Skip to content

Fix reflection access to misaligned fields in packed structs #133828

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
steveisok wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Fix reflection access to misaligned fields in packed structs #133828

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
db90580
Fix reflection access to misaligned fields
steveisok Sep 13, 2026
8d240e0
Handle misaligned direct reflection access
steveisok Sep 13, 2026
630846c
Refine packed field alignment handling
steveisok Sep 13, 2026
9192c64
Make primitive reflection access consistent
steveisok Sep 14, 2026
4691b84
Correct 32-bit reflection field semantics
steveisok Sep 14, 2026
bc45d68
Address reflection field access review feedback
steveisok Sep 27, 2026
1e59afc
Keep NativeAOT field alignment handling in reflection
steveisok Sep 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
144 changes: 133 additions & 11 deletions ...coreclr/nativeaot/System.Private.CoreLib/src/Internal/Runtime/Augments/RuntimeAugments.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,42 +231,48 @@ public static unsafe RuntimeTypeHandle CreateRuntimeTypeHandle(IntPtr ldTokenRes

public static unsafe void StoreValueTypeField(IntPtr address, object fieldValue, RuntimeTypeHandle fieldType)
{
RuntimeImports.RhUnbox(fieldValue, ref *(byte*)address, fieldType.ToMethodTable());
StoreValueTypeField(ref *(byte*)address, fieldValue, fieldType);
}

public static unsafe object LoadValueTypeField(IntPtr address, RuntimeTypeHandle fieldType)
{
return RuntimeExports.RhBox(fieldType.ToMethodTable(), ref *(byte*)address);
return LoadValueTypeField(ref *(byte*)address, fieldType);
}

public static unsafe object LoadPointerTypeField(IntPtr address, RuntimeTypeHandle fieldType)
{
IntPtr value = default;
LoadPrimitiveField(ref *(byte*)address, ref Unsafe.As<IntPtr, byte>(ref value), (uint)IntPtr.Size);

if (fieldType.ToMethodTable()->IsFunctionPointer)
return *(IntPtr*)address;
return value;

return ReflectionPointer.Box(*(void**)address, Type.GetTypeFromHandle(fieldType));
return ReflectionPointer.Box((void*)value, Type.GetTypeFromHandle(fieldType));
}

public static unsafe void StoreValueTypeField(object obj, int fieldOffset, object fieldValue, RuntimeTypeHandle fieldType)
{
ref byte address = ref Unsafe.AddByteOffset(ref obj.GetRawData(), new IntPtr(fieldOffset - ObjectHeaderSize));
RuntimeImports.RhUnbox(fieldValue, ref address, fieldType.ToMethodTable());
StoreValueTypeField(ref address, fieldValue, fieldType);
}

public static unsafe object LoadValueTypeField(object obj, int fieldOffset, RuntimeTypeHandle fieldType)
{
ref byte address = ref Unsafe.AddByteOffset(ref obj.GetRawData(), new IntPtr(fieldOffset - ObjectHeaderSize));
return RuntimeExports.RhBox(fieldType.ToMethodTable(), ref address);
return LoadValueTypeField(ref address, fieldType);
}

public static unsafe object LoadPointerTypeField(object obj, int fieldOffset, RuntimeTypeHandle fieldType)
{
ref byte address = ref Unsafe.AddByteOffset(ref obj.GetRawData(), new IntPtr(fieldOffset - ObjectHeaderSize));

IntPtr value = default;
LoadPrimitiveField(ref address, ref Unsafe.As<IntPtr, byte>(ref value), (uint)IntPtr.Size);

if (fieldType.ToMethodTable()->IsFunctionPointer)
return RuntimeExports.RhBox(MethodTable.Of<IntPtr>(), ref address);
return value;

return ReflectionPointer.Box((void*)Unsafe.As<byte, IntPtr>(ref address), Type.GetTypeFromHandle(fieldType));
return ReflectionPointer.Box((void*)value, Type.GetTypeFromHandle(fieldType));
}

public static unsafe void StoreReferenceTypeField(IntPtr address, object fieldValue)
Expand Down Expand Up @@ -296,7 +302,7 @@ public static void StoreValueTypeFieldValueIntoValueType(TypedReference typedRef
{
Debug.Assert(TypedReference.TargetTypeToken(typedReference).ToMethodTable()->IsValueType);

RuntimeImports.RhUnbox(fieldValue, ref Unsafe.Add<byte>(ref typedReference.Value, fieldOffset), fieldTypeHandle.ToMethodTable());
StoreValueTypeField(ref Unsafe.Add<byte>(ref typedReference.Value, fieldOffset), fieldValue, fieldTypeHandle);
}

[CLSCompliant(false)]
Expand All @@ -305,7 +311,7 @@ public static object LoadValueTypeFieldValueFromValueType(TypedReference typedRe
Debug.Assert(TypedReference.TargetTypeToken(typedReference).ToMethodTable()->IsValueType);
Debug.Assert(fieldTypeHandle.ToMethodTable()->IsValueType);

return RuntimeExports.RhBox(fieldTypeHandle.ToMethodTable(), ref Unsafe.Add<byte>(ref typedReference.Value, fieldOffset));
return LoadValueTypeField(ref Unsafe.Add<byte>(ref typedReference.Value, fieldOffset), fieldTypeHandle);
}

