Repository navigation
[release/11.0] [mono] Fix gc descriptor for large static valuetypes - #136859
Open
github-actions[bot] wants to merge 1 commit into
Open
github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
`compute_class_bitmap` has the role of initializing the incoming bitmap, by setting bits for slots containing refs for the class in question. If the passed bitmap is not large enough to hold bits for all slots, it allocates a new bitmap which will be returned. `compute_class_bitmap` also receives a position argument to offset the bit setting in the received bitmap. All non-static field offsets include also the expected object header size (of 2 slots). If you need to set ref bits for a valuetype field inside a class having its bitmap computed, then you pass the bitmap owned by this parent class and the position where the bitmap needs to be initialized, position which needs to subtract MONO_OBJECT_HEADER_BITS to revert the standard field offset. Consider the bitmap initialization for the `StaticData` class from the testcase. It will allocate a bitmap able to hold all static data for the class, in our case only one field, therefore `sizeof(LargeValue) / sizeof(void*)` bits. The current offset to store the bits is 0. It will then recursively delegate the initialization of the bitmap section for the `LargeValue` to the instance field specific part, passing the -MONO_OBJECT_HEADER_BITS offset. The `max_size` that we compute for this class includes the object header, so it can therefore exceed the initial bitmap size. This would hit the realloc path which the caller doesn't expect, ending up with improperly initialized ref bitmaps. Fixes #136602
github-actions
Bot
requested review from
steveisok,
thaystg and
vitek-karas
as code owners
November 2, 2026 19:13
|
Azure Pipelines: Successfully started running 3 pipeline(s). 12 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
BrzVlad
approved these changes
Nov 2, 2026
BrzVlad
added
Servicing-approved
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #136625 to release/11.0
/cc @BrzVlad
Customer Impact
A large valuetype (more than 255 fields) which is stored in a static field will be incorrectly scanned by the GC on mono. This means that references stored inside this valuetype can end up with a stale value (an address to the old object location or an address to the collected object). Applications storing large valuetypes in a static field can experience random crashes or incorrect program behavior. Issue was hit by customer on blazor wasm.
Regression
Testing
Reproduced bug with a sample app, which was also used to validate the fix.
Risk
Low. This is a minor fix to the gc ref bitmap computation logic.