[Interpreter] Install the resume-after-catch handler in ThrowControlForThread

src/coreclr/interpreter/compiler.cpp

@@ -3222,9 +3222,12 @@ void InterpCompiler::EmitLeave(int32_t ilOffset, int32_t target)
         NO_WAY("Leave target basic block does not exist");
     }
 
-    // The leave doesn't jump out of any try region with finally, so we can just emit a branch
-    // to the target.
-    EmitBranchToBB(INTOP_BR, pTargetBB);
+    // When the first island is a catch leave island, the leave exits that catch here: INTOP_LEAVE_CATCH ends the
+    // catch funclet and the execution resumes after the catch at the island. The island is outside the catch's own
+    // try region and inside every try region that encloses it, so a thread abort raised again at the resume point
+    // reaches the handlers of the enclosing try regions. Otherwise, emit a plain branch to the island or the target.
+    bool isCatchLeave = pTargetBB->isLeaveChainIsland && !pTargetBB->isFinallyCallIsland;
+    EmitBranchToBB(isCatchLeave ? INTOP_LEAVE_CATCH : INTOP_BR, pTargetBB);
 }
 
 void InterpCompiler::EmitBinaryArithmeticOp(int32_t opBase)
@@ -11971,18 +11974,21 @@ InterpBasicBlock *InterpCompiler::GenerateCodeForLeaveChainIslands(InterpBasicBl
                 m_pLastNewIns->ilOffset = -1;
             }
 
-            InterpOpcode branchOpcode = pLeaveChainIslandBB->isFinallyCallIsland ? INTOP_BR : INTOP_LEAVE_CATCH;
+            // A catch leave island is where the execution resumes after its catch, which ends with the
+            // INTOP_LEAVE_CATCH to the island. So the branch out of an island is a plain INTOP_BR, unless it goes
+            // into the catch leave island of an outer catch that the leave also exits.
 
             // Try to get the next finally call (for an outer try's finally) / catch leave island block (for an outer catch)
             if (pLeaveChainIslandBB->pLeaveChainIslandBB)
             {
-                // Branch to the next finally call island (at an outer try block)
-                EmitBranchToBB(branchOpcode, pLeaveChainIslandBB->pLeaveChainIslandBB);
+                // Branch to the next finally call island (at an outer try block) / catch leave island (for an outer catch)
+                InterpBasicBlock *pNextIslandBB = pLeaveChainIslandBB->pLeaveChainIslandBB;
+                EmitBranchToBB(pNextIslandBB->isFinallyCallIsland ? INTOP_BR : INTOP_LEAVE_CATCH, pNextIslandBB);
             }
             else
             {
                 // This is the last finally call / catch leave island, so we need to emit a branch to the leave target
-                EmitBranchToBB(branchOpcode, pLeaveChainIslandBB->pLeaveTargetBB);
+                EmitBranchToBB(INTOP_BR, pLeaveChainIslandBB->pLeaveTargetBB);
             }
             m_pLastNewIns->ilOffset = -1;
             m_pCBB->emitState = BBStateEmitted;

src/coreclr/vm/exceptionhandling.cpp

@@ -1457,12 +1457,14 @@ BOOL HandleHardwareException(PAL_SEHException* ex)
 #if defined(FEATURE_INTERPRETER) && !defined(HOST_WASM)
 
 // The ssp argument needs to match the pContext (SSP register value at that context)
-VOID DECLSPEC_NORETURN RethrowResumeAfterCatchExceptionSkipManagedFrames(const ResumeAfterCatchException& ex, CONTEXT *pContext, TADDR ssp)
+// isInterruptedContext: the context is where a thread was interrupted and redirected, not a call site. No shadow stack slot
+// holds its instruction pointer and the ssp is the precise value already.
+VOID DECLSPEC_NORETURN RethrowResumeAfterCatchExceptionSkipManagedFrames(const ResumeAfterCatchException& ex, CONTEXT *pContext, TADDR ssp, bool isInterruptedContext)
 {
 #if defined(HOST_AMD64) && defined(HOST_WINDOWS)
     // Find precise SSP value. We cannot use the instruction pointer from the context here because for PInvoke frames it points to the return address
     // of the JIT_PInvokeBegin call that is called before the actual target function.
-    if (ssp != 0)
+    if (ssp != 0 && !isInterruptedContext)
     {
         while (!ExecutionManager::IsManagedCode(*(PCODE*)(ssp - 8)))
         {

src/coreclr/vm/exceptionhandling.h

@@ -85,7 +85,7 @@ class ResumeAfterCatchException
 };
 
