW64 on Win7, and similar) can hit a double-redirect race that corrupts the saved thread context, causing random, hard-to-diagnose crashes. .NET 10 is LTS (supported through Nov 2028).

Regression

No. Pre-existing bug in the x86 RestoreContextSimulated path, not introduced in a recent release.

Testing

Manual review confirming the diff matches the merged main change. The affected code is entirely under #ifdef TARGET_X86, so it is not exercised by non-Windows-x86 build/test configurations.

Risk

Low. Minimal, localized reordering of an existing abort check; already reviewed and shipping on main since 2026-05-01.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[azure-pipelines]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.

...

⚠️ This PR's base branch needs to be changed to release/10.0

I've prepared the backport of #127638, but I cannot push it because this PR currently targets main as its base branch (base = main @ 0f08396), whereas this is a request to backport the fix to release/10.0.

Two consequences of the wrong base:

1. main already contains the fix. PR Fix !m_RedirectContextInUse assert in RestoreContextSimulated on win-x86 #127638 was merged to main on 2026-05-01 (bd9e85e4). There is no diff to apply against main, so a backport cannot be represented while the base stays main.
2. The automation rebases the working branch onto the (main-based) PR head, which replays the entire release/10.0 history and conflicts, so the release/10.0-based backport commit can't be pushed.

What needs to happen

Please change the base branch of this PR from main to release/10.0 (Edit → base dropdown). Once retargeted, the backport commit can be pushed cleanly.

The prepared change (identical to #127638, minimal +10/-12 in src/coreclr/vm/threadsuspend.cpp)

• Remove the inlined pThread->HandleThreadAbort(); from Thread::RestoreContextSimulated.
• Move the #ifdef TARGET_X86RestoreContextSimulated(...) call in RedirectedHandledJITCase to after the COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share one abort-check path.

 void Thread::RestoreContextSimulated(Thread* pThread, CONTEXT* pCtx, void* pFrame, DWORD dwLastError)
{
- pThread->HandleThreadAbort(); // Might throw an exception.-
// A counter to avoid a nasty case where an
// up-stack filter throws another exception
// causing our filter to be run again for
@@ RedirectedHandledJITCase @@
// Once we get here the suspension is over!
// We will restore the state as it was at the point of redirection
// and continue normal execution.
-#ifdef TARGET_X86- if (!g_pfnRtlRestoreContext)- {- RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);-- // we never return to the caller.- __UNREACHABLE();- }-#endif // TARGET_X86-
UINT_PTR uAbortAddr;
UINT_PTR uResumePC = (UINT_PTR)GetIP(pCtx);
@@ @@
SetIP(pCtx, uAbortAddr);
}
+#ifdef TARGET_X86+ if (!g_pfnRtlRestoreContext)+ {+ RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);++ // we never return to the caller.+ __UNREACHABLE();+ }+#endif // TARGET_X86+
// Unlink the frame in preparation for resuming in managed code
frame.Pop();

(The only difference vs the main commit is preserving release/10.0's __UNREACHABLE() spelling.)

Note

This comment was generated by GitHub Copilot.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke
See info in area-owners.md if you want to be subscribed.

[Copilot]

main PR #127638

Description

On x86 Windows lacking RtlRestoreContext, Thread::RestoreContextSimulated called HandleThreadAbort() while m_RedirectContextInUse was still true. Constructing the ThreadAbortException runs managed code, during which a concurrent GC redirect fires MarkRedirectContextInUse() and hits the !m_RedirectContextInUse assert (and can corrupt the saved context).

Backport of #127638 to release/10.0 (src/coreclr/vm/threadsuspend.cpp, +10/-12):

• Removed the inlined HandleThreadAbort() from RestoreContextSimulated.
• Moved the #ifdef TARGET_X86RestoreContextSimulated call in RedirectedHandledJITCase to after the existing COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share a single abort-check path.

Byte-for-byte identical to the merged main fix except for preserving release/10.0's __UNREACHABLE() spelling.

Customer Impact

Any x86 .NET 10 process where ntdll lacks RtlRestoreContext (x86 Win7, WOW64 on Win7, and similar) can hit a double-redirect race that corrupts the saved thread context, causing random, hard-to-diagnose crashes. .NET 10 is LTS (supported through Nov 2028).

Regression

No. Pre-existing bug in the x86 RestoreContextSimulated path, not introduced in a recent release.

Testing

Manual review confirming the diff matches the merged main change. The affected code is entirely under #ifdef TARGET_X86, so it is not exercised by non-Windows-x86 build/test configurations.

Risk

Low. Minimal, localized reordering of an existing abort check; already reviewed and shipping on main since 2026-05-01.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[azure-pipelines]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.

...

⚠️ This PR's base branch needs to be changed to release/10.0

I've prepared the backport of #127638, but I cannot push it because this PR currently targets main as its base branch (base = main @ 0f08396), whereas this is a request to backport the fix to release/10.0.

Two consequences of the wrong base:

1. main already contains the fix. PR Fix !m_RedirectContextInUse assert in RestoreContextSimulated on win-x86 #127638 was merged to main on 2026-05-01 (bd9e85e4). There is no diff to apply against main, so a backport cannot be represented while the base stays main.
2. The automation rebases the working branch onto the (main-based) PR head, which replays the entire release/10.0 history and conflicts, so the release/10.0-based backport commit can't be pushed.

What needs to happen

Please change the base branch of this PR from main to release/10.0 (Edit → base dropdown). Once retargeted, the backport commit can be pushed cleanly.

