Func-eval ref struct result: ExternalMemoryHandle doesn't keep a collectible LoaderAllocator alive (access violation in GC after unload) #135252

using System;
using System.Diagnostics;
using System.Reflection;
using System.Reflection.Emit;
using System.Runtime.CompilerServices;

// A ref struct defined in a NON-collectible assembly. When it is closed over a collectible type argument, the
// closed type's MethodTable is allocated in that collectible type's LoaderAllocator.
public ref struct View<T>
{
    public ref int Number;
}

public static class Producer
{
    private static readonly int[] s_numbers = { 10, 20, 30 };

    // The method that the debugger func-evals. It returns a ref struct, so the runtime stores the result in
    // debugger-owned external memory that is registered with the GC through an ExternalMemoryHandle.
    public static View<T> Create<T>()
    {
        View<T> view = default;
        view.Number = ref s_numbers[1];
        return view;
    }
}

public static class Program
{
    private static void Log(string message) => Console.WriteLine($"[debuggee {Environment.ProcessId}] {message}");

    [MethodImpl(MethodImplOptions.NoInlining)]
    private static Type CreateCollectibleType()
    {
        AssemblyBuilder assembly = AssemblyBuilder.DefineDynamicAssembly(
            new AssemblyName("CollectibleAssembly"), AssemblyBuilderAccess.RunAndCollect);
        ModuleBuilder module = assembly.DefineDynamicModule("CollectibleAssembly");
        return module.DefineType("CollectiblePayload", TypeAttributes.Public | TypeAttributes.Class).CreateType();
    }

    [MethodImpl(MethodImplOptions.NoInlining)]
    private static void Pause()
    {
        Log("break: the debugger now func-evals Producer.Create<CollectiblePayload>() and keeps the returned value");
        Debugger.Break();
    }

    // Every reference to the collectible assembly lives only in this frame, which has returned by the time
    // the garbage collections in Main run.
    [MethodImpl(MethodImplOptions.NoInlining)]
    private static WeakReference RunEvaluation()
    {
        Type payload = CreateCollectibleType();
        var weak = new WeakReference(payload);
        Pause();
        GC.KeepAlive(payload);
        return weak;
    }

    public static int Main()
    {
        WeakReference collectibleType = RunEvaluation();

        Log("the debugger resumed the process; nothing in the debuggee references the collectible assembly any more");
        for (int i = 0; i < 10; i++)
        {
            Log($"before GC #{i}: collectible type alive = {collectibleType.IsAlive}");
            GC.Collect();
            GC.WaitForPendingFinalizers();
        }

        Log($"SURVIVED: all collections completed; collectible type alive = {collectibleType.IsAlive}");
        return 0;
    }
}

using System.Diagnostics;
using System.Runtime.InteropServices;
using ClrDebug;

// Minimal ICorDebug client for the repro:
//   1. launches <host> <Debuggee.dll> under the debugger (dbgshim),
//   2. remembers the ICorDebugClass of CollectiblePayload (LoadClass callback),
//   3. at Debugger.Break() func-evals Producer.Create<CollectiblePayload>() (returns a ref struct, so the
//      runtime keeps the result in external memory that it registers with the GC),
//   4. KEEPS the returned ICorDebugValue alive, so the debuggee-side external memory handle stays registered,
//   5. continues; the debuggee unloads the collectible assembly and forces more garbage collections.
internal static class Program
{
    private static readonly Stopwatch s_clock = Stopwatch.StartNew();
    private static readonly List<object> s_keepAlive = new();
    private static readonly ManualResetEventSlim s_processExited = new(false);
    private static readonly object s_logGate = new();

    private static PSTARTUP_CALLBACK? s_startupCallback;
    private static Process? s_debuggee;
    private static CorDebugModule? s_debuggeeModule;
    private static CorDebugClass? s_payloadClass;
    private static bool s_evalStarted;
    private static int s_unloadNotifications;
    private static string? s_failure;

