[interpreter] Resolve open virtual delegates invoked through the shuffle thunk (wasm, Apple mobile) by lewing · Pull Request #134699 · dotnet/runtime

lewing · 2026-09-26T04:39:30Z

Invoking an open virtual delegate from compiled code crashes CoreCLR on platforms that use the interpreter with cached interface dispatch:

browser-wasm (ReadyToRun): memory access out of bounds in PrepareInterpreterCode ([browser][CoreCLR][R2R] System.Linq.Expressions tests trap in PrepareInterpreterCode #134261).
maccatalyst / iOS / tvOS: a crash in CID_VirtualOpenDelegateDispatchWorker. In CI this showed up as a 75-minute System.Runtime.Tests hang on maccatalyst-arm64 CoreCLR_Smoke, because a second fault while logging the crash spins in PAL_DispatchException ([maccatalyst][CoreCLR] Fault while logging the fatal-error call stack spins in PAL_DispatchException instead of terminating #134720).

Cause

For an open virtual delegate, _methodPtr is the delegate shuffle thunk and _methodPtrAux is CID_VirtualOpenDelegateDispatch. The shuffle thunk is an IL stub that does calli _methodPtrAux, and on these platforms it runs in the interpreter.

CID_VirtualOpenDelegateDispatch can't be invoked through a plain calli, because it expects the address of _methodPtrAux in a hidden argument that calli cannot express:

On arm64 it expects the address of _methodPtrAux in x11, which the interpreter's calli doesn't set.
On wasm it is only a PORTABILITY_ASSERT stub, not a portable entry point, so PortableEntryPoint::GetMethodDesc returns garbage.

Interpreted callers don't hit this, because INTOP_CALLDELEGATE already recognizes the value and skips the shuffle thunk. Compiled (R2R) callers invoke _methodPtr directly and reach the calli.

Change

This is an interpreter-side workaround for #134733. The IL shuffle thunk's calli can't pass the hidden argument that open virtual delegate dispatch stubs expect, under both cached interface dispatch and virtual stub dispatch. The general fix belongs in the shuffle thunk and is tracked by that issue.

In INTOP_CALLI, under FEATURE_CACHED_INTERFACE_DISPATCH, recognize CID_VirtualOpenDelegateDispatch. Resolve the virtual target from the delegate (the shuffle thunk's this) and the target's this argument, then continue through CALL_INTERP_METHOD. That path falls back to InvokeManagedMethod when the target has compiled code.
Link CreateILDelegateShuffleThunk's calli cannot pass the hidden argument that open virtual delegate dispatch stubs expect #134733 from this workaround and from the EmitCALLI in CreateILDelegateShuffleThunk.
Share the resolution between INTOP_CALLDELEGATE and INTOP_CALLI via ResolveOpenVirtualDelegateTarget.
Add DelegateTests coverage for invoking open virtual delegates: class override, boxed struct, enum and interface dispatch. The interface cases are disabled on browser Mono AOT, which has a separate crash tracked in [browser][Mono] Open-instance delegate to an interface method crashes in mono_class_interface_offset_with_variance #134707.
Re-enable System.Linq.Expressions.Tests on the browser CoreCLR ReadyToRun lane.

Validation (local)

Configuration	Test	Without fix	With fix
browser-wasm CoreCLR ReadyToRun + trimming (Chrome)	System.Linq.Expressions.Tests	Trap in `PrepareInterpreterCode`	35,116 run, 0 failed
browser-wasm CoreCLR ReadyToRun + trimming (Chrome)	System.Runtime.Tests `DelegateTests`	Trap in the new test	58 run, 0 failed
maccatalyst-arm64 CoreCLR Release	System.Runtime.Tests (full)	Hang (crash in `CID_VirtualOpenDelegateDispatchWorker`)	79,181 run, 0 failed

The browser Debug build compiles the new asserts.

Resolves #134261

Note

This PR description was generated with GitHub Copilot.

