Requesting a servicing backport of #129763 to release/10.0.
Problem
Intermittent SIGSEGV in dotnet build / dotnet test / testhost on arm64 under parallel load — a weak-memory publication race in CoreCLR generic-dictionary layout resolution. EEClass::SetDictionaryLayout / InstantiatedMethodDesc::IMD_SetDictionaryLayout published m_pDictLayout without release semantics, so a concurrent reader on another core could observe a torn/stale pointer and dereference it. Faults surface in GenericsHelpers.GenericHandleWorker → ClassWithSlotAndModule / MethodWithSlotAndModule.
Fixed in main by #129763 (VolatileStore/VolatileLoad on the layout accessors). It is main-only — not in release/10.0 (runtime 10.0.926 / current 10.0.x SDKs).
Customer impact
Production CI on linux-arm64 (NVIDIA DGX Spark / GB10, 20-core) — intermittent crashes of dotnet build/test across our .NET 10 repos, roughly 1 in 30 heavily-parallel builds. Also occasional non-fatal ArgumentException: An item with the same key has already been added in the same code, consistent with the same publication race corrupting dictionary state.
Validation
Built release/10.0 with and without #129763, overlaid only libcoreclr.so (libclrjit.so and System.Private.CoreLib.dll byte-identical between the two arms), and looped parallel dotnet build -c Release on 2× GB10 under production CI load:
| release/10.0 runtime |
runs |
SIGSEGV |
| unpatched |
166 |
5 |
| + #129763 |
165 |
0 |
All five unpatched crashes symbolized to the dictionary-layout path (GenericHandleWorker / ClassWithSlotAndModule), from ImmutableDictionary<__Canon,…> enumeration. P(patched zero | unpatched rate) ≈ e⁻⁵ ≈ 0.007.
Risk
Low. The change is a narrow memory-ordering strengthening — only the m_pDictLayout accessors in class.h (EEClass) and method.hpp (InstantiatedMethodDesc) switch to VolatileLoad/VolatileStore; no behavior change outside dictionary-layout publication. In main since 2026-06-24 without follow-up issues.
I initially opened a manual backport PR (#130548) with the full evidence before realizing backports should be area-owner-initiated via command — closing that in favor of this issue.
Requesting a servicing backport of #129763 to release/10.0.
Problem
Intermittent
SIGSEGVindotnet build/dotnet test/testhoston arm64 under parallel load — a weak-memory publication race in CoreCLR generic-dictionary layout resolution.EEClass::SetDictionaryLayout/InstantiatedMethodDesc::IMD_SetDictionaryLayoutpublishedm_pDictLayoutwithout release semantics, so a concurrent reader on another core could observe a torn/stale pointer and dereference it. Faults surface inGenericsHelpers.GenericHandleWorker→ClassWithSlotAndModule/MethodWithSlotAndModule.Fixed in
mainby #129763 (VolatileStore/VolatileLoadon the layout accessors). It is main-only — not in release/10.0 (runtime 10.0.926 / current 10.0.x SDKs).Customer impact
Production CI on linux-arm64 (NVIDIA DGX Spark / GB10, 20-core) — intermittent crashes of
dotnet build/test across our .NET 10 repos, roughly 1 in 30 heavily-parallel builds. Also occasional non-fatalArgumentException: An item with the same key has already been addedin the same code, consistent with the same publication race corrupting dictionary state.Validation
Built release/10.0 with and without #129763, overlaid only
libcoreclr.so(libclrjit.soandSystem.Private.CoreLib.dllbyte-identical between the two arms), and looped paralleldotnet build -c Releaseon 2× GB10 under production CI load:All five unpatched crashes symbolized to the dictionary-layout path (
GenericHandleWorker/ClassWithSlotAndModule), fromImmutableDictionary<__Canon,…>enumeration. P(patched zero | unpatched rate) ≈ e⁻⁵ ≈ 0.007.Risk
Low. The change is a narrow memory-ordering strengthening — only the
m_pDictLayoutaccessors inclass.h(EEClass) andmethod.hpp(InstantiatedMethodDesc) switch toVolatileLoad/VolatileStore; no behavior change outside dictionary-layout publication. Inmainsince 2026-06-24 without follow-up issues.I initially opened a manual backport PR (#130548) with the full evidence before realizing backports should be area-owner-initiated via command — closing that in favor of this issue.