Merge branch 'main' into robust-crossJumpVictim

Author: BoyBaykiller

.github/workflows/ci-failure-fix.lock.yml

@@ -0,0 +1,48 @@
+# Area → skill directory
+
+A single source of truth mapping a `dotnet/runtime` area / pipeline to the
+Copilot skill that carries the domain knowledge for it. Agents and skills that
+need to route a failure, a review, or a change to the right area knowledge
+should reference this table instead of re-declaring their own copy, so the
+mapping stays consistent as skills are added or renamed.
+
+Skill paths in the table below are relative to `.github/skills/`, so
+`mobile-platforms/SKILL.md` means `.github/skills/mobile-platforms/SKILL.md`.
+The one non-skill entry (NativeAOT) is given as a repo-root-relative path and is
+called out as such. Area-owner handles are **not** listed here; resolve owners
+from [`docs/area-owners.md`](../../../docs/area-owners.md) by the issue's
+`area-*` label.
+
+<a id="area-skill-table"></a>
+
+## Area → skill table
+
+Skill paths are relative to `.github/skills/`.
+
+| Area / pipeline | Skill(s) | What the skill covers |
+|---|---|---|
+| Mobile (ios / tvos / maccatalyst / android / wasm / wasi) | `mobile-platforms/SKILL.md` | Mobile/wasm test, csproj, and platform-condition knowledge. |
+| JIT / GC / PGO stress (codegen) | `jit-regression-test/SKILL.md`; `ci-pipeline-monitor/SKILL.md` | JIT codegen, assertion triage, regression-test extraction. |
+| `System.Net.*` | `system-net-review/SKILL.md` | Networking stack review and conventions. |
+| `Microsoft.Extensions.*` | `extensions-review/SKILL.md` | Extensions (DI, config, logging, hosting, caching) review. |
+| NativeAOT outer loop | repo-root `eng/testing/tests.*aot*.targets` + the test `.csproj` | NativeAOT test wiring (no dedicated skill; read the targets). |
+| Generic / unmapped | `ci-pipeline-monitor/SKILL.md` | Cross-cutting CI pipeline monitoring and triage. |
+
+When more than one skill is listed, load them in order; the first carries the
+primary domain knowledge and the rest add CI/triage context.
+
+<a id="area-mention-conventions"></a>
+
+## Area-owner mention conventions
+
+When an agent loops a human in (a PR body or an issue comment) based on an
+`area-*` label, apply these rules so notifications stay proportionate:
+
+- Resolve owners from [`docs/area-owners.md`](../../../docs/area-owners.md) by the
+  `area-*` label.
+- Live-mention **at most one or two** individual owners.
+- **Never live-mention a GitHub team.** Render a team handle (`@dotnet/<team>`)
+  as inline code `` `@dotnet/<team>` `` so it does not notify the whole team.
+- Never mention bots (`dotnet-maestro`, `github-actions`, codeflow accounts).
+- Put contacts under a non-accusatory heading framed as "loop-in for triage",
+  not blame.

.github/workflows/ci-failure-fix.md

@@ -141,9 +141,20 @@ never match because there is no test name. Add:
 Each candidate body must be fetched and read; do not match on title alone. On
 hit, record `existing-PR #<n>`.
 
+### Integrity-filtered PR candidate
+
+If any PR search above returns a `[Filtered]` marker for a candidate whose
+title, source symbol, or assertion slice overlaps the failing signature, do
+**not** assume no fix exists and file a fresh KBE. The filter hides a real PR
+you are not permitted to read, and it may already handle this failure. Record
+`skipped: integrity-filtered candidate, needs human review` and stop for this
+signature. A human can confirm whether the hidden PR fixes the failure; filing a
+duplicate KBE that is immediately closed as "fixed by" the hidden PR is a
+scanner-quality miss the feedback workflow will penalize.
+
 ### Merged fix PR (last 14 days)
 
-Only when an existing KBE or area-team tracker was recorded:
+When an existing KBE or area-team tracker was recorded:
 
 - `is:pr is:merged "<test-name>" merged:>=<14-days-ago>`
 - `is:pr is:merged "<test-file-path>" merged:>=<14-days-ago>`
@@ -152,6 +163,29 @@ Only when an existing KBE or area-team tracker was recorded:
 On match, record `skipped: fix recently merged in #<n>` and do not file a
 test-disable PR.
 
