methodtable.cpp Assert failure: fieldSize != (unsigned int)-1

[sbomer]

On net7.0-Linux-Release-x64-CoreCLR_checked-Ubuntu.1804.Amd64.Open, System.Security.Cryptography.Tests failed with assertion:

+ ./RunTests.sh --runtime-path /datadisks/disk1/work/A40508DF/p
----- start Sun Jan 30 21:07:36 UTC 2022 =============== To repro directly: =====================================================
pushd .
/datadisks/disk1/work/A40508DF/p/dotnet exec --runtimeconfig System.Security.Cryptography.Tests.runtimeconfig.json --depsfile System.Security.Cryptography.Tests.deps.json xunit.console.dll System.Security.Cryptography.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing 
popd
===========================================================================================================
/datadisks/disk1/work/A40508DF/w/A07A0890/e /datadisks/disk1/work/A40508DF/w/A07A0890/e

Assert failure(PID 28466 [0x00006f32], Thread: 28472 [0x6f38]): fieldSize != (unsigned int)-1
    File: /__w/1/s/src/coreclr/vm/methodtable.cpp Line: 2323
    Image: /datadisks/disk1/work/A40508DF/p/dotnet

./RunTests.sh: line 162: 28466 Aborted                 (core dumped) "$RUNTIME_PATH/dotnet" exec --runtimeconfig System.Security.Cryptography.Tests.runtimeconfig.json --depsfile System.Security.Cryptography.Tests.deps.json xunit.console.dll System.Security.Cryptography.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing $RSP_FILE
/datadisks/disk1/work/A40508DF/w/A07A0890/e
----- end Sun Jan 30 21:07:38 UTC 2022 ----- exit code 134 ----------------------------------------------------------
exit code 134 means SIGABRT Abort. Managed or native assert, or runtime check such as heap corruption, caused call to abort(). Core dumped.
ulimit -c value: unlimited

console log
build
core dump

The failure appears to be nondeterministic as the prior and subsequent rolling builds passed (and did not contain changes that would affect this, to my knowledge).

@bartonjs who would be the best person to investigate this?

[dotnet-issue-labeler]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[danmoseley]

I imagine this is more likely a VM bug than anything we could trigger in managed code.

[mangod9]

@jkoritzinsky could this be related to your field layout changes?

[jkoritzinsky]

I’m not sure. I’ll take a preliminary look in case it is due to my changes.

[jkoritzinsky]

The Helix artifacts are gone, so there's limited work I can do. I didn't change anything with field sizes (only offsets) in my work, so I don't think this was due to my changes. If this repros again, I'll take a closer look.

[danmoseley]

Reproed again
https://helixre8s23ayyeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-pull-64899-merge-3efdf7ca52ac471c87/System.Xml.Schema.Extensions.Tests/1/console.469561f1.log?sv=2019-07-07&se=2022-04-12T22%3A08%3A52Z&sr=c&sp=rl&sig=hwIhV3bbpQR7efzLJKvxa6wOZtuOejdPG9EX%2FavHgMM%3D

  Discovering: System.Xml.Schema.Extensions.Tests (method display = ClassAndMethod, method display options = None)

Assert failure(PID 24 [0x00000018], Thread: 34 [0x0022]): fieldSize != (unsigned int)-1
    File: /__w/1/s/src/coreclr/vm/methodtable.cpp Line: 2323
    Image: /root/helix/work/correlation/dotnet

@jkoritzinsky there is a dump while it lasts at https://dev.azure.com/dnceng/public/_build/results?buildId=1678750&view=ms.vss-test-web.build-test-results-tab&runId=46009164&paneView=dotnet-dnceng.dnceng-build-release-tasks.helix-test-information-tab&resultId=185866

net7.0-Linux-Debug-x64-CoreCLR_checked-(Alpine.314.Amd64.Open)Ubuntu.1804.Amd64.Open@mcr.microsoft.com/dotnet-buildtools/prereqs:alpine-3.14-helix-amd64-20210910135833-1848e19

[jkoritzinsky]

This looks like it's failing on the _pointer field of Span<char> when jitting System.Reflection.AssemblyNameFormatter.ComputeDisplayName. A -1 value here means that the field type hasn't been loaded or some other error occurred, so I'm thinking this might be by-ref field related.

I don't think I can get further than that at the moment.

cc: @AaronRobinsonMSFT for any additional ideas

[jkotas]

Failed in #70000

[janvorli]

Assigning to @trylek as the dup issue I've just closed was assigned to him.

[janvorli]

The dup #71241 issue still has a core dump available.

[janvorli]

I have added some analysis based on the dump to the #71241

[davidwrighton]

This appears to have been a bug around the behavior of the ByReference<T> type in the runtime. Now that @AaronRobinsonMSFT has replaced all of those usages with ref fields as of #71498, this problem should no longer recur.