[OSX|x64] CompareExchangeTClass_1.sh fails with assert !IsPointingToPrestub()

[jashook]

Assert failure(PID 8371 [0x000020b3], Thread: 964708 [0xeb864]): !IsPointingToPrestub()
    File: /Users/jashoo/projects/coreclr/src/vm/precode.cpp Line: 501
    Image: /Users/jashoo/projects/coreclr/bin/tests/OSX.x64.Checked/Tests/Core_Root/corerun

../CompareExchangeTClass/CompareExchangeTClass.sh: line 251:  8371 Abort trap: 6           $_DebuggerFullPath \"$CORE_ROOT/corerun\" $ExePath $CLRTestExecutionArguments


Return code:      1
Raw output file:      /Users/jashoo/projects/coreclr/bin/tests/OSX.x64.Checked/baseservices/threading/Reports/baseservices.threading/interlocked/compareexchange/CompareExchangeTClass_1/CompareExchangeTClass_1.output.txt
Raw output:
BEGIN EXECUTION
export CDPATH=/Users/jashoo/projects/coreclr/bin/tests/OSX.x64.Checked/baseservices/threading/interlocked/compareexchange/CompareExchangeTClass_1
/bin/sh ../CompareExchangeTClass/CompareExchangeTClass.sh
BEGIN EXECUTION
/Users/jashoo/projects/coreclr/bin/tests/OSX.x64.Checked/Tests/Core_Root/corerun CompareExchangeTClass.exe \"hello world\"
Creating threads
Joining threads
Expected: 100
Actual: 134
END EXECUTION - FAILED
Expected: 0
Actual: 1
END EXECUTION - FAILED
Test Harness Exitcode is : 1

To run the test:
> set CORE_ROOT=/Users/jashoo/projects/coreclr/bin/tests/OSX.x64.Checked/Tests/Core_Root
> /Users/jashoo/projects/coreclr/bin/tests/OSX.x64.Checked/baseservices/threading/interlocked/compareexchange/CompareExchangeTClass_1/CompareExchangeTClass_1.sh

Expected: True
Actual:   False

[jashook]

@janvorli went ahead and assigned this one to you in case you know more about it.

[jashook]

Note this fails in the outerloop pri1 tests.

[RussKeldorph]

@kouvel

[janvorli]

I was able to do repro it on my Mac, it happens quite infrequently, once in several hundreds of iterations.
The precodeType was PRECODE_FIXUP in all the cases I've seen. The target parameter of the Precode::SetTargetInterlocked where the assert fired was pointing to a jitted code, but at the time of the assert, it is pointing to PrecodeFixupThunk. So it looks like something is racing with setting the target.
I have also dumped the values of expected and return value:

target: 000000011A834D30 (jitted code)
expected: 000000010B6BCF57 (PrecodeFixupThunk)
ret: 1

Given the fact that ret=1, the compare exchange must have succeeded and so it means that the target was changed in the very small window after the ret = AsFixupPrecode()->SetTargetInterlocked(target, expected); and before the assert got the target value.

There are many threads running at the time of the crash and many of them have CodeVersionManager::PublishVersionableCodeIfNecessary on their call stacks, as you can see from the stacktraces of all the threads in the gist below:
https://gist.github.com/janvorli/207c0d304145eea040fcffbf6e81fd0a