Change to bring few jit helpers to new unwind plan breaks diagnostic tests

[janvorli]

The private diagnostic tests suite got broken by the PR #123307 that brought few jit helpers to the new unwind plan. The test suite execution exits abruptly with failure message after running only a couple of tests. No details that would help identify the issue are shown.

[dotnet-policy-service]

Tagging subscribers to this area: @mangod9
See info in area-owners.md if you want to be subscribed.

[jkotas]

cc @am11

[noahfalk]

cc @dotnet/dotnet-diag

[janvorli]

Enabling WinDbg as just in time debugger, I can see the problem is due to
FAST_FAIL_CONTROL_INVALID_RETURN_ADDRESS Shadow stack violation.
Unfortunately the stack trace is broken, so I don't see where it stems from.

[janvorli]

The !dumpstack actually got something possibly pointing to a problematic stuff. I guess the JIT_PatchPoint is likely involved.

Child-SP         RetAddr          Caller, Callee
000000B967A7E0D0 00007ff8f81c9d5e coreclr!TransitionFrame::TransitionFrame + 0x1e [D:\git\runtime7\src\coreclr\vm\frames.h:793], calling coreclr!Frame::Frame [D:\git\runtime7\src\coreclr\vm\frames.h:591]
000000B967A7E100 00007ff8f81c9c32 coreclr!FramedMethodFrame::FramedMethodFrame + 0x32 [D:\git\runtime7\src\coreclr\vm\frames.h:1188], calling coreclr!dac_cast<unsigned __int64,TransitionBlock *> [D:\git\runtime7\src\coreclr\inc\daccess.h:2323]
000000B967A7E120 00007ff8f83738b1 coreclr!OBJECTREF::OBJECTREF + 0x71 [D:\git\runtime7\src\coreclr\vm\object.cpp:954], calling coreclr!Thread::ObjectRefNew [D:\git\runtime7\src\coreclr\vm\threads.h:2994]
000000B967A7E130 00007ff8f821f8db coreclr!DynamicHelperFrame::DynamicHelperFrame + 0x2b [D:\git\runtime7\src\coreclr\vm\frames.cpp:1049], calling coreclr!FramedMethodFrame::FramedMethodFrame [D:\git\runtime7\src\coreclr\vm\frames.h:1189]
000000B967A7E160 00007ff8f85ddbca coreclr!RhpGcAlloc + 0xea [D:\git\runtime7\src\coreclr\vm\gchelpers.cpp:67], calling coreclr!Frame::Push [D:\git\runtime7\src\coreclr\vm\frames.cpp:546]
000000B967A7E270 00007ff8f8acad14 coreclr!JIT_Patchpoint + 0xb4 [D:\git\runtime7\src\coreclr\vm\amd64\AsmHelpers.asm:413], calling coreclr!JIT_PatchpointWorkerWorkerWithPolicy [D:\git\runtime7\src\coreclr\vm\jithelpers.cpp:1566]
000000B967A7E300 00007ff8f57b15ce (MethodDesc 00007ff8997de6a0 + 0x2e System.Char.IsWhiteSpaceLatin1(Char)), calling System.Diagnostics.Debug.Assert(Boolean, System.String, System.String)
000000B967A7E330 00007ff8f57b161d (MethodDesc 00007ff8997de6f0 + 0x1d System.Char.IsWhiteSpace(Char)), calling System.Char.IsWhiteSpaceLatin1(Char)

Dumping the shadow stack:

