Repository navigation
Accept a faulted frame in the shadow stack assert of CallCatchFunclet - #135531
Open
pcshrosbree wants to merge 2 commits into
Open
pcshrosbree wants to merge 2 commits into
pcshrosbree wants to merge 2 commits into
Conversation
A thread abort raised again at the end of a catch handler is thrown from ThrowControlForThread, which records the SSP of the frame the thread was redirected from. That frame was interrupted rather than stopped at a call, so the slot below its SSP does not hold its ControlPC, and the assert failed on Windows x64 with shadow stacks when the abort was caught in the same frame. The SSP itself is the right value to resume the frame with. Fixes dotnet#135530
dotnet-policy-service
Bot
added
the
community-contribution
|
Azure Pipelines: Successfully started running 3 pipeline(s). 13 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @agocke |
jkotas
reviewed
Oct 9, 2026
| @@ -0,0 +1,15 @@ | |||
| <Project Sdk="Microsoft.NET.Sdk"> | |||
Member
There was a problem hiding this comment.
This should be <CLRTestPriority>1</CLRTestPriority> test
It aborts a thread and is a niche case.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #135530.
On windows-x64 with shadow stacks, a Checked runtime asserts in
CallCatchFuncletwhen a thread abort that the runtime raises again at the end of a catch handler is caught by another handler in the same method.EECodeManager::ResumeAfterCatchsends such a thread toThrowControlForThread, andRedirectForThrowControlrecords in theFaultingExceptionFramethe SSP at the point where the thread was redirected. That frame was interrupted rather than stopped at a call, so the slot below its SSP does not hold itsControlPC, and the assert's last clause fails when the catch handler is in that frame. The SSP points at the frame's return address, which is what resuming the frame needs. The assert now also accepts a handler frame that has faulted. Release builds are unchanged.Test: new
src/tests/Regressions/coreclr/GitHub_135530, the case from the issue. It is disabled under the interpreter until #135520 (fixes #135463) is in; the interpreter fails it for that reason, not this one.Validation (Checked):
CallCatchFuncletTieredCompilation=0,JITMinOpts,JitStress1 and 2,ReadyToRun=0,GCStress0x3 and 0xCThe other probes from the issue investigation also print the same on windows-x64 as on linux-x64 with this change, including an abort raised again right in front of a try block that catches it.
Note
This PR was prepared with AI assistance (Anthropic Claude, reviewed by OpenAI Codex). The builds and runs it cites were done at the PR's base commit.