    [DllImport("kernel32.dll")]
    private static extern uint SetErrorMode(uint mode);

    private static void Log(string message)
    {
        lock (s_logGate)
        {
            Console.WriteLine($"[driver {s_clock.Elapsed.TotalSeconds,7:F2}s] {message}");
        }
    }

    private static string Safe(Func<object?> getter)
    {
        try
        {
            return getter()?.ToString() ?? "<null>";
        }
        catch (Exception ex)
        {
            return $"<{ex.GetType().Name}>";
        }
    }

    private static int Main(string[] args)
    {
        if (args.Length < 2)
        {
            Console.Error.WriteLine("usage: Driver <host-exe (corerun.exe or dotnet.exe)> <path-to-Debuggee.dll> [timeout-seconds]");
            return 2;
        }

        string hostExe = Path.GetFullPath(args[0]);
        string debuggeeDll = Path.GetFullPath(args[1]);
        int timeoutSeconds = args.Length > 2 ? int.Parse(args[2]) : 180;
        string dbgshimPath = Path.Combine(AppContext.BaseDirectory, "runtimes", "win-x64", "native", "dbgshim.dll");

        if (string.Equals(Path.GetFileName(hostExe), "corerun.exe", StringComparison.OrdinalIgnoreCase))
        {
            Environment.SetEnvironmentVariable("CORE_ROOT", Path.GetDirectoryName(hostExe));
        }

        // The debuggee inherits the error mode: a crash must not block on a Windows Error Reporting dialog.
        SetErrorMode(0x0001 | 0x0002);

        var dbgshim = new DbgShim(NativeLibrary.Load(dbgshimPath));
        string commandLine = $"\"{hostExe}\" \"{debuggeeDll}\"";
        Log($"launching: {commandLine}");
        CreateProcessForLaunchResult launch = dbgshim.CreateProcessForLaunch(
            commandLine, true, IntPtr.Zero, Path.GetDirectoryName(debuggeeDll));
        s_debuggee = Process.GetProcessById(launch.ProcessId);
        _ = s_debuggee.Handle; // open a handle now so the exit code remains available

        var callback = new CorDebugManagedCallback();
        callback.OnAnyEvent += (_, e) =>
        {
            // ClrDebug never resumes the process by itself: every callback must end with Continue.
            if (e.Kind != CorDebugManagedCallbackKind.ExitProcess && e.Continue)
            {
                try
                {
                    e.Controller.Continue(false);
                }
                catch (Exception ex)
                {
                    Log($"Continue failed after {e.Kind}: {ex.Message}");
                }
            }
        };
        callback.OnLoadModule += (_, e) =>
        {
            string name = Safe(() => e.Module.Name);
            if (name.EndsWith("Debuggee.dll", StringComparison.OrdinalIgnoreCase))
            {
                s_debuggeeModule = e.Module;
                Log($"callback: LoadModule {name}");
            }
            else if (name == "CollectibleAssembly")
            {
                Log($"callback: LoadModule {name} (dynamic, collectible)");
            }
        };
        callback.OnLoadClass += (_, e) =>
        {
            if (Safe(() => e.C.Module.Name) == "CollectibleAssembly")
            {
                s_payloadClass = e.C;
                Log("callback: LoadClass CollectiblePayload");
            }
        };
        callback.OnBreak += OnBreak;
        callback.OnEvalComplete += OnEvalComplete;
        callback.OnEvalException += OnEvalException;
        callback.OnUnloadModule += (_, e) =>
        {
            s_unloadNotifications++;
            Log($"callback: UnloadModule {Safe(() => e.Module.Name)}   <-- the collectible assembly was unloaded");
        };
        callback.OnUnloadClass += (_, _) => Log("callback: UnloadClass");
        callback.OnExitProcess += (_, _) =>
        {
            Log("callback: ExitProcess");
            s_processExited.Set();
        };

        s_startupCallback = (pCordb, _, hr) =>
        {
            try
            {
                if (hr != HRESULT.S_OK)
                {
                    s_failure = $"runtime startup callback reported {hr}";
                    s_processExited.Set();
                    return;
                }

                var corDebug = new CorDebug((ICorDebug)Marshal.GetObjectForIUnknown(pCordb));
                corDebug.Initialize();
                corDebug.SetManagedHandler(callback);
                CorDebugProcess process = corDebug.DebugActiveProcess(launch.ProcessId, false);
                s_keepAlive.Add(corDebug);
                s_keepAlive.Add(process);
                Log("attached to the runtime");
            }
            catch (Exception ex)
            {
                s_failure = $"attach failed: {ex}";
                s_processExited.Set();
            }
        };

