Backport #129763 to release/10.0: volatile access for CoreCLR dictionary layout publication

[Copilot]

main PR: #129763

Description

Servicing backport of #129763. EEClass::SetDictionaryLayout and InstantiatedMethodDesc::IMD_SetDictionaryLayout published m_pDictLayout without release semantics, allowing a concurrent reader on another core to observe a torn/stale pointer and dereference it — an intermittent arm64 SIGSEGV under parallel load. Faults surface in GenericsHelpers.GenericHandleWorker → ClassWithSlotAndModule / MethodWithSlotAndModule.

The m_pDictLayout accessors switch to VolatileLoad/VolatileStore:

• src/coreclr/vm/class.h — EEClass::GetDictionaryLayout / SetDictionaryLayout
• src/coreclr/vm/method.hpp — InstantiatedMethodDesc::GetDictLayoutRaw / IMD_GetDictionaryLayout / IMD_SetDictionaryLayout

-        GetOptionalFields()->m_pDictLayout = pLayout;
+        VolatileStore(&GetOptionalFields()->m_pDictLayout, pLayout);

Important

This PR's base branch is main, where #129763 already landed, so it carries no diff. The change cherry-picks cleanly onto release/10.0 (git cherry-pick -x bb4ec1f810d, 2 files / 7+ / 7-, no conflicts). To land the backport, comment /backport to release/10.0 on #129763.

Customer Impact

Intermittent crashes of dotnet build / dotnet test / testhost on linux-arm64 under heavy parallel load (~1 in 30 builds), reported from production CI on 20-core GB10 hardware. Also occasional non-fatal ArgumentException: An item with the same key has already been added from the same publication race corrupting dictionary state.

Regression

No. Long-standing weak-memory ordering bug, not a recent regression.

Testing

Reporter built release/10.0 with and without #129763, overlaying only libcoreclr.so, and looped parallel dotnet build -c Release on 2× GB10 under production CI load:

release/10.0 runtime	runs	SIGSEGV
unpatched	166	5
+ #129763	165	0

All five unpatched crashes symbolized to the dictionary-layout path. In main since 2026-06-24 with no follow-up issues.

Risk

Low. Narrow memory-ordering strengthening confined to m_pDictLayout publication; no behavior change elsewhere.

Package authoring no longer needed in .NET 9

IMPORTANT: Starting with .NET 9, you no longer need to edit a NuGet package's csproj to enable building and bump the version.
Keep in mind that we still need package authoring in .NET 8 and older versions.

Note

This description was generated by GitHub Copilot.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[azure-pipelines]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Azure Pipelines:
15 pipeline(s) were filtered out due to trigger conditions.

...

Backport of #129763 to release/10.0 — action required

I investigated this backport request. The fix is a narrow, 2-file memory-ordering change (switching the m_pDictLayout accessors to VolatileLoad/VolatileStore), and I confirmed it applies cleanly to release/10.0:

• git cherry-pick -x bb4ec1f810d (the original Use volatile access for CoreCLR dictionary layout publication #129763 commit) applies onto release/10.0 with no conflicts, producing exactly 2 files changed, 7 insertions(+), 7 deletions(-) — byte-for-byte identical to Use volatile access for CoreCLR dictionary layout publication #129763.

However, this PR cannot carry the backport as-is: its base branch is main, and #129763 already landed in main on 2026-06-24. Against a main base there is no diff to produce (the VolatileLoad/VolatileStore code is already present), and the coding-agent tooling can only add commits on top of this main-based branch — it can't re-base the branch onto release/10.0.

Recommended way to land this

Use the automated servicing backport bot on the original PR, which cherry-picks it onto the release branch and opens a correctly-targeted PR:

On #129763, comment: /backport to release/10.0

That is the mechanism referenced in the issue ("backports should be area-owner-initiated via command") and it produces a PR whose base is release/10.0.

The exact change (for reference)

src/coreclr/vm/class.h — EEClass::GetDictionaryLayout / SetDictionaryLayout:

-        return HasOptionalFields() ? GetOptionalFields()->m_pDictLayout : NULL;
+        return HasOptionalFields() ? VolatileLoad(&GetOptionalFields()->m_pDictLayout) : NULL;
...
-        GetOptionalFields()->m_pDictLayout = pLayout;
+        VolatileStore(&GetOptionalFields()->m_pDictLayout, pLayout);

src/coreclr/vm/method.hpp — InstantiatedMethodDesc::GetDictLayoutRaw / IMD_GetDictionaryLayout / IMD_SetDictionaryLayout:

-        return m_pDictLayout;
+        return VolatileLoad(&m_pDictLayout);
...
-            return pIMD->m_pDictLayout;
+            return VolatileLoad(&pIMD->m_pDictLayout);
-            return m_pDictLayout;
+            return VolatileLoad(&m_pDictLayout);
...
-            pIMD->m_pDictLayout = pNewLayout;
+            VolatileStore(&pIMD->m_pDictLayout, pNewLayout);
...
-            m_pDictLayout = pNewLayout;
+            VolatileStore(&m_pDictLayout, pNewLayout);

cc @VSadov @davidwrighton @vitek-karas

Note

This comment was generated by GitHub Copilot.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke
See info in area-owners.md if you want to be subscribed.