 #ifndef HOST_WASM
-VOID DECLSPEC_NORETURN RethrowResumeAfterCatchExceptionSkipManagedFrames(const ResumeAfterCatchException& ex, CONTEXT *pContext, TADDR ssp);
+VOID DECLSPEC_NORETURN RethrowResumeAfterCatchExceptionSkipManagedFrames(const ResumeAfterCatchException& ex, CONTEXT *pContext, TADDR ssp, bool isInterruptedContext = false);
 #endif // HOST_WASM
 
 #endif // FEATURE_INTERPRETER

src/coreclr/vm/exceptmacros.h

@@ -232,10 +232,21 @@ VOID DECLSPEC_NORETURN RethrowResumeAfterCatchException(const ResumeAfterCatchEx
 #define INSTALL_RESUME_AFTER_CATCH_HANDLER_WITH_CONTEXT(pContext, ssp) \
         CONTEXT *__pResumeAfterCatchContext = pContext;                \
         TADDR __pResumeAfterCatchSSP = ssp;                            \
+        bool __resumeAfterCatchContextIsInterrupted = false;           \
         TADDR __resumeSP = 0, __resumeIP = 0;                          \
         try                                                            \
         {
 
+// The same for a context where the thread was interrupted and redirected rather than one at a call site.
+// The ssp is the SSP register value at that context.
+#define INSTALL_RESUME_AFTER_CATCH_HANDLER_WITH_INTERRUPTED_CONTEXT(pContext, ssp) \
+        CONTEXT *__pResumeAfterCatchContext = pContext;                            \
+        TADDR __pResumeAfterCatchSSP = ssp;                                        \
+        bool __resumeAfterCatchContextIsInterrupted = true;                        \
+        TADDR __resumeSP = 0, __resumeIP = 0;                                      \
+        try                                                                        \
+        {
+
 #define INSTALL_RESUME_AFTER_CATCH_HANDLER_WITH_FRAME(pFrame) \
         Frame *__pResumeAfterCatchFrame = pFrame;             \
         TADDR __pResumeAfterCatchSSP = READ_SSP();            \
@@ -254,7 +265,8 @@ VOID DECLSPEC_NORETURN RethrowResumeAfterCatchException(const ResumeAfterCatchEx
         if (__resumeSP != 0)                                                                                           \
         {                                                                                                              \
             ResumeAfterCatchException ex(__resumeSP, __resumeIP);                                                      \
-            RethrowResumeAfterCatchExceptionSkipManagedFrames(ex, __pResumeAfterCatchContext, __pResumeAfterCatchSSP); \
+            RethrowResumeAfterCatchExceptionSkipManagedFrames(ex, __pResumeAfterCatchContext, __pResumeAfterCatchSSP,  \
+                                                              __resumeAfterCatchContextIsInterrupted);                 \
         }
 
 
@@ -275,6 +287,7 @@ VOID DECLSPEC_NORETURN RethrowResumeAfterCatchException(const ResumeAfterCatchEx
 #else // FEATURE_INTERPRETER && !HOST_WASM
 #define INSTALL_RESUME_AFTER_CATCH_HANDLER_WITH_FRAME(pFrame)
 #define INSTALL_RESUME_AFTER_CATCH_HANDLER_WITH_CONTEXT(pContext, ssp)
+#define INSTALL_RESUME_AFTER_CATCH_HANDLER_WITH_INTERRUPTED_CONTEXT(pContext, ssp)
 #define UNINSTALL_RESUME_AFTER_CATCH_HANDLER_WITH_FRAME
 #define UNINSTALL_RESUME_AFTER_CATCH_HANDLER_WITH_CONTEXT
 #endif // FEATURE_INTERPRETER && !HOST_WASM

src/coreclr/vm/interpexec.cpp

@@ -4980,8 +4980,12 @@ do                                                                      \
     }
     catch (const ResumeAfterCatchException& ex)
     {
-        GCX_COOP_NO_DTOR();
         ex.GetResumeContext(&resumeSP, &resumeIP);
+    }
+
+RESUME_AFTER_CATCH:
+    {
+        GCX_COOP_NO_DTOR();
         _ASSERTE(resumeSP != 0 && resumeIP != 0);
 
         InterpMethodContextFrame* pResumeFrame = (InterpMethodContextFrame*)resumeSP;
@@ -5017,16 +5021,43 @@ do                                                                      \
 
         pInterpreterFrame->SetIsFaulting(false);
 