…e shuffle thunk When compiled (R2R) code invokes an open virtual delegate on portable entry point platforms, it calls the IL delegate shuffle thunk, which does a calli on _methodPtrAux. For open virtual delegates that is CID_VirtualOpenDelegateDispatch, which is not a portable entry point, so treating it as one read a garbage MethodDesc and trapped in PrepareInterpreterCode. Resolve the virtual target in INTOP_CALLI the same way INTOP_CALLDELEGATE does. Re-enable System.Linq.Expressions.Tests on the browser CoreCLR R2R lane. Fixes #134261 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Extract ResolveOpenVirtualDelegateTarget for INTOP_CALLDELEGATE and INTOP_CALLI, use #else for the portable entry point branch, and add a DelegateTests case that invokes open virtual delegates (class override, boxed struct, enum, interface). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

azure-pipelines · 2026-09-26T04:40:13Z

Azure Pipelines: Successfully started running 3 pipeline(s). 13 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-09-26T04:40:30Z

Tagging subscribers to this area: @JulieLeeMSFT, @BrzVlad, @janvorli
See info in area-owners.md if you want to be subscribed.

dotnet-policy-service · 2026-09-26T04:43:16Z

Tagging subscribers to 'arch-wasm': @lewing, @pavelsavara
See info in area-owners.md if you want to be subscribed.

Copilot

Copilot review overview

🟢 Approval recommended

No blocking issues remain; only a documentation nit was noted.

Review effort: Lite
Findings: 1

Open (1)

Correct comments for the portable entrypoint preprocessor branch · New

What changed in this PR

Fixes browser-Wasm CoreCLR ReadyToRun crashes when invoking open virtual delegates.

Changes:

Resolves open virtual delegate targets in interpreter calli handling.
Shares delegate resolution logic and adds regression coverage.
Re-enables LINQ Expressions tests for the affected lane.

File	Summary
`src/libraries/tests.proj`	Re-enables the affected ReadyToRun test project.
`src/libraries/System.Runtime/tests/System.Runtime.Tests/System/DelegateTests.cs`	Adds open virtual delegate dispatch tests.
`src/coreclr/vm/interpexec.cpp`	Resolves portable open virtual delegate targets; update the related preprocessor guard comments.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…Mono AOT Mono AOT on browser crashes invoking an open-instance interface delegate (#134707). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…-dispatch platforms CID_VirtualOpenDelegateDispatch needs the delegate (on arm64 it reads &_methodPtrAux from x11), so interpreted shuffle thunks cannot invoke it through calli. On maccatalyst/iOS/tvOS the interpreter called the native stub without x11 set and crashed in CID_VirtualOpenDelegateDispatchWorker (found by the new DelegateTests on maccatalyst-arm64 CoreCLR). Apply the INTOP_CALLI resolution under FEATURE_CACHED_INTERFACE_DISPATCH instead of only FEATURE_PORTABLE_ENTRYPOINTS. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

dotnet-policy-service · 2026-09-26T17:37:39Z

Tagging subscribers to 'os-maccatalyst': @vitek-karas, @kotlarmilos, @steveisok, @akoeplinger
See info in area-owners.md if you want to be subscribed.

dotnet-policy-service · 2026-09-26T17:38:06Z

Tagging subscribers to 'arch-wasm': @lewing, @pavelsavara
See info in area-owners.md if you want to be subscribed.

…calli Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

jkotas · 2026-09-27T05:25:40Z

LGTM otherwise

Co-authored-by: Jan Kotas <jkotas@microsoft.com>

Co-authored-by: Jan Kotas <jkotas@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

lewing · 2026-09-27T17:51:40Z

/backport to release/11.0

github-actions · 2026-09-27T17:51:48Z

Started backporting to release/11.0 (link to workflow run)

github-actions · 2026-09-27T17:53:40Z

@lewing backporting to release/11.0 failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git cherry-pick 01a32f307cf916d453fe8d6203eef498fd31fa45

Auto-merging src/coreclr/vm/comdelegate.cpp
Auto-merging src/coreclr/vm/interpexec.cpp
CONFLICT (content): Merge conflict in src/coreclr/vm/interpexec.cpp
Auto-merging src/libraries/System.Runtime/tests/System.Runtime.Tests/System/DelegateTests.cs
Auto-merging src/libraries/tests.proj
CONFLICT (content): Merge conflict in src/libraries/tests.proj
error: could not apply 01a32f307cf... [interpreter] Resolve open virtual delegates invoked through the shuffle thunk (wasm, Apple mobile) (#134699)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"


