Test failure: Regressions/coreclr/GitHub_89834/test89834/test89834.cmd #135404

Activity

1. VincentBu

   added

   blocking-clean-ci-optionalBlocking optional rolling runsBlocking optional rolling runs

   Known Build ErrorUse this to report build issues in the .NET Helix tabUse this to report build issues in the .NET Helix tab

   on Oct 8, 2026
2. dotnet-policy-service

   added

   untriagedNew issue has not been triaged by the area ownerNew issue has not been triaged by the area owner

   on Oct 8, 2026
3. github-actions

   added

   area-VM-coreclr

   on Oct 8, 2026
4. github-project-automation

   added this to AppModelon Oct 8, 2026
5. dotnet-policy-service commented on Oct 8, 2026

   

   dotnet-policy-servicebot

   on Oct 8, 2026 – with Dotnet Policy Service

   Contributor

   More actions

   Tagging subscribers to this area: @agocke
   See info in area-owners.md if you want to be subscribed.
6. jkotas

   added

   arch-arm64

   on Oct 8, 2026
7. agocke

   assigned

   Copilot

   and

   agocke

   on Oct 9, 2026
8. Copilot

   linked a pull request that will close this issueInvestigate test89834 SIGBUS on macOS ARM64 #135547on Oct 9, 2026
9. agocke commented on Oct 11, 2026

   

   agocke

   on Oct 11, 2026

   Member

   More actions

   I downloaded the macOS ARM64 dump and analyzed it with the exact matching CoreCLR native symbols. The evidence points to a GC hole in CORINFO_HELP_BULK_WRITEBARRIER_SMALL: the helper is classified as non-GC, but its first call can enter the prestub and trigger a collection.

   This helper was introduced by #134345. The same helper/prestub hole is explicitly listed as not fixed in #135415; this dump shows its ARM64 failure mechanism.

   Evidence from the dump and in-memory stress log

   1. AsyncTaskMethodBuilder<int>.GetStateMachineBox<test89834.<Main>d__0> copies the 40-byte state machine using the small bulk-write-barrier helper. I decoded this method's version-5 GC info: it has 28 safepoints, but no safepoint at the bulk-copy return address 0x10eaba664 (method offset 0x204).

   2. The call goes through a jump stub at 0x10ea80370 to the precode at 0x1050b3990. The precode belongs to System.Buffer.BulkMoveWithWriteBarrierInternal; the dynamic-helper table also contains that precode address.

   3. The stress log records full compacting GC 10815 while this FCall's prestub frame is active, with GetStateMachineBox suspended at 0x10eaba664. The box moves from 0x7002400040 to 0x7002077118. The destination interior pointer and the state machine's stack reference are relocated correctly, but the caller's live box reference in X22 is not reported.

   4. After returning, the caller immediately executes:

      0x10eaba664: mov x0, x22
      ...
      0x10eaba678: blr x1       ; AsyncStateMachineBox.get_Context

      At the subsequent prestub, saved X22 and argument X0 both contain the old box address, 0x7002400040, while the stack reference at 0x16ae317c8 correctly contains 0x7002077118.

   5. GC 10816 then attempts to relocate that stale reference. relocate_address follows the brick-table entries into an invalid tree at 0x70023fefff, and node_right_child faults reading 0x70023feff1. The actual fault is SIGBUS, at 0x10a583f14:

      ldursh x28, [x27, #-0xe]

   The relocate_address / tree_search crash is therefore the consequence of the stale root, rather than evidence of an independent GC tree-maintenance bug.

   Source-level mechanism

   At the crashing commit, 30f813606aed8f64dbb3e296dba3f99a7c77590f:

   • utils.cpp classifies CORINFO_HELP_BULK_WRITEBARRIER_SMALL as isNoGC = true.
   • jithelpers.h registers it as a dynamic helper backed by METHOD__BUFFER__MEMCOPYGC_SMALL (BulkMoveWithWriteBarrierInternal).
   • LoadDynamicJitHelper resolves the helper using pMD->GetMultiCallableAddrOfCode().
   • For FCalls, TryGetMultiCallableAddrOfCode returns the stable entrypoint, allowing the first call to enter the collecting prestub instead of directly calling the native worker.

   A fix needs to ensure that the no-GC helper resolves directly to the native worker without a collecting prestub transition, or revert the small-copy optimization. This is dump/stress-log/source analysis; I have not reproduced the failure or validated a fix.

   Note

   This analysis and comment were generated with GitHub Copilot.