-        void* abortAddress = COMPlusCheckForAbort(resumeIP);
-        if (abortAddress != NULL)
+        // If the thread is being aborted, the abort has to be raised again now that the catch handler is done, like
+        // EECodeManager::ResumeAfterCatch does for compiled code.
+
+        // Record the resume IP in the pFrame so that the exception handling unwinds from there
+        pFrame->ip = ip;
+
+        // COMPlusCheckForAbort expects Thread::m_OSContext to describe the place where the execution resumes. It
+        // uses that context to find out whether the thread can be aborted there.
+        pInterpreterFrame->SetContextToInterpMethodContextFrame(GetThread()->m_OSContext);
+
+        if (COMPlusCheckForAbort(resumeIP) == NULL)
         {
-            // Record the resume IP in the pFrame so that the exception handling unwinds from there
-            pFrame->ip = ip;
-            DispatchManagedException(kThreadAbortException);
+            goto MAIN_LOOP;
         }
+    }
 
-        goto MAIN_LOOP;
+    // Raise the abort again at the resume IP. It has a try block of its own: when a frame of this InterpExecMethod
+    // catches the abort, the ResumeAfterCatchException that resumes that frame is caught here.
+    try
+    {
+        INSTALL_MANAGED_EXCEPTION_DISPATCHER;
+        INSTALL_UNWIND_AND_CONTINUE_HANDLER;
+        // Look up the handlers at the resume IP itself, as INTOP_THROW does, rather than at the instruction before
+        // it, as for a return address. After a catch, the resume IP is the catch leave island, which is covered by the
+        // try regions that enclose the catch's try region and not by the catch's own try region.
+        pInterpreterFrame->SetIsFaulting(true);
+        DispatchManagedException(kThreadAbortException);
+        UNINSTALL_UNWIND_AND_CONTINUE_HANDLER;
+        UNINSTALL_MANAGED_EXCEPTION_DISPATCHER;
     }
+    catch (const ResumeAfterCatchException& ex)
+    {
+        ex.GetResumeContext(&resumeSP, &resumeIP);
+        goto RESUME_AFTER_CATCH;
+    }
+
+    UNREACHABLE();
 
 EXIT_FRAME:
     // Exit the current frame, MAKE CERTAIN not to trigger any GC between here and the return, since the interpreter

src/coreclr/vm/threadsuspend.cpp

@@ -3686,7 +3686,18 @@ ThrowControlForThread(
 
     OBJECTREF throwable = ExInfo::CreateThrowable(&exceptionRecord, TRUE);
     pfef->GetExceptionContext()->ContextFlags |= CONTEXT_EXCEPTION_ACTIVE;
+
+#if defined(TARGET_AMD64) && defined(TARGET_WINDOWS)
+    TADDR resumeSSP = ssp;
+#else
+    TADDR resumeSSP = 0;
+#endif
+
+    // The abort can be caught by an interpreted frame further up the stack. Resuming there unwinds the native frames
+    // with a ResumeAfterCatchException, which must not run into the managed frames this thread was redirected from.
+    INSTALL_RESUME_AFTER_CATCH_HANDLER_WITH_INTERRUPTED_CONTEXT(pfef->GetExceptionContext(), resumeSSP);
     DispatchManagedException(throwable, pfef->GetExceptionContext());
+    UNINSTALL_RESUME_AFTER_CATCH_HANDLER_WITH_CONTEXT;
 }
 
 #if defined(FEATURE_HIJACK) && !defined(TARGET_UNIX)

src/libraries/System.Runtime/tests/System.Runtime.Tests/System/Runtime/ControlledExecutionTests.cs

@@ -74,7 +74,7 @@ void Test()
 
         // Tests that an infinite loop may be aborted, that the ThreadAbortException is automatically rethrown,
         // and that it is eventually translated to an OperationCanceledException.
-//        [ConditionalFact(typeof(PlatformDetection), nameof(PlatformDetection.IsNotMonoRuntime), nameof(PlatformDetection.IsNotNativeAot))]
+        [ConditionalFact(typeof(PlatformDetection), nameof(PlatformDetection.IsNotMonoRuntime), nameof(PlatformDetection.IsNotNativeAot))]
         public void CancelInTryAndExitCatchNormally()
         {
             var cts = new CancellationTokenSource();
@@ -205,7 +205,7 @@ void Test()
         }
 
         // Tests cancellation by the action itself
-//        [ConditionalFact(typeof(PlatformDetection), nameof(PlatformDetection.IsNotMonoRuntime), nameof(PlatformDetection.IsNotNativeAot))]
+        [ConditionalFact(typeof(PlatformDetection), nameof(PlatformDetection.IsNotMonoRuntime), nameof(PlatformDetection.IsNotNativeAot))]
         public void CancelItselfOutsideOfTryCatchFinally()
         {
             var cts = new CancellationTokenSource();