$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: [wasm][interpreter] Resolve open virtual delegates invoked through the shuffle thunk
Using index info to reconstruct a base tree...
M	src/coreclr/vm/interpexec.cpp
M	src/libraries/tests.proj
Falling back to patching base and 3-way merge...
Auto-merging src/coreclr/vm/interpexec.cpp
Auto-merging src/libraries/tests.proj
CONFLICT (content): Merge conflict in src/libraries/tests.proj
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 [wasm][interpreter] Resolve open virtual delegates invoked through the shuffle thunk
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output

Re-enables two JIT regression tests that were disabled on browser-wasm ReadyToRun. Both invoke an open delegate over an interface method from R2R-compiled code. Before #134699, that hit `portableEntryPoint->IsValid()` in the interpreted delegate shuffle thunk, because the thunk's `calli` passed `CID_VirtualOpenDelegateDispatch` to `PortableEntryPoint::GetMethodDesc`. - `JIT/Regression_o_3/Runtime_79354`: `ActiveIssue` for #131886 removed. - `JIT/Regression_2/Runtime_70259` (`.cs` and `.il`): `ActiveIssue` for #133169, a duplicate of #131886, removed. - The `TestLibrary` using/assembly reference is also removed from each file, since it was only there for these attributes. #125138 did the same when it last re-enabled these tests. ## Validation (local) Run on browser-wasm with a checked runtime, Release libraries and crossgen2 ReadyToRun (`RunCrossGen2=1`), matching the `R2R_CG2 browser wasm checked` lane. The R2R images were emitted and loaded. | Test | With #134699 | #134699's `INTOP_CALLI` branch disabled | |---|---|---| | `Runtime_79354` | Pass (100) | `portableEntryPoint->IsValid()` in `MyDelegate::IL_STUB_DelegateShuffleThunk, IR_0014` | | `Runtime_70259` | Pass (100) | `portableEntryPoint->IsValid()` in ``System.Func`2[__Canon,Int32]::IL_STUB_DelegateShuffleThunk, IR_0014`` | I also checked the separate diagnosis in #130840 (a misplaced receiver in `INTOP_CALLDELEGATE`'s open-virtual branch after R2R-to-interpreter entry). A scratch probe had R2R-compiled callers invoke interpreted `DynamicMethod`s, which then invoke open virtual delegates. It covered interface and class-virtual targets, class and boxed-struct receivers, mixed int/long/double arguments, a `Vector128` argument and a hidden-buffer struct return. All `INTOP_CALLDELEGATE` cases passed, including with #134699's branch disabled. Details are in #130840. Resolves #131886 Resolves #130840 > [!NOTE] > This PR description was generated with GitHub Copilot. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

lewing and others added 2 commits September 25, 2026 23:05

lewing requested review from BrzVlad and janvorli as code owners September 26, 2026 04:39

github-actions Bot added the area-CodeGen-Interpreter-coreclr label Sep 26, 2026

dotnet-policy-service Bot assigned lewing Sep 26, 2026

lewing requested a review from radekdoulik September 26, 2026 04:41

lewing added the arch-wasm WebAssembly architecture label Sep 26, 2026

lewing requested a lite review from Copilot September 26, 2026 04:48

Copilot started reviewing on behalf of lewing September 26, 2026 04:48 View session

Copilot AI reviewed Sep 26, 2026

View reviewed changes

Comment thread src/coreclr/vm/interpexec.cpp Outdated

Clarify #else comment for the portable entry point branch

e7a50b1

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

lewing mentioned this pull request Sep 26, 2026

[browser][Mono] Open-instance delegate to an interface method crashes in mono_class_interface_offset_with_variance #134707

Open

Split interface open-virtual delegate test and disable it on browser …

9665c7d

…Mono AOT Mono AOT on browser crashes invoking an open-instance interface delegate (#134707). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

lewing requested a review from pavelsavara September 26, 2026 16:29

lewing changed the title ~~[wasm][interpreter] Resolve open virtual delegates invoked through the shuffle thunk~~ [interpreter] Resolve open virtual delegates invoked through the shuffle thunk (wasm, Apple mobile) Sep 26, 2026

lewing mentioned this pull request Sep 26, 2026

[maccatalyst][CoreCLR] Fault while logging the fatal-error call stack spins in PAL_DispatchException instead of terminating #134720