The prepared change (identical to #127638, minimal +10/-12 in src/coreclr/vm/threadsuspend.cpp)

• Remove the inlined pThread->HandleThreadAbort(); from Thread::RestoreContextSimulated.
• Move the #ifdef TARGET_X86RestoreContextSimulated(...) call in RedirectedHandledJITCase to after the COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share one abort-check path.

 void Thread::RestoreContextSimulated(Thread* pThread, CONTEXT* pCtx, void* pFrame, DWORD dwLastError)
{
- pThread->HandleThreadAbort(); // Might throw an exception.-
// A counter to avoid a nasty case where an
// up-stack filter throws another exception
// causing our filter to be run again for
@@ RedirectedHandledJITCase @@
// Once we get here the suspension is over!
// We will restore the state as it was at the point of redirection
// and continue normal execution.
-#ifdef TARGET_X86- if (!g_pfnRtlRestoreContext)- {- RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);-- // we never return to the caller.- __UNREACHABLE();- }-#endif // TARGET_X86-
UINT_PTR uAbortAddr;
UINT_PTR uResumePC = (UINT_PTR)GetIP(pCtx);
@@ @@
SetIP(pCtx, uAbortAddr);
}
+#ifdef TARGET_X86+ if (!g_pfnRtlRestoreContext)+ {+ RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);++ // we never return to the caller.+ __UNREACHABLE();+ }+#endif // TARGET_X86+
// Unlink the frame in preparation for resuming in managed code
frame.Pop();

(The only difference vs the main commit is preserving release/10.0's __UNREACHABLE() spelling.)

Note

This comment was generated by GitHub Copilot.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke
See info in area-owners.md if you want to be subscribed.

[Copilot]

main PR #127638

Description

On x86 Windows lacking RtlRestoreContext, Thread::RestoreContextSimulated called HandleThreadAbort() while m_RedirectContextInUse was still true. Constructing the ThreadAbortException runs managed code, during which a concurrent GC redirect fires MarkRedirectContextInUse() and hits the !m_RedirectContextInUse assert (and can corrupt the saved context).

Backport of #127638 to release/10.0 (src/coreclr/vm/threadsuspend.cpp, +10/-12):

• Removed the inlined HandleThreadAbort() from RestoreContextSimulated.
• Moved the #ifdef TARGET_X86RestoreContextSimulated call in RedirectedHandledJITCase to after the existing COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share a single abort-check path.

Byte-for-byte identical to the merged main fix except for preserving release/10.0's __UNREACHABLE() spelling.

Customer Impact

Any x86 .NET 10 process where ntdll lacks RtlRestoreContext (x86 Win7, WOW64 on Win7, and similar) can hit a double-redirect race that corrupts the saved thread context, causing random, hard-to-diagnose crashes. .NET 10 is LTS (supported through Nov 2028).

Regression

No. Pre-existing bug in the x86 RestoreContextSimulated path, not introduced in a recent release.

Testing

Manual review confirming the diff matches the merged main change. The affected code is entirely under #ifdef TARGET_X86, so it is not exercised by non-Windows-x86 build/test configurations.

Risk

Low. Minimal, localized reordering of an existing abort check; already reviewed and shipping on main since 2026-05-01.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[azure-pipelines]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.

...

⚠️ This PR's base branch needs to be changed to release/10.0

I've prepared the backport of #127638, but I cannot push it because this PR currently targets main as its base branch (base = main @ 0f08396), whereas this is a request to backport the fix to release/10.0.

Two consequences of the wrong base:

1. main already contains the fix. PR Fix !m_RedirectContextInUse assert in RestoreContextSimulated on win-x86 #127638 was merged to main on 2026-05-01 (bd9e85e4). There is no diff to apply against main, so a backport cannot be represented while the base stays main.
2. The automation rebases the working branch onto the (main-based) PR head, which replays the entire release/10.0 history and conflicts, so the release/10.0-based backport commit can't be pushed.

What needs to happen

Please change the base branch of this PR from main to release/10.0 (Edit → base dropdown). Once retargeted, the backport commit can be pushed cleanly.

The prepared change (identical to #127638, minimal +10/-12 in src/coreclr/vm/threadsuspend.cpp)

• Remove the inlined pThread->HandleThreadAbort(); from Thread::RestoreContextSimulated.
• Move the #ifdef TARGET_X86RestoreContextSimulated(...) call in RedirectedHandledJITCase to after the COMPlusCheckForAbort() block, so the x86 SEH path and the RtlRestoreContext path share one abort-check path.

 void Thread::RestoreContextSimulated(Thread* pThread, CONTEXT* pCtx, void* pFrame, DWORD dwLastError)
{
- pThread->HandleThreadAbort(); // Might throw an exception.-
// A counter to avoid a nasty case where an
// up-stack filter throws another exception
// causing our filter to be run again for
@@ RedirectedHandledJITCase @@
// Once we get here the suspension is over!
// We will restore the state as it was at the point of redirection
// and continue normal execution.
-#ifdef TARGET_X86- if (!g_pfnRtlRestoreContext)- {- RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);-- // we never return to the caller.- __UNREACHABLE();- }-#endif // TARGET_X86-
UINT_PTR uAbortAddr;
UINT_PTR uResumePC = (UINT_PTR)GetIP(pCtx);
@@ @@
SetIP(pCtx, uAbortAddr);
}
+#ifdef TARGET_X86+ if (!g_pfnRtlRestoreContext)+ {+ RestoreContextSimulated(pThread, pCtx, &frame, dwLastError);++ // we never return to the caller.+ __UNREACHABLE();+ }+#endif // TARGET_X86+
// Unlink the frame in preparation for resuming in managed code
frame.Pop();

(The only difference vs the main commit is preserving release/10.0's __UNREACHABLE() spelling.)

Note

This comment was generated by GitHub Copilot.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke
See info in area-owners.md if you want to be subscribed.