DoStackSnapshot fails on .NET 10 when invoked from ELT hook

[acizmarik]

Description

While implementing new feature for profiler I noticed a bug - DoStackSnapshot works within ELT hook for .NET 8 and .NET 9 but fails on .NET 10 with E_FAIL (0x80004005)

Reproduction Steps

1. Profiler with ELT hooks that calls DoStackSnapshot
2. Run profiler with program whose TargetFramework is set to net8.0 and net9.0 - this should work fine
3. Run profiler with program whose TargetFramework is set to net10.0 - this fails

Expected behavior

It should work on .NET 10 in the same way as for previous versions

Actual behavior

Fails for .NET 10, works for previous versions

Regression?

Yes

Known Workarounds

I made a quick test to unwind the native top frame using _Unwind_Backtrace. After that the DoStackSnapshot succeeds

Configuration

• .NET:

8.0.128 [/usr/lib/dotnet/sdk]
9.0.118 [/usr/lib/dotnet/sdk]
10.0.109 [/usr/lib/dotnet/sdk]

• OS

Linux version 6.17.0-40-generic (buildd@lcy02-amd64-101) (x86_64-linux-gnu-gcc (Ubuntu 15.2.0-4ubuntu4) 15.2.0, GNU ld (GNU Binutils for Ubuntu) 2.45) #40-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 19 16:42:13 UTC 2026

• Architecture
  • x64
  • Though I don't think that these things are specific to my configuration / environment

Other information

I believe that this issue originates here: #107152. I am aware of the announced change that some APIs that were previously unsafe to call from hooks now return CORPROF_E_UNSUPPORTED_CALL_SEQUENCE. But I believe the issue I described here is different

[dotnet-policy-service]

Tagging subscribers to this area: @steveisok, @tommcdon, @dotnet/dotnet-diag
See info in area-owners.md if you want to be subscribed.

[steveisok]

Failure: DoStackSnapshot from an ELT hook returns E_FAIL (0x80004005) on .NET 10 (works on 8/9, Linux x64). The E_FAIL is SWA_FAILED from StackWalkFrames, mapped at proftoeeinterfaceimpl.cpp:8440-8441.

Suspected Root cause: PR #107152 ("Remove helper method frame from Profiler hooks", commit 5e560d9) deleted the HELPER_METHOD_FRAME_BEGIN_ATTRIB_NOPOLL(FRAME_ATTR_CAPTURE_DEPTH_2) transition frame from ProfileEnter/Leave/Tailcall. That frame captured the managed caller's context and served as the seed for the profiler stackwalk. Without it, a cooperative-mode hook leaves pctxSeed NULL, so the walk starts in native profiler code and can't reach managed frames → SWA_FAILED. Confirmed: commit is in release/10.0 + main, absent from release/9.0 and release/8.0