        IntPtr unregisterToken = dbgshim.RegisterForRuntimeStartup(launch.ProcessId, s_startupCallback, IntPtr.Zero);
        dbgshim.ResumeProcess(launch.ResumeHandle);
        dbgshim.CloseResumeHandle(launch.ResumeHandle);

        if (!s_processExited.Wait(TimeSpan.FromSeconds(timeoutSeconds)))
        {
            Log($"TIMEOUT after {timeoutSeconds}s; killing the debuggee");
            s_debuggee.Kill(true);
        }

        s_debuggee.WaitForExit(30_000);
        dbgshim.UnregisterForRuntimeStartup(unregisterToken);

        uint exitCode = unchecked((uint)s_debuggee.ExitCode);
        Log($"unload notifications seen: {s_unloadNotifications}");
        Log($"debuggee exit code: 0x{exitCode:X8}{(exitCode == 0xC0000005 ? " (STATUS_ACCESS_VIOLATION)" : string.Empty)}");
        if (s_failure is not null)
        {
            Log($"FAILURE: {s_failure}");
            return 3;
        }

        return exitCode == 0 ? 0 : 1;
    }

    private static void Fail(string what, Exception ex)
    {
        s_failure = $"{what}: {ex}";
        Log($"FAILURE: {s_failure}");
        try
        {
            s_debuggee?.Kill(true);
        }
        catch
        {
        }
    }

    private static void OnBreak(object? sender, BreakCorDebugManagedCallbackEventArgs e)
    {
        if (s_evalStarted)
        {
            return;
        }

        s_evalStarted = true;
        if (Environment.GetEnvironmentVariable("REPRO_SKIP_EVAL") == "1")
        {
            Log("break: REPRO_SKIP_EVAL=1, not evaluating anything (control run)");
            return;
        }

        try
        {
            CorDebugModule module = s_debuggeeModule ?? throw new InvalidOperationException("Debuggee.dll was not seen");
            CorDebugClass payloadClass = s_payloadClass ?? throw new InvalidOperationException("CollectiblePayload was not seen");

            // Resolve Producer.Create through metadata.
            MetaDataImport import = module.GetMetaDataInterface<MetaDataImport>();
            mdTypeDef producer = import.FindTypeDefByName("Producer", mdToken.Nil);
            mdMethodDef method = import.FindMethod(producer, "Create", IntPtr.Zero, 0);
            CorDebugFunction function = module.GetFunctionFromToken(method);

            // ICorDebugType for the collectible class: the type argument of the generic method.
            CorDebugType payloadType = payloadClass.GetParameterizedType(CorElementType.Class, 0, Array.Empty<ICorDebugType>());

            CorDebugEval eval = e.Thread.CreateEval();
            eval.CallParameterizedFunction(function.Raw, 1, new[] { payloadType.Raw }, 0, Array.Empty<ICorDebugValue>());
            s_keepAlive.Add(eval);
            Log("break: started the func-eval of Producer.Create<CollectiblePayload>()");
        }
        catch (Exception ex)
        {
            Fail("break handler", ex);
        }
    }

    private static void OnEvalComplete(object? sender, EvalCompleteCorDebugManagedCallbackEventArgs e)
    {
        try
        {
            CorDebugValue result = e.Eval.Result;
            Log($"func-eval complete: result element type {result.Type}, size {result.Size}, " +
                $"address {Safe(() => result.Address)}, wrapper {result.GetType().Name}");

            if (Environment.GetEnvironmentVariable("REPRO_RELEASE_RESULT") == "1")
            {
                // Control: do not retain anything, so the right side can dispose the external memory owner.
                Marshal.FinalReleaseComObject(result.Raw);
                Marshal.FinalReleaseComObject(e.Eval.Raw);
                Log("control: released the result value and the eval; the debugger no longer owns the external memory");
                return;
            }

            // Retain the value (and the eval): the debugger still owns the debuggee-side external memory.
            s_keepAlive.Add(e.Eval);
            s_keepAlive.Add(result);
            Log("the debugger retains the result value and resumes the debuggee");
        }
        catch (Exception ex)
        {
            Fail("GetResult", ex);
        }
    }

    private static void OnEvalException(object? sender, EvalExceptionCorDebugManagedCallbackEventArgs e)
    {
        Log("callback: EvalException (the func-eval threw)");
        s_failure = "the func-eval threw";
    }
}