+#### Always run this for assertion / native / build-level signatures
+
+For a JIT, runtime, or build-level signature (assert in `coreclr!*`, `clrjit!*`,
+a native crash, or a compiler diagnostic), run the merged-PR search
+**unconditionally** — even when no existing KBE was found. These signatures
+recur and their KBEs are frequently closed-as-fixed, so an open-only dedup will
+not see the closed predecessor and the failure gets re-filed from a stale build.
+Search:
+
+- `is:pr is:merged "<assertion-text>" merged:>=<14-days-ago>` using a 6-12 word
+  literal slice of the assert / diagnostic message.
+- `is:pr is:merged "<source-symbol>" merged:>=<14-days-ago>` for each of the 2-3
+  most unique C / C++ identifiers in the stack frame or assertion text.
+
+For every merged PR hit, compare its `mergedAt` against the failing build's
+`finishTime` (the AzDO build that produced this failure; read it from the build
+metadata, not the queue time). If the fix merged **after** the build finished,
+the failure is stale and already addressed: record
+`skipped: fix already merged after source build` (cite the PR `#<n>`) and do not
+file. Only file a new KBE when the same assertion still reproduces in a build
+that finished **after** the fix merged (a genuine post-fix recurrence), and say
+so explicitly in the KBE body with both the fix PR `#<n>` and the post-fix build.
+
 <a id="verify-embedded-issues"></a>
 
 ## Verify every embedded issue number exists

.github/workflows/ci-failure-scan-feedback.lock.yml

@@ -343,6 +343,7 @@ public readonly struct DebugVarInfo
     public int StackOffset { get; init; }
     public uint BaseRegister2 { get; init; }
     public int StackOffset2 { get; init; }
+    public uint CallReturnValueILOffset { get; init; }
 }
 
 // Given a code pointer, return the variable location info for the method.
@@ -352,7 +353,8 @@ IEnumerable<DebugVarInfo> GetMethodVarInfo(TargetCodePointer pCode, out uint cod
 Additional constants (Version 2):
 | Constant Name | Meaning | Value |
 | --- | --- | --- |
-| `MAX_ILNUM` | Bias for adjusted encoding of variable numbers | `0xfffffffc` (-4) |
+| `MAX_ILNUM` | Bias for adjusted encoding of variable numbers | `0xfffffffa` (-6) |
+| `CALL_RETURN_ILNUM` | Special variable number identifying a call-return-value entry | `0xfffffffb` (-5) |
 | `VLT_REG` | Variable is in a register | `0` |
 | `VLT_REG_BYREF` | Address of the variable is in a register | `1` |
 | `VLT_REG_FP` | Variable is in an FP register | `2` |
@@ -371,9 +373,11 @@ Additional constants (Version 2):
 
 Each variable entry in the Vars section is nibble-encoded as follows:
 
-1. `startOffset` — encoded unsigned 32-bit integer
-2. `endOffset` — encoded as delta from `startOffset` (unsigned)
-3. `varNumber` — encoded as adjusted unsigned (`value - MAX_ILNUM`)
+1. `varNumber` — encoded as adjusted unsigned (`value - MAX_ILNUM`)
+2. `startOffset` — encoded unsigned 32-bit integer
+3. The next field depends on `varNumber`:
+   - If `varNumber == CALL_RETURN_ILNUM`: `callReturnValueILOffset` — encoded unsigned 32-bit integer (IL offset of the call site whose return value this entry describes). `endOffset` is implicit and equals `startOffset + 1`.
+   - Otherwise: `endOffset` — encoded as delta from `startOffset` (unsigned). `callReturnValueILOffset` is implicit and equals `0`.
 4. `VarLocType` — encoded unsigned 32-bit integer
 5. Location fields depend on the `VarLocType`:
 

.github/workflows/ci-failure-scan-feedback.md

@@ -628,62 +628,24 @@ At each frame yielded by `Filter`, the walk determines whether to scan for GC re
 
 See [GCRefMap Format and Resolution](#gcrefmap-format-and-resolution) for the GCRefMap scanning path and [Signature-Based Scanning](#signature-based-scanning) for the signature decoding path.
 
