Test failure in RunReflectionScenario_UnsafeRead

[JulieLeeMSFT]

Failed in runtime-coreclr gcstress-extra/20250312.1

coreclr linux x64 Checked gcstress0xc_jitstress2 @ azurelinux.3.amd64.open
coreclr windows x86 Checked gcstress0xc_jitstress2 @ Windows.10.Amd64.Open

Beginning scenario: RunReflectionScenario_UnsafeRead

Assert failure(PID 1816 [0x00000718], Thread: 3180 [0x0c6c]): SanityCheck()

CORECLR! MethodTable::Validate + 0x31 (0x71b7836c)
CORECLR! Object::ValidateInner + 0x12D (0x71b830ed)
CORECLR! Object::Validate + 0x98 (0x71b82f78)
CORECLR! WKS::GCHeap::Promote + 0x8F (0x71ea9f4f)
CORECLR! PromoteCarefully + 0x7B (0x71bc0a9b)
CORECLR! GcEnumObject + 0x63 (0x71c9bbd3)
CORECLR! EnumGcRefsX86 + 0x125A (0x71aabd9a)
CORECLR! EECodeManager::EnumGcRefs + 0x114 (0x71aaaaf4)
CORECLR! GcStackCrawlCallBack + 0x129 (0x71c9be19)
CORECLR! Thread::MakeStackwalkerCallback + 0x48 (0x71bc2beb)
    File: D:\a\_work\1\s\src\coreclr\vm\methodtable.cpp:8502
    Image: C:\h\w\A16A0907\p\corerun.exe

App Exit Code: -1073740286
Expected: 100
Actual: -1073740286
END EXECUTION - FAILED

Beginning scenario: RunReflectionScenario_UnsafeRead
[createdump] Gathering state for process 5349 corerun
[createdump] Crashing thread 14e5 signal 11 (000b)
[createdump] Writing crash report to file /home/helixbot/dotnetbuild/dumps/coredump.5349.dmp.crashreport.json
[createdump] Crash report successfully written
[createdump] Writing minidump with heap to file /home/helixbot/dotnetbuild/dumps/coredump.5349.dmp
[createdump] Written 187011072 bytes (45657 pages) to core file
[createdump] Target process is alive
[createdump] Dump successfully written in 749ms
waitpid() returned successfully (wstatus 00000000) WEXITSTATUS 0 WTERMSIG 0
App Exit Code: 22
Expected: 100
Actual: 22
END EXECUTION - FAILED
+ test_exit_code=1
+ /datadisks/disk1/work/AB240976/p/XUnitLogChecker --results-path JIT/HardwareIntrinsics/HardwareIntrinsics_General_ro --test-wrapper HardwareIntrinsics_General_ro --dumps-path /home/helixbot/dotnetbuild/dumps

[JulieLeeMSFT]

@kunalspathak, PTAL.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[EgorBo]

Possibly, similar gc hole/buffer overrun as #113113

[kunalspathak]

Possibly, similar gc hole/buffer overrun as #113113

That's what I thought, but this seems to be coming from old tests, so wondering if this is actual gc hole rather than buffer overrun.

_Vector64_ro::JIT.HardwareIntrinsics.General._Vector64.Program.AbsUInt16()

[kunalspathak]

This is very odd and corner case scenario. We have a loop after epilog (with stress block layout, we might have something like that). If there are IGs after epilog, the epilog creates additional dummy IG to store GC state in it. However, when we create an actual IG after this dummy IG, the GC state information is lost, because we saved it on dummy IG. The fix would be to force store the GC state on all IGs until we come across a valid labelled IG.

In the example above, although V73 is not live, it was thought to be live and holding gc reference. V73 is spilled on stack and when GC scanned the slot on stack for V73 it was hitting invalid object error message.