0:056> dps @ssp
000000b9`67bfeee0  00007ff8`f822aa7c coreclr!Frame::Push+0x4c [D:\git\runtime7\src\coreclr\vm\frames.cpp @ 547]
000000b9`67bfeee8  00007ff8`f85ddbca coreclr!RhpGcAlloc+0xea [D:\git\runtime7\src\coreclr\vm\gchelpers.cpp @ 67]
000000b9`67bfeef0  00007ff8`f8acde13 coreclr!RhpNewVariableSizeObject+0x23 [D:\git\runtime7\src\coreclr\runtime\amd64\AllocFast.asm @ 230]
000000b9`67bfeef8  00007ff8`f5798eb0*** WARNING: Unable to verify checksum for D:\git\dotnet-diagnostictests\artifacts\bin\windows.x64.Debug\runtimes\coreclr\System.Private.CoreLib.dll
 System_Private_CoreLib!System.String.FastAllocateString+0x40
000000b9`67bfef00  00007ff8`f58b5d03 System_Private_CoreLib!System.Text.StringBuilder.ToString+0x23 [D:\git\runtime7\src\libraries\System.Private.CoreLib\src\System\Text\StringBuilder.cs @ 324]
000000b9`67bfef08  00007ff8`f866605b coreclr!JIT_PatchpointWorkerWorkerWithPolicy+0x60b [D:\git\runtime7\src\coreclr\vm\jithelpers.cpp @ 1701]
000000b9`67bfef10  00007ff8`f8acad14 coreclr!JIT_Patchpoint+0xb4 [D:\git\runtime7\src\coreclr\vm\amd64\AsmHelpers.asm @ 413]
000000b9`67bfef18  00007ff8`9afeddf7 xunit_execution_dotnet!Xunit.Sdk.TestOutputHelper.EscapeInvalidHexChars(System.String)+0x337
000000b9`67bfef20  00007ff8`9afed9cb xunit_execution_dotnet!Xunit.Sdk.TestOutputHelper.QueueTestOutput(System.String)+0x2b
000000b9`67bfef28  00007ff8`9afed282 xunit_execution_dotnet!Xunit.Sdk.TestOutputHelper.WriteLine(System.String)+0x72
000000b9`67bfef30  00007ff8`9aff95f4 Microsoft_Diagnostics_TestHelpers!Microsoft.Diagnostics.TestHelpers.TestRunner+OutputHelper.WriteLine(System.String)+0x34 [/_/src/Microsoft.Diagnostics.TestHelpers/TestRunner.cs @ 172]
000000b9`67bfef38  00007ff8`9b016020 Microsoft_Diagnostics_TestHelpers!Microsoft.Diagnostics.TestHelpers.TestOutputProcessLogger.ProcessStarted(Microsoft.Diagnostics.TestHelpers.ProcessRunner)+0xd0 [/_/src/Microsoft.Diagnostics.TestHelpers/TestOutputProcessLogger.cs @ 30]
000000b9`67bfef40  00007ff8`9b00984b Microsoft_Diagnostics_TestHelpers!Microsoft.Diagnostics.TestHelpers.ProcessRunner.Start()+0x1db [/_/src/Microsoft.Diagnostics.TestHelpers/ProcessRunner.cs @ 281]
000000b9`67bfef48  00007ff8`9b0093fe Microsoft_Diagnostics_TestHelpers!Microsoft.Diagnostics.TestHelpers.ProcessRunner.Run()+0x1e [/_/src/Microsoft.Diagnostics.TestHelpers/ProcessRunner.cs @ 245]
000000b9`67bfef50  00007ff8`9aff70c1*** WARNING: Unable to verify checksum for D:\git\dotnet-diagnostictests\artifacts\bin\windows.x64.Debug\Debugger.Tests\Debugger.Tests.dll
 Debugger_Tests!Debugger.Tests.MDbgRunner+<Execute>d__17.MoveNext()+0xd11 [D:\git\dotnet-diagnostictests\src\Debugger.Tests\MDbgRunner.cs @ 142]
000000b9`67bfef58  00007ff8`f5a9a42b System_Private_CoreLib!System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1.AsyncStateMachineBox`1.ExecutionContextCallback+0x5afccd4b

[janvorli]

I can see that in the JIT_PatchPointWorkerWithPolicy, we are sitting at

runtime/src/coreclr/vm/jithelpers.cpp

Line 1701 in e83b37c

ClrRestoreNonvolatileContext(pFrameContext);

[janvorli]

Some more evidence - looking at ssp-0x10, it actually matches what the !dumpstack dumped, so it looks like the SSP is off by 16 bytes.

:056> dps @ssp-10
000000b9`67bfeed0  00007ff8`f81c9d5e coreclr!TransitionFrame::TransitionFrame+0x1e [D:\git\runtime7\src\coreclr\vm\frames.h @ 793]
000000b9`67bfeed8  00007ff8`f81c9c32 coreclr!FramedMethodFrame::FramedMethodFrame+0x32 [D:\git\runtime7\src\coreclr\vm\frames.h @ 1188]
000000b9`67bfeee0  00007ff8`f822aa7c coreclr!Frame::Push+0x4c [D:\git\runtime7\src\coreclr\vm\frames.cpp @ 547]
000000b9`67bfeee8  00007ff8`f85ddbca coreclr!RhpGcAlloc+0xea [D:\git\runtime7\src\coreclr\vm\gchelpers.cpp @ 67]
000000b9`67bfeef0  00007ff8`f8acde13 coreclr!RhpNewVariableSizeObject+0x23 [D:\git\runtime7\src\coreclr\runtime\amd64\AllocFast.asm @ 230]
000000b9`67bfeef8  00007ff8`f5798eb0 System_Private_CoreLib!System.String.FastAllocateString+0x40
000000b9`67bfef00  00007ff8`f58b5d03 System_Private_CoreLib!System.Text.StringBuilder.ToString+0x23 [D:\git\runtime7\src\libraries\System.Private.CoreLib\src\System\Text\StringBuilder.cs @ 324]
000000b9`67bfef08  00007ff8`f866605b coreclr!JIT_PatchpointWorkerWorkerWithPolicy+0x60b [D:\git\runtime7\src\coreclr\vm\jithelpers.cpp @ 1701]
000000b9`67bfef10  00007ff8`f8acad14 coreclr!JIT_Patchpoint+0xb4 [D:\git\runtime7\src\coreclr\vm\amd64\AsmHelpers.asm @ 413]

[MihaZupan]

I bisected fuzzing & code coverage failures to this change as well, if a stable repro is of any use:

# Prepare the build
.\build.cmd clr+libs -rc Checked
cd .\src\libraries\Fuzzing\DotnetFuzzing\
..\..\..\..\.dotnet\dotnet.exe build
.\run.bat

# Run a fuzzer (might work for a few seconds before crashing)
.\deployment\HttpHeadersFuzzer\local-run.bat

SharpFuzz process exited with code 0x80000002, aborting

[janvorli]

One thing I can see that's not correct is that in JIT_PatchpointWorkerWorkerWithPolicy, we get current SSP using _rdsspq() and then subtract 8, which gets us the SSP of the JIT_PatchPoint itself. The previous code was using the UnwindToFirstManagedFrame which would move us to the managed frame and then we would subtract 8 from the SSP. That seems to explain the 16 byte discrepancy.
Let me try to change that constant and see...

[janvorli]

It actually seems to be more involved than this.