-### Signature-Based Scanning
+### Signature-Based Scanning (currently deferred)
 
-When a transition frame's calling convention is not described by a precomputed GCRefMap (`PrestubMethodFrame`, `CallCountingHelperFrame`, and the fallback path for `StubDispatchFrame`/`ExternalMethodFrame`), the GC reference walk classifies caller-stack arguments by decoding the callee's method signature. This corresponds to native `TransitionFrame::PromoteCallerStack` (`src/coreclr/vm/frames.cpp`).
+When a transition frame's calling convention is not described by a precomputed GCRefMap (`PrestubMethodFrame`, `CallCountingHelperFrame`, and the fallback path for `StubDispatchFrame`/`ExternalMethodFrame`), the native runtime classifies caller-stack arguments by decoding the callee's method signature (`TransitionFrame::PromoteCallerStack` in `src/coreclr/vm/frames.cpp`).
 
-#### GcSignatureTypeProvider
-
-`GcSignatureTypeProvider` is an `IRuntimeSignatureTypeProvider<GcTypeKind, GcSignatureContext>` that classifies each parameter type into one of:
+The cDAC does **not** currently port this scan. `GcScanner.PromoteCallerStack` is a stub that records the frame as deferred and returns without enumerating any refs:
 
 ```csharp
-internal enum GcTypeKind
+private static void PromoteCallerStack(TargetPointer frameAddress, GcScanContext scanContext)
 {
-    None,       // Non-GC primitive that fits in a single slot
-    Ref,        // Object reference (TYPE_GC_REF)
-    Interior,   // Managed pointer / byref (TYPE_GC_BYREF)
-    Other,      // Value type that may contain GC refs, or any type larger than a slot
+    scanContext.RecordDeferredFrame(frameAddress);
 }
 ```
 
