Skip to content

Avoid incorrectly resolving a MonoClass for MONO_TYPE_GENERICINST when loading custom attribute values.#123439

Merged
steveisok merged 10 commits intodotnet:mainfrom
Venkad000:roslynfix
Apr 6, 2026
Merged

Avoid incorrectly resolving a MonoClass for MONO_TYPE_GENERICINST when loading custom attribute values.#123439
steveisok merged 10 commits intodotnet:mainfrom
Venkad000:roslynfix

Conversation

@Venkad000
Copy link
Copy Markdown
Contributor

@Venkad000 Venkad000 commented Jan 21, 2026

Avoid incorrectly resolving a MonoClass for MONO_TYPE_GENERICINST when loading custom attribute values.

load_cattr_value() previously unconditionally called m_type_data_get_klass(), which is invalid for GENERICINST and could lead to incorrect behavior when processing generic enum instances. This change defers class resolution for MONO_TYPE_GENERICINST and handles enum generic instances explicitly by extracting the underlying element type. This fixes a crash when decoding custom attributes involving generic types.

This crashes in Mono but doesn't in CoreClr

using System;
using System.Collections;
using System.Reflection;

using System.Runtime.InteropServices;

var attr = typeof(C).CustomAttributes.Single(d => d.AttributeType == typeof(A));
var arg = attr.ConstructorArguments.Single();
Console.WriteLine(arg.GetType());
class A : Attribute
{
    public unsafe A(B<delegate*<void>[]>.E e) { }
} 

class B<T>
{
    public enum E { }
}

[A(default)]
unsafe class C { }

Output on CoreClr:

System.Reflection.CustomAttributeTypedArgument

Output on Mono without fix:

MonoType with type 21 accessed by m_type_data_get_klass

=================================================================
	Native Crash Reporting
=================================================================
Got a SIGABRT while executing native code. This usually indicates
a fatal error in the mono runtime or one of the native libraries 
used by your application.
=================================================================

=================================================================
	Native stacktrace:
=================================================================
	0x7fa2a25ffd2f - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a25a3e0e - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a25ff5b1 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a2a29040 - /lib64/libc.so.6 : 
	0x7fa2a2a82e5c - /lib64/libc.so.6 : 
	0x7fa2a2a28f0e - /lib64/libc.so.6 : gsignal
	0x7fa2a2a106d0 - /lib64/libc.so.6 : abort
	0x7fa2a26ac244 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a26b9e06 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a26ac606 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a26ac73e - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a277445b - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a277408d - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a276ee74 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a276e9c4 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : mono_reflection_create_custom_attr_data_args
	0x7fa2a276fdbf - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a2704f08 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x4037366b - Unknown

Output on Mono with fix:

System.Reflection.CustomAttributeTypedArgument

@dotnet-policy-service dotnet-policy-service Bot added the community-contribution Indicates that the PR has been added by a community member label Jan 21, 2026
@github-actions github-actions Bot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Jan 21, 2026
@lewing lewing added area-VM-meta-mono and removed needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners labels Jan 21, 2026
Copilot AI mentioned this pull request Jan 21, 2026
Open
@build-analysis build-analysis Bot mentioned this pull request Jan 21, 2026
Closed
Copilot AI added a commit that referenced this pull request Jan 21, 2026
@lewing
Merge PR #123439 Mono fix into test branch
5542a1f 
Co-authored-by: lewing <24063+lewing@users.noreply.github.com>
This was referenced Jan 24, 2026
Open
Open
Closed
@Venkad000
Copy link
Copy Markdown
Contributor Author

Venkad000 commented Jan 28, 2026

@lewing should i add test cases to verify this?

@lewing
Copy link
Copy Markdown
Member

lewing commented Jan 30, 2026

@lewing should i add test cases to verify this?

Sorry, Your PR looks good and I'm experimenting in #123445 with a test case as a follow-up.

This was referenced Jan 31, 2026
Closed
Open
lewing added a commit to lewing/runtime that referenced this pull request Feb 3, 2026
@lewing
Simplify test to use int[] instead of function pointer array
6b07e9f 
Change test from delegate*<void>[] to int[] to avoid hitting
unrelated Mono function pointer type equality issue (dotnet#90308)
while still testing the original crash fix (MONO_TYPE_GENERICINST
handling in custom attribute decoding from PR dotnet#123439).

Verified:
- Test crashes on Mono WITHOUT the fix (m_type_data_get_klass error)
- Test passes on Mono WITH the fix
- Test passes on CoreCLR
lewing added a commit that referenced this pull request Feb 3, 2026
@lewing
Add test for custom attribute with generic enum array argument
52f4a3f 
Add regression test for Mono crash when decoding custom attributes
with generic enum arguments involving arrays (PR #123439).

Uses GenericClassForEnum<int[]>.E to test the MONO_TYPE_GENERICINST
handling in custom attribute decoding.
lewing added a commit that referenced this pull request Feb 3, 2026
@lewing @MichalStrehovsky
Add test for custom attribute with generic enum array argument
a33c5e6 
Add regression test for Mono crash when decoding custom attributes
with generic enum arguments involving arrays (PR #123439).

