Dynamic type resolution goes into infinite recursion

[ScramblerUSA]

Under certain circumstances dynamic type resolution goes into infinite recursion (causing program to terminate with StackOverflowException) alternating between these methods:

Microsoft.CSharp.dll!Microsoft.CSharp.RuntimeBinder.Semantics.TypeManager.SubstTypeCore(Microsoft.CSharp.RuntimeBinder.Semantics.CType type, Microsoft.CSharp.RuntimeBinder.Semantics.SubstContext pctx)
Microsoft.CSharp.dll!Microsoft.CSharp.RuntimeBinder.Semantics.TypeManager.SubstTypeArray(Microsoft.CSharp.RuntimeBinder.Semantics.TypeArray taSrc, Microsoft.CSharp.RuntimeBinder.Semantics.SubstContext pctx)

This happens only when an argument of type "dynamic" is passed, of course. Static typing works fine.

Repro:

using System;
class Program
{
    static void Main(string[] args)
    {
        // vvv--- changing "dynamic" to "var" or "string" here fixes the issue
        dynamic parsedDocument = "";
        var mystery = new FailingClass<string>();
        Console.WriteLine("Entering...");
        mystery.FailingMethod(parsedDocument);
        Console.WriteLine("... and we are back!");
        Console.ReadLine();
    }
}
public abstract class CommonBase<T> {}

// Technically, this class does nothing and deriving from it should be identical to deriving from CommonBase
public abstract class FailingClassBase<T> : CommonBase<T> {}

// However, deriving from CommonBase instead of FailingClassBase here also fixes the issue
// ----------------------------vvvvvvvvvvvvvvvv
public class FailingClass<T> : FailingClassBase<FailingClass<T>>
{
    public void FailingMethod(T src) {}
}

[EDIT] Fixed callstack formatting by @karelz
[EDIT] Inlined source code from original attachment repro.txt, with minor formatting changes by @karelz

[ContentsMayVary]

Here's another repro - this also causes StackOverflowException:

class First<T> where T : First<T> { }
class Second<T> : First<T> where T : First<T> { }
class Third<T> : Second<Third<T>> { }

class Program
{
    static void Main()
    {
        dynamic x = new Third<int>();
        Print(x); // Uncomment this and the exception goes away.
    }

    static void Print(object obj) { }
}

Also see:

http://stackoverflow.com/questions/39870305/system-stackoverflowexception-error-when-try-to-get-a-dynamic-proppery-from-an#comment67032482_39870305
http://stackoverflow.com/questions/22672775/stackoverflowexception-when-accessing-member-of-generic-type-via-dynamic-net-c

[EDIT] Add C# syntax highlighting by @karelz

[karelz]

We need someone to get it under debugger and find out what is wrong in .NET Core code.

[JonHanna]

The loop is straight-forward enough. In the last of the examples produced, for example, it trys to substitute the types in Third<T> to get Third<int> then work out the base when is a type of Second<T> typed with Third<T> which has a base of Second<T> typed with Third<T> which has a base…

Breaking the loop does not seem to be easy though.

[karelz]

There is duplicate report in dotnet/corefx#23706 with variant of the same bug: Second<T>=BuilderBaseEx<T>, but the constraint is slightly (and likely insignificantly) different:

• Second<T> : First<T> where T : Second<T> in dotnet/corefx#23706
• Second<T> : First<T> where T : First<T> in https://github.com/dotnet/corefx/issues/7527#issuecomment-251657022

Note: The original (previously "hidden") repro does not have any constraints on generic parameters.

[JonHanna]

The great thing about not having time to contribute to corefx for a month, is getting a fresher look at some things. I'd tried a variant of the fix in dotnet/corefx#25196 before but must have slipped up, since it went quite smoothly this time.

[JonHanna]

It might be worth making this netfx-port-consider, since there are several stackoverflow questions about it with netfx, suggesting it affects a fair number of people.

[karelz]

@JonHanna did you see more than the 2 StackOverflow links above? If there are any highly upvoted, that would be worth linking from here. It will be useful at the point we do the port to assess need vs. risk. Thanks!

[JonHanna]

There was also https://stackoverflow.com/q/19612325/400547 that gave me the idea of testing it in cases where it should throw RBE.

[karelz]

Which last one? Can you please edit your reply to keep just the relevant links? Thanks!

[JonHanna]

NP