[CLSCompliant(false)]
Expand All @@ -328,14 +334,130 @@ public static object LoadReferenceTypeFieldValueFromValueType(TypedReference typ
public static unsafe object LoadPointerTypeFieldValueFromValueType(TypedReference typedReference, int fieldOffset, RuntimeTypeHandle fieldTypeHandle)
{
Debug.Assert(TypedReference.TargetTypeToken(typedReference).ToMethodTable()->IsValueType);
IntPtr ptrValue = Unsafe.As<byte, IntPtr>(ref Unsafe.Add<byte>(ref typedReference.Value, fieldOffset));
IntPtr ptrValue = default;
LoadPrimitiveField(
ref Unsafe.Add<byte>(ref typedReference.Value, fieldOffset),
ref Unsafe.As<IntPtr, byte>(ref ptrValue),
(uint)IntPtr.Size);

if (fieldTypeHandle.ToMethodTable()->IsFunctionPointer)
return ptrValue;

return ReflectionPointer.Box((void*)ptrValue, Type.GetTypeFromHandle(fieldTypeHandle));
}

private static object LoadValueTypeField(ref byte address, RuntimeTypeHandle fieldType)
{
MethodTable* fieldMethodTable = fieldType.ToMethodTable();
if (!fieldMethodTable->IsPrimitive &&
(fieldMethodTable->ContainsGCPointers || fieldMethodTable->IsNullable))
{
return RuntimeExports.RhBox(fieldMethodTable, ref address);
}

object result = RuntimeImports.RhNewObject(fieldMethodTable);
if (fieldMethodTable->IsPrimitive)
{
LoadPrimitiveField(ref address, ref result.GetRawData(), fieldMethodTable->ValueTypeSize);
}
else
{
Unsafe.CopyBlockUnaligned(ref result.GetRawData(), ref address, fieldMethodTable->ValueTypeSize);
}

return result;
}

private static void StoreValueTypeField(ref byte address, object fieldValue, RuntimeTypeHandle fieldType)
{
MethodTable* fieldMethodTable = fieldType.ToMethodTable();
if (!fieldMethodTable->IsPrimitive &&
(fieldMethodTable->ContainsGCPointers || fieldMethodTable->IsNullable))
{
RuntimeImports.RhUnbox(fieldValue, ref address, fieldMethodTable);
return;
}

if (fieldMethodTable->IsPrimitive)
{
StorePrimitiveField(ref address, ref fieldValue.GetRawData(), fieldMethodTable->ValueTypeSize);
}
else
{
Unsafe.CopyBlockUnaligned(ref address, ref fieldValue.GetRawData(), fieldMethodTable->ValueTypeSize);
}
}

private static unsafe void LoadPrimitiveField(ref byte source, ref byte destination, uint size)
{
Debug.Assert(size is 1 or 2 or 4 or 8);

fixed (byte* sourcePointer = &source)
{
if (((nuint)sourcePointer & (size - 1)) != 0)
{
Unsafe.CopyBlockUnaligned(ref destination, ref source, size);
return;
}

switch (size)
{
case 1:
destination = Volatile.Read(ref source);
break;
case 2:
Unsafe.As<byte, short>(ref destination) = Volatile.Read(ref Unsafe.As<byte, short>(ref source));
break;
case 4:
Unsafe.As<byte, int>(ref destination) = Volatile.Read(ref Unsafe.As<byte, int>(ref source));
break;
case 8:
#if TARGET_64BIT
Unsafe.As<byte, long>(ref destination) = Volatile.Read(ref Unsafe.As<byte, long>(ref source));
#else
Unsafe.As<byte, long>(ref destination) = Unsafe.As<byte, long>(ref source);
Interlocked.MemoryBarrier();

@jkotas jkotas Sep 28, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Interlocked.MemoryBarrier();
Volatile.ReadBarrier();

#endif
break;
}
}
}

private static unsafe void StorePrimitiveField(ref byte destination, ref byte source, uint size)
{
Debug.Assert(size is 1 or 2 or 4 or 8);

fixed (byte* destinationPointer = &destination)
{
if (((nuint)destinationPointer & (size - 1)) != 0)
{
Unsafe.CopyBlockUnaligned(ref destination, ref source, size);
return;
}

switch (size)
{
case 1:
Volatile.Write(ref destination, source);
break;
case 2:
Volatile.Write(ref Unsafe.As<byte, short>(ref destination), Unsafe.As<byte, short>(ref source));
break;
case 4:
Volatile.Write(ref Unsafe.As<byte, int>(ref destination), Unsafe.As<byte, int>(ref source));
break;
case 8:
#if TARGET_64BIT
Volatile.Write(ref Unsafe.As<byte, long>(ref destination), Unsafe.As<byte, long>(ref source));
#else
Interlocked.MemoryBarrier();

@jkotas jkotas Sep 28, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Interlocked.MemoryBarrier();
Volatile.WriteBarrier();

Unsafe.As<byte, long>(ref destination) = Unsafe.As<byte, long>(ref source);
#endif
break;
}
}
}

public static unsafe object GetThreadStaticBase(IntPtr cookie)
{
return ThreadStatics.GetThreadStaticBaseForType(*(TypeManagerSlot**)cookie, (int)*((IntPtr*)(cookie) + 1));
Expand Down
1 change: 0 additions & 1 deletion src/coreclr/vm/field.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -745,4 +745,3 @@ struct cdac_data<FieldDesc>
};

#endif // _FIELD_H_

Loading
Loading