Open

lewing requested a review from vitek-karas September 26, 2026 17:37

lewing added os-maccatalyst MacCatalyst OS and removed arch-wasm WebAssembly architecture labels Sep 26, 2026

lewing added the arch-wasm WebAssembly architecture label Sep 26, 2026

jkotas reviewed Sep 26, 2026

View reviewed changes

Comment thread src/coreclr/vm/interpexec.cpp Outdated

Clarify why CID_VirtualOpenDelegateDispatch cannot be called through …

e2234ae

…calli Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

lewing mentioned this pull request Sep 27, 2026

CreateILDelegateShuffleThunk's calli cannot pass the hidden argument that open virtual delegate dispatch stubs expect #134733

Open

Link the IL shuffle thunk hidden-argument issue from both sites

d988331

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

This was referenced Sep 27, 2026

slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883

Open

The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008

Open

jkotas reviewed Sep 27, 2026

View reviewed changes

Comment thread src/coreclr/vm/comdelegate.cpp Outdated

jkotas reviewed Sep 27, 2026

View reviewed changes

Comment thread src/coreclr/vm/interpexec.cpp Outdated

build-analysis Bot mentioned this pull request Sep 27, 2026

XHarness package install failure on iOS due to devicectl NSPOSIXErrorDomain error 49 #123796

Open

lewing and others added 2 commits September 27, 2026 09:35

Update comdelegate.cpp

a718e4e

Co-authored-by: Jan Kotas <jkotas@microsoft.com>

Apply review suggestion to the INTOP_CALLI workaround comment

d15c8ca

Co-authored-by: Jan Kotas <jkotas@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

jkotas approved these changes Sep 27, 2026

View reviewed changes

lewing enabled auto-merge (squash) September 27, 2026 15:05

This was referenced Sep 27, 2026

iOS device work items fail to install with "No valid provisioning profile found" (APP_NOT_SIGNED) on osx.15.amd64.iphone.open #134747

Open

[browser][CoreCLR][R2R] System.Linq.Expressions tests trap in PrepareInterpreterCode #134261

Closed

lewing merged commit 01a32f3 into main Sep 27, 2026
132 of 134 checks passed

lewing deleted the lewing-wasm-r2r-open-virtual-delegate branch September 27, 2026 17:13

This was referenced Sep 27, 2026

Connect_Parallel_FailsOver Assert.NotNull() test failure #134107

Open

Crash: access violation in coreclr!PgoManager::getPgoInstrumentationResults during tier-1 background JIT (Windows x86) #134695

Open

This was referenced Sep 27, 2026

[release/11.0] [interpreter] Resolve open virtual delegates invoked through the shuffle thunk (wasm, Apple mobile) #134751

Open

[wasm][R2R] Re-enable open virtual delegate runtime tests #134765

Merged

dotnet-maestro Bot mentioned this pull request Sep 28, 2026

[main] Source code updates from dotnet/runtime dotnet/dotnet#9796

Merged

dotnet-milestone-bot Bot added this to the 12.0-preview1 milestone Sep 28, 2026

Navigation Menu

[interpreter] Resolve open virtual delegates invoked through the shuffle thunk (wasm, Apple mobile) - #134699

[interpreter] Resolve open virtual delegates invoked through the shuffle thunk (wasm, Apple mobile)#134699
lewing merged 9 commits into
mainfrom
lewing-wasm-r2r-open-virtual-delegate

lewing commented Sep 26, 2026 •

edited

Loading

Uh oh!

azure-pipelines Bot commented Sep 26, 2026

Uh oh!

dotnet-policy-service Bot commented Sep 26, 2026

Uh oh!

dotnet-policy-service Bot commented Sep 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

dotnet-policy-service Bot commented Sep 26, 2026

Uh oh!

dotnet-policy-service Bot commented Sep 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jkotas commented Sep 27, 2026

Uh oh!

Uh oh!

lewing commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

lewing commented Sep 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Cause

Change

Validation (local)

Uh oh!

azure-pipelines Bot commented Sep 26, 2026

Uh oh!

dotnet-policy-service Bot commented Sep 26, 2026

Uh oh!

dotnet-policy-service Bot commented Sep 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

Uh oh!

dotnet-policy-service Bot commented Sep 26, 2026

Uh oh!

dotnet-policy-service Bot commented Sep 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jkotas commented Sep 27, 2026

Uh oh!

Uh oh!

lewing commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lewing commented Sep 26, 2026 •

edited

Loading