-The provider is scoped to the method's containing module (captured at construction) so that `TypeDef` and `TypeRef` tokens can be resolved to a loaded `MethodTable` via the module's `TypeDefToMethodTable` / `TypeRefToMethodTable` lookup tables. The decoder's generic context is a `GcSignatureContext(TypeHandle classContext, MethodDescHandle methodContext)` carrying the method's class and method instantiations.
-
-The provider classifies primitives directly (`String`/`Object` -> `Ref`, `TypedReference` -> `Other`, others -> `None`). For `TypeDef`/`TypeRef` it resolves the loaded `TypeHandle` and classifies via `RuntimeTypeSystem.GetSignatureCorElementType`, treating enums (`IsEnum`) as their underlying primitive (`None`). When the type cannot be resolved (e.g., not yet loaded), classification falls back to the signature's `rawTypeKind` (`ValueType` -> `Other`, otherwise `Ref`). Arrays are `Ref`, byrefs are `Interior`, raw pointers are `None`. Generic parameters (`!T`, `!!T`) are resolved against the `GcSignatureContext` (via `GetInstantiation` / `GetGenericMethodInstantiation`) and classified by their actual instantiation -- matching native `SigTypeContext`-driven `PeekElemTypeNormalized` behavior. `ELEMENT_TYPE_INTERNAL` resolves the `TypeHandle` via `RuntimeTypeSystem.GetSignatureCorElementType` and maps the `CorElementType` to a `GcTypeKind`.
-
-#### PromoteCallerStack Algorithm
-
-1. Read the `MethodDesc` pointer from the `FramedMethodFrame` and obtain a `MethodDescHandle` from `RuntimeTypeSystem`.
-2. Resolve the method's `MetadataReader` via `Loader.GetModuleHandleFromModulePtr` and `EcmaMetadata.GetMetadata`. If metadata is unavailable, no caller-stack refs are reported (matches native fallback behavior).
-3. Obtain the method's signature blob, matching native `MethodDesc::GetSig`:
-   - If `RuntimeTypeSystem.IsStoredSigMethodDesc` is true (dynamic, EEImpl, and array method descs), pin the stored signature span and pass a `BlobReader` over it to `RuntimeSignatureDecoder.DecodeMethodSignature`.
-   - Otherwise, look up the signature via the metadata token (`mdMethodDef`), skipping methods with a nil token (`0x06000000`).
-4. Decode the signature with `RuntimeSignatureDecoder<GcTypeKind, GcSignatureContext>` and a `GcSignatureTypeProvider` constructed for the method's module. The `GcSignatureContext` passes the method's class and method instantiations so that `VAR`/`MVAR` placeholders resolve to their actual types. See [Signature contract](./Signature.md) for the decoder.
-5. Skip varargs methods (the caller-stack layout is not described by the callee signature alone).
-6. Compute the number of reserved register slots in the `TransitionBlock`:
-
-   | Reserved Slot | Condition |
-   |---|---|
-   | `this` pointer | `MethodSignature.Header.IsInstance` |
-   | Return buffer | Return type is `GcTypeKind.Other` |
-   | Generic instantiation arg | `RuntimeTypeSystem.RequiresInstArg(methodDesc)` |
-   | Async continuation | `RuntimeTypeSystem.IsAsyncMethod(methodDesc)` |
-   | ARM64 indirect-result register (`x8`) | Target architecture is ARM64 |
-
-7. If `IsInstance`, report the `this` slot at position `0` (or `1` on ARM64 to skip `x8`). The slot is reported as `GC_CALL_INTERIOR` for value-type `this`, otherwise as a normal reference.
-8. Walk `MethodSignature.ParameterTypes` starting at slot index = reserved slot count, advancing one slot per parameter:
-   - `GcTypeKind.Ref` -> report as a reference.
-   - `GcTypeKind.Interior` -> report with `GC_CALL_INTERIOR`.
-   - `GcTypeKind.Other` / `GcTypeKind.None` -> not reported (large value types are reported via the GCRefMap path when one is available; otherwise their interior refs are not visible to this scan).
-
-The slot address is computed using the same formula as the GCRefMap path:
-
-```csharp
-slotAddress = transitionBlockPtr + FirstGCRefMapSlot + (position * pointerSize);
-```
+`RecordDeferredFrame` (on `GcScanContext`) appends a sentinel `StackRefData` entry with `Flags = GcScanFlags.CDAC_DEFERRED_FRAME (0x40000000)` and `Source = frameAddress`. The sentinel has no real GC ref payload; downstream consumers (e.g. the cDAC stress harness in `src/coreclr/vm/cdacstress.cpp`) can detect it and treat the missing refs at that frame as expected gaps rather than cDAC bugs. See [tests/StressTests/known-issues.md](../../../src/native/managed/cdac/tests/StressTests/known-issues.md) for the stress framework's handling and the tracking work to re-enable the scan.
 
-#### Limitations vs. Native
+The `GcSignatureTypeProvider` class remains in the tree as the scaffolding the eventual port will use; it has no callers while `PromoteCallerStack` is stubbed.
 
-This signature-based scan has known gaps relative to native see [dotnet/runtime#127765](https://github.com/dotnet/runtime/issues/127765) for tracking.
+Tracking work to re-enable the scan: it requires porting `ArgIterator` behind an `ICallingConvention` contract. Once that lands, `PromoteCallerStack` will fan out into the signature-decoding algorithm (reserved-slot computation, signature walk, slot reporting) that mirrors the native version. See also [dotnet/runtime#127765](https://github.com/dotnet/runtime/issues/127765).
 
 ### GCRefMap Format and Resolution