Test failure: CoreMangLib/system/delegate/VSD/OpenDelegate/OpenDelegate.cmd

[SakeTao]

Failed in: runtime-coreclr gcstress-extra 20251214.1

Failed tests:

coreclr windows x64 Checked gcstress0xc_disabler2r_jitstress2 @ Windows.10.Amd64.Open
    - CoreMangLib/system/delegate/VSD/OpenDelegate/OpenDelegate.cmd

Error message:

Fatal error.
0xC0000005
   at System.RuntimeMethodHandle.InvokeMethod(System.Runtime.CompilerServices.ObjectHandleOnStack, Void**, System.Runtime.CompilerServices.ObjectHandleOnStack, BOOL, System.Runtime.CompilerServices.ObjectHandleOnStack)
   at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(System.Object, IntPtr*)
   at System.Reflection.MethodBaseInvoker.InvokeDirectByRefWithFewArgs(System.Object, System.Span`1<System.Object>, System.Reflection.BindingFlags)
   at System.Reflection.MethodBaseInvoker.InvokeWithOneArg(System.Object, System.Reflection.BindingFlags, System.Reflection.Binder, System.Object[], System.Globalization.CultureInfo)
   at System.Reflection.RuntimeMethodInfo.Invoke(System.Object, System.Reflection.BindingFlags, System.Reflection.Binder, System.Object[], System.Globalization.CultureInfo)
   at System.Delegate.DynamicInvokeImpl(System.Object[])
   at Program.TestEntryPoint()
   at __GeneratedMainWrapper.Main()

Return code:      1
Raw output file:      C:hwA3B90973wA7B7097BuploadssystemdelegateVSDOpenDelegateoutput.txt
Raw output:
BEGIN EXECUTION
 "C:hwA3B90973pcorerun.exe" -p "System.Reflection.Metadata.MetadataUpdater.IsSupported=false" -p "System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization=true"  OpenDelegate.dll 
Expected: 100
Actual: -1073741819
END EXECUTION - FAILED
FAILED
Test failed. Trying to see if dump file was created in C:cores since 12/14/2025 10:43:54 PM
Processing C:corescorerun.exe.3780.dmp
Invoking: C:Program Files (x86)Windows Kits10Debuggersdcdb.exe -c "$<C:hwA3B90973		mpunjqon.tmp" -z "C:corescorerun.exe.3780.dmp"
stdout: 
Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:corescorerun.exe.3780.dmp]
User Mini Dump File with Full Memory: Only application data is available


************* Path validation summary **************
Response                         Time (ms)     Location
OK                                             C:hwA3B90973pPDB
Symbol search path is: C:hwA3B90973pPDB
Executable search path is: 
Windows 10 Version 14393 MP (4 procs) Free x64
Product: Server, suite: TerminalServer DataCenter SingleUserTS
10.0.14393.6343 (rs1_release.230913-1727)
Machine Name:
Debug session time: Sun Dec 14 22:44:00.000 2025 (UTC + 0:00)
System Uptime: 0 days 0:04:54.360
Process Uptime: 0 days 0:00:06.000
.............................

************* Symbol Loading Error Summary **************
Module name            Error
ntdll                  The system cannot find the file specified

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(ec4.a3c): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
*** WARNING: Unable to verify checksum for coreclr.dll
KERNELBASE!RaiseFailFastException+0xae:
00007ffa`ed90a0be 803d7d6e120000  cmp     byte ptr [KERNELBASE!local_unwind+0x7452 (00007ffa`eda30f42)],0 ds:00007ffa`eda30f42=00
0:000> cdb: Reading initial command '$<C:hwA3B90973		mpunjqon.tmp'
0:000> .cordll -lp "C:hwA3B90973p"
The call to LoadLibrary(sos) failed, Win32 error 0n2
    "The system cannot find the file specified."
Please check your debugger configuration and/or network access.
CLR DLL status: Loaded DLL C:hwA3B90973pmscordaccore.dll
0:000> .load C:Users
unner.dotnetsossos.dll
0:000> ~*k

.  0  Id: ec4.a3c Suspend: 0 Teb: 000000b7`49feb000 Unfrozen
Child-SP          RetAddr           Call Site
000000b7`4a17a370 00007ffa`cafabcd9 KERNELBASE!RaiseFailFastException+0xae
000000b7`4a17a940 00007ffa`cb24972e coreclr!WatsonLastChance+0x3e9
000000b7`4a17aae0 00007ffa`cb2483de coreclr!EEPolicy::LogFatalError+0x9be
00

Stack trace:

   at Xunit.Assert.True(Nullable`1 condition, String userMessage) in /_/src/arcade/src/Microsoft.DotNet.XUnitAssert/src/BooleanAsserts.cs:line 141
   at TestLibrary.OutOfProcessTest.RunOutOfProcessTest(String assemblyPath, String testPathPrefix)
   at Program.<<Main>$>g__TestExecutor31|0_32(StreamWriter tempLogSw, StreamWriter statsCsvSw, <>c__DisplayClass0_0&)

[jkotas]

Actual stacktrace of the crash:

 # Child-SP          RetAddr               Call Site
00 000000b7`4a17d478 00007ffa`cb602fc3     0x0
01 000000b7`4a17d480 00007ffa`cb3e304a     coreclr!CallDescrWorkerInternal+0x83 [D:\a\_work\1\s\src\coreclr\vm\amd64\CallDescrWorkerAMD64.asm @ 74] 
02 000000b7`4a17d4c0 00007ffa`6bc185b9     coreclr!RuntimeMethodHandle_InvokeMethod+0xcfa [D:\a\_work\1\s\src\coreclr\vm\reflectioninvocation.cpp @ 602] 

[jkotas]

This looks like a bad GCInfo generated by the JIT.

Disassembly of ILStubClass.IL_STUB_Delegate_Invoke(ClassA):

00007ffa`6c0f0200 4883ec38        sub     rsp,38h
00007ffa`6c0f0204 48b878563412f0debc9a mov rax,9ABCDEF012345678h
00007ffa`6c0f020e 4889442430      mov     qword ptr [rsp+30h],rax
00007ffa`6c0f0213 488bc2          mov     rax,rdx
00007ffa`6c0f0216 488bd1          mov     rdx,rcx
00007ffa`6c0f0219 488bc8          mov     rcx,rax
0000001c interruptible
0000001c +rdx +rcx
00007ffa`6c0f021c 488bc2          mov     rax,rdx
0000001f +rax
00007ffa`6c0f021f 488bd1          mov     rdx,rcx
00007ffa`6c0f0222 488b4808        mov     rcx,qword ptr [rax+8]
00007ffa`6c0f0226 49ba78563412f0debc9a mov r10,9ABCDEF012345678h
00007ffa`6c0f0230 4c39542430      cmp     qword ptr [rsp+30h],r10
00007ffa`6c0f0235 7405            je      00007ffa`6c0f023c
....
0000003c -rax
00007ffa`6c0f023c 90              nop
00007ffa`6c0f023d 4883c438        add     rsp,38h
00000041 not interruptible
00000041 -rdx -rcx
00007ffa`6c0f0241 48ff6018        jmp     qword ptr [rax+18h]

Notice that we stop tracking rax at offset 3c, execute a few instruction, and then jmp indirect via rax. If the GC happens at the nop at offset 0x3c and moves the object reference in rax, the jump will jump to a bogus address.