') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); [release/10.0] Fix InlinedCallFrameMarker bit-0 check on 64-bit platforms in DAC stack walk by jkotas · Pull Request #131961 · dotnet/runtime · GitHub
Skip to content

[release/10.0] Fix InlinedCallFrameMarker bit-0 check on 64-bit platforms in DAC stack walk - #131961

Merged
JulieLeeMSFT merged 1 commit into
release/10.0from
copilot/fix-eh-marker-64bit-release10
Aug 24, 2026
Merged

[release/10.0] Fix InlinedCallFrameMarker bit-0 check on 64-bit platforms in DAC stack walk#131961
JulieLeeMSFT merged 1 commit into
release/10.0from
copilot/fix-eh-marker-64bit-release10

Conversation

@jkotas

@jkotasjkotas commented Aug 6, 2026

Copy link
Copy Markdown
Member

Fixes Issue #131606

main PR N/A (targeted servicing fix; the full fix for main is in #131642 / #131654, which are too invasive for a servicing branch)

Description

On 64-bit platforms, an unmanaged calli target can be encoded into InlinedCallFrame::m_Datum as (target << 1) | 1. This left-shift moves bit 0 of the target address into bit 1 of m_Datum. Two sites in src/coreclr/debug/daccess/dacdbiimplstackwalk.cpp (GetCountOfInternalFrames and EnumerateInternalFrames) test bit 1 of m_Datum against InlinedCallFrameMarker::ExceptionHandlingHelper without first checking bit 0 to confirm the field actually holds a MethodDesc* (with the marker bit set) rather than a shifted-and-tagged raw calli target. As a result, when the linker happens to place the native calli target at an odd address, the shifted-in low bit is misread as the EH-helper marker, and the frame is incorrectly skipped during stack walking.

This PR adds a TARGET_64BIT-guarded check for bit 0 before interpreting bit 1 as the InlinedCallFrameMarker::ExceptionHandlingHelper marker at both affected sites, matching the precedent already established in InlinedCallFrame::GetFunction_Impl (src/coreclr/vm/frames.h), which masks out the marker bits before treating m_Datum as a pointer.

Customer Impact

Visual Studio's mixed-mode debugger fails to show native C++ call stack frames when a C++/CLI layer calls native code through an unmanaged calli whose target address happens to be odd (a common occurrence with delay-loaded imports and incrementally-linked thunks). This makes debugging native code called from managed C++/CLI unreliable and appears intermittent/random to customers, since it depends on a single bit of a linker-chosen address.

Regression

Yes. This is a regression from .NET 8, introduced by the exception handling rewrite.

Testing

Verified the corrected bit-check logic in isolation (bit 0 check first, then bit 1), confirming that on 64-bit an odd-tagged calli target (bit0=1, bit1=1) is no longer misidentified as the EH-helper marker, while behavior for actual EH-helper-marked frames (bit0=0, bit1=1) and for 32-bit platforms (unaffected, no shift-tagging) is unchanged.

Risk

Low. The change is narrowly scoped to two conditional checks in the DAC stack-walk code, guarded by TARGET_64BIT, and does not alter behavior for 32-bit platforms or for frames that are genuinely marked as EH helpers.

@jkotas
Add bit-0 check before InlinedCallFrameMarker on 64-bit
cb6e7de
Co-authored-by: jkotas <6668460+jkotas@users.noreply.github.com>
@jkotas
jkotas requested review from Copilot and janvorli and removed request for CopilotAugust 6, 2026 19:10
@jkotasjkotas added the Servicing-approved Approved for servicing release label Aug 6, 2026
@azure-pipelines

azure-pipelinesBot commented Aug 6, 2026

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@dotnet-policy-service

dotnet-policy-serviceBot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @steveisok, @tommcdon, @dotnet/dotnet-diag
See info in area-owners.md if you want to be subscribed.

@steveisok
steveisok enabled auto-merge (squash) August 11, 2026 22:19
@steveisok

steveisok commented Aug 11, 2026

Copy link
Copy Markdown
Member

/ba-g Known issue https://dev.azure.com/dnceng-public/public/_build/results?buildId=1543226&view=ms.vss-test-web.build-test-results-tab&runId=42489836&resultId=201761

@JulieLeeMSFTJulieLeeMSFT added this to the 10.0.x milestone Aug 24, 2026
@JulieLeeMSFT

JulieLeeMSFT commented Aug 24, 2026

Copy link
Copy Markdown
Member

/ba-g known issues.

@JulieLeeMSFT
JulieLeeMSFT merged commit f8a7519 into release/10.0Aug 24, 2026
89 of 95 checks passed
@JulieLeeMSFT
JulieLeeMSFT deleted the copilot/fix-eh-marker-64bit-release10 branch August 24, 2026 18:02
@dotnet-maestrodotnet-maestroBot mentioned this pull request Aug 24, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@janvorlijanvorlijanvorli approved these changes

Assignees

@jkotasjkotas

Labels

area-Diagnostics-coreclrServicing-approvedApproved for servicing release

Projects

None yet

Milestone

10.0.x

Development

Successfully merging this pull request may close these issues.

5 participants

@jkotas@steveisok@JulieLeeMSFT@janvorli