Uses GenericClassForEnum<int[]>.E to test the MONO_TYPE_GENERICINST
handling in custom attribute decoding.

Co-authored-by: Michal Strehovsky <MichalStrehovsky@users.noreply.github.com>
@Venkad000
Copy link
Copy Markdown
Contributor Author

Venkad000 commented Feb 5, 2026

Can we merge this?

@giritrivedi
Copy link
Copy Markdown
Contributor

giritrivedi commented Feb 6, 2026 •
edited
Loading

@copilot
Can you check if everything is good and merger this PR. ?

@saitama951
Copy link
Copy Markdown
Contributor

saitama951 commented Feb 13, 2026

@lewing is the test case experimentation complete? can this be merged yet?

This was referenced Feb 23, 2026
Open
Closed
Closed
Closed
@giritrivedi
Copy link
Copy Markdown
Contributor

giritrivedi commented Mar 9, 2026

Can this be merged ?

@steveisok steveisok enabled auto-merge (squash) April 6, 2026 16:53
@steveisok
Copy link
Copy Markdown
Member

steveisok commented Apr 6, 2026

/ba-g Generic known issues

@steveisok steveisok merged commit f7fcd1c into dotnet:main Apr 6, 2026
74 of 76 checks passed
@Venkad000 Venkad000 deleted the roslynfix branch April 7, 2026 05:11
@dotnet-maestro dotnet-maestro Bot mentioned this pull request Apr 8, 2026
Merged
radekdoulik pushed a commit to radekdoulik/runtime that referenced this pull request Apr 9, 2026
@Venkad000 @lewing @radekdoulik
Avoid incorrectly resolving a MonoClass for MONO_TYPE_GENERICINST whe…
d68074f 
…n loading custom attribute values. (dotnet#123439)

Avoid incorrectly resolving a MonoClass for `MONO_TYPE_GENERICINST` when
loading custom attribute values.

`load_cattr_value()` previously unconditionally called
`m_type_data_get_klass()`, which is invalid for `GENERICINST` and could
lead to incorrect behavior when processing generic enum instances. This
change defers class resolution for `MONO_TYPE_GENERICINST` and handles
enum generic instances explicitly by extracting the underlying element
type. This fixes a crash when decoding custom attributes involving
generic types.

#### This crashes in Mono but doesn't in CoreClr

```
using System;
using System.Collections;
using System.Reflection;

using System.Runtime.InteropServices;

var attr = typeof(C).CustomAttributes.Single(d => d.AttributeType == typeof(A));
var arg = attr.ConstructorArguments.Single();
Console.WriteLine(arg.GetType());
class A : Attribute
{
    public unsafe A(B<delegate*<void>[]>.E e) { }
} 

class B<T>
{
    public enum E { }
}

[A(default)]
unsafe class C { }

```

#### Output on CoreClr:

```
System.Reflection.CustomAttributeTypedArgument
```

#### Output on Mono without fix:

```
MonoType with type 21 accessed by m_type_data_get_klass

=================================================================
	Native Crash Reporting
=================================================================
Got a SIGABRT while executing native code. This usually indicates
a fatal error in the mono runtime or one of the native libraries 
used by your application.
=================================================================

=================================================================
	Native stacktrace:
=================================================================
	0x7fa2a25ffd2f - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a25a3e0e - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a25ff5b1 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a2a29040 - /lib64/libc.so.6 : 
	0x7fa2a2a82e5c - /lib64/libc.so.6 : 
	0x7fa2a2a28f0e - /lib64/libc.so.6 : gsignal
	0x7fa2a2a106d0 - /lib64/libc.so.6 : abort
	0x7fa2a26ac244 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a26b9e06 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a26ac606 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a26ac73e - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a277445b - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a277408d - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a276ee74 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a276e9c4 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : mono_reflection_create_custom_attr_data_args
	0x7fa2a276fdbf - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x7fa2a2704f08 - /home/venkad/dotnet10.0.100-mono/shared/Microsoft.NETCore.App/10.0.0-dev/libcoreclr.so : 
	0x4037366b - Unknown

```

#### Output on Mono with fix:

```
System.Reflection.CustomAttributeTypedArgument
```

Co-authored-by: Larry Ewing <lewing@microsoft.com>
@pavelsavara pavelsavara mentioned this pull request Apr 16, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lewing lewing lewing approved these changes

@steveisok steveisok steveisok approved these changes

@thaystg thaystg Awaiting requested review from thaystg thaystg is a code owner

@vitek-karas vitek-karas Awaiting requested review from vitek-karas vitek-karas is a code owner

Assignees

No one assigned

Labels

area-VM-meta-mono community-contribution Indicates that the PR has been added by a community member

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Venkad000 @lewing @giritrivedi @saitama951 @steveisok