[ci-scan] Known Build Error: NativeAOT MethodTable::Validate assertion failure in System.Threading.Tasks.Parallel.Tests

[github-actions]

Build Information

Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1415421
Build error leg or test failing: linux-x64 Release NativeAOT_Checked_Libs_SizeOpt - System.Threading.Tasks.Parallel.Tests

Error Message

{
  "ErrorMessage": "MethodTable::Validate check failed",
  "BuildRetry": false,
  "ExcludeConsoleLog": false
}

Reasoning

System.Threading.Tasks.Parallel.Tests crashes with a native debug assertion MethodTable::Validate check failed (SIGABRT, exit code 134) when running under NativeAOT on linux-x64. The assertion fires in src/coreclr/nativeaot/Runtime/MethodTable.cpp:83. This is a NativeAOT runtime product bug, not a test issue.

Impact on platforms

• runtime-nativeaot-outerloop (def 265) · linux-x64 Release NativeAOT_Checked_Libs_SizeOpt · Debian.13.Amd64.Open · exit code 134 (SIGABRT)
• runtime-nativeaot-outerloop (def 265) · windows-x86 Release NativeAOT_Libs · exit code failure (same test)

Errors log

Debug Assertion Violation

Message: MethodTable::Validate check failed

Expression: 'ASSERT_UNCONDITIONALLY'

File: /__w/1/s/src/coreclr/nativeaot/Runtime/MethodTable.cpp, Line: 83

DOTNET_DbgEnableMiniDump is set and the createdump binary does not exist: ./createdump
./RunTests.sh: line 173:    18 Aborted                 (core dumped) ./System.Threading.Tasks.Parallel.Tests -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing -xml testResults.xml
exit code 134 means SIGABRT Abort.

First build it occurred

First seen in build 1414978 (2026-05-10) within the scanned window. Also present in build 1415421 (2026-05-11). 2 occurrences in the scanned window. This is within the scanned window and may not be the true origin.

Recommended action

This is a NativeAOT runtime bug in MethodTable validation. The crash occurs early in test execution (before any test results are produced), suggesting the issue may be in type initialization or GC scanning of MethodTable structures. Investigation should focus on src/coreclr/nativeaot/Runtime/MethodTable.cpp and recent changes to type layout or GC interaction in the NativeAOT runtime. cc @MichalStrehovsky @dotnet/ilc-contrib

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• dotnet.github.io

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "dotnet.github.io"

See Network Configuration for more information.

Note

🔒 Integrity filter blocked 4 items

The following items were blocked because they don't meet the GitHub integrity level.

• #116358 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #86273 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #125436 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #128019 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

Generated by CI Outer-Loop Failure Scanner · ● 56.5M · ◷

Report

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
0	0	0

Known issue validation

Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1415421
Error message validated: [MethodTable::Validate check failed]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 5/12/2026 11:31:54 AM UTC

Report

Build	Definition	Test	Pull Request
1417036	dotnet/runtime	System.Threading.Tasks.Parallel.Tests.WorkItemExecution
1415421	dotnet/runtime	System.Threading.Tasks.Parallel.Tests.WorkItemExecution

Summary

24-Hour Hit Count	7-Day Hit Count	1-Month Count
1	2	2

Known issue validation

Build: 🔎 https://dev.azure.com/dnceng-public/public/_build/results?buildId=1415421
Error message validated: [MethodTable::Validate check failed]
Result validation: ✅ Known issue matched with the provided build.
Validation performed at: 5/12/2026 11:31:54 AM UTC

[jkotas]

cc @mangod9

[MichalStrehovsky]

The crash is caused by bad GC info for rax across the thread-static TLS access in RuntimeAsyncTask<VoidTaskResult>.DispatchContinuations.

rax is still reported as a live GC ref until offset 0x108, but the linker-relaxed TLS sequence overwrites rax at offset 0x0f8/0x101 with a TLS address. The core stopped at +0x101, so GC promoted that TLS address as an object and hit MethodTable::Validate.

Key dump evidence:

; Assembly listing for method ...RuntimeAsyncTask`1[System.Threading.Tasks.VoidTaskResult]:DispatchContinuations():this (FullOpts)
; NativeAOT compilation
; fully interruptible

;  V18 tmp3  [V18,T06] ... ref  ->  rax  "calli"
;  V58 rat1  [V58,T27] ... long ->  rax  "TlsRootAddr access"

Register slot id for reg rax = 18.
Set state of slot 18 at instr offset 0xe8 to Live.
Set state of slot 18 at instr offset 0x108 to Dead.

The fixed ILC object still contains the TLSGD pattern over that range:

4e9b18: leaq (%rip), %rdi
          R_X86_64_TLSGD tls_InlinedThreadStatics-0x4
4e9b20: callq ... +0x108
          R_X86_64_PLT32 __tls_get_addr-0x4
4e9b28: movq (%rax), %r15

But the final crashing binary has that sequence relaxed to code that clobbers rax before 0x108:

103c4f8: movq %fs:0x0, %rax
103c501: leaq -0x128(%rax), %rax
103c508: movq (%rax), %r15

The core’s active GC enumeration state matches this exactly:

IP = 0x000060c7ecf25501
Summary: ...DispatchContinuations + 257 at AsyncHelpers.CoreCLR.cs:560

and the saved rax value was the invalid object GC tried to validate:

pRax = 0x0000798d32ffc590
0x798d32ffc590: 0x0000798d32ffd6c0
CObjectHeader::Validate(this=0x0000798d32ffd6c0, ...)

Conclusion: this is not a GC heap corruption bug. It is a NativeAOT/JIT GC-info correctness bug caused by rax remaining live as a GC ref through a TLS access sequence that can be linker-relaxed into instructions that overwrite rax. The live range should be killed before the TLS root-address sequence, not at 0x108.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[MichalStrehovsky]

Here's the full JitDisasm, not just the part from AI:

The <unknown method> is from my temp change to JitDisasm/JitDump support. It seems to be broken under native AOT, didn't investigate.

Relevant bit is the rax reporting here:

                            ; gcrRegs +[rax]
						;; size=15 bbWeight=1 PerfScore 2.00
G_M10894_IG06:        ; bbWeight=1, gcrefRegs=0001 {rax}, byrefRegs=0008 {rbx}, byref
                            ; gcrRegs -[r15]
0000E8 mov      rdi, gword ptr [rax+0x08]
                            ; gcrRegs +[rdi]
0000EC mov      gword ptr [rbp-0x40], rdi
0000F0 mov      rdi, gword ptr [rax+0x10]
0000F4 mov      gword ptr [rbp-0x38], rdi
0000F8 data16   
0000F9 lea      rdi, [(reloc 0x40000000004293b8)]
                            ; gcrRegs -[rdi]
000100 data16   
000101 data16   
000102 call     <unknown method>
                            ; gcrRegs -[rax]
000108 mov      r15, gword ptr [rax]
                            ; gcrRegs +[r15]

The rest:

; Assembly listing for method System.Runtime.CompilerServices.AsyncHelpers+RuntimeAsