Uh oh!
There was an error while loading. Please reload this page.
Fix AV in gc_heap::init_heap_segment - #131947
Conversation
There is a bug in get_card_table_element_layout / get_card_table_commit_layout that results in the last page of the seg_mapping_table_element not being committed in case there was no mark_array_element. That happens when concurrent GC is disabled. The change fixes that by ensuring that every layout[element] is aligned according to its alignment requirements even when its size is 0. That allows the get_card_table_commit_layout to set commit end of the seg_mapping_table_element to include the last page even when the mark_array_element is not present. The problem happens because when a memory page is shared by multiple card table elements, the commit range for the first element on that page doesn't include that page and the next element is supposed to do the commit. Closedotnet#129681
|
Azure Pipelines: Successfully started running 3 pipeline(s). 13 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Tagging subscribers to this area: @anicka-net, @dotnet/gc |
There was a problem hiding this comment.
Pull request overview
This PR fixes a GC bookkeeping layout/commit bug in gc_heap::get_card_table_element_layout that can leave the last page of the seg-mapping table uncommitted when the background/mark array element is absent, which can later lead to an AV during heap segment initialization. It also adds a targeted regression test to exercise the problematic configuration.
Changes:
- Always align each bookkeeping element’s start offset (except the terminal sentinel) even when the element’s size is
0, so later elements’ commit ranges correctly cover shared pages. - Add a new GC regression test project and test case intended to reproduce the failure under GC stress/heap hard-limit settings.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
src/coreclr/gc/card_table.cpp | Adjusts bookkeeping element layout alignment so commit layout doesn’t skip the last shared page when a zero-sized element is present. |
src/tests/GC/Regressions/Github/Runtime_129681/Runtime_129681.csproj | Adds a process-isolated test project that sets GC stress / region / hard-limit environment variables. |
src/tests/GC/Regressions/Github/Runtime_129681/Runtime_129681.cs | Adds a regression test that drives allocations to OOM under the configured GC constraints. |
Suppressed comments (1)
src/tests/GC/Regressions/Github/Runtime_129681/Runtime_129681.csproj:18
- Same as the batch pre-commands: explicitly disable concurrent GC in the bash pre-commands so the test reliably runs in the configuration where mark_array_element is absent (sizes[mark_array_element] == 0).
$(CLRTestBashPreCommands)
export DOTNET_GCStress=0xC
export DOTNET_GCHeapHardLimit=0x4000000
export DOTNET_GCRegionRange=0x4000000
export DOTNET_GCRegionSize=0x100000
Uh oh!
There was an error while loading. Please reload this page.
kkokosa
left a comment
There was a problem hiding this comment.
Copilot suggested disabling this test for Mono - not sure if needed:
<!-- Mono doesn't enforce DOTNET_GCHeapHardLimit as a GC heap limit -->
<DisableProjectBuild Condition="'$(RuntimeFlavor)' == 'mono'">true</DisableProjectBuild>
There was a problem hiding this comment.
Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.
Note
This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.
janvorli
commented
Aug 7, 2026
/ba-g failure is #132000 |
Uh oh!
There was an error while loading. Please reload this page.
There is a bug in get_card_table_element_layout / get_card_table_commit_layout that results in the last page of the seg_mapping_table_element not being committed in case there was no mark_array_element. That happens when concurrent GC is disabled. The change fixes that by ensuring that every layout[element] is aligned according to its alignment requirements even when its size is 0. That allows the get_card_table_commit_layout to set commit end of the seg_mapping_table_element to include the last page even when the mark_array_element is not present. The problem happens because when a memory page is shared by multiple card table elements, the commit range for the first element on that page doesn't include that page and the next element is supposed to do the commit. Closedotnet#129681
There is a bug in get_card_table_element_layout /
get_card_table_commit_layout that results in the last page of the seg_mapping_table_element not being committed in case there was no mark_array_element. That happens when concurrent GC is disabled.
The change fixes that by ensuring that every layout[element] is aligned according to its alignment requirements even when its size is 0. That allows the get_card_table_commit_layout to set commit end of the seg_mapping_table_element to include the last page even when the mark_array_element is not present.
The problem happens because when a memory page is shared by multiple card table elements, the commit range for the first element on that page doesn't include that page and the next element is supposed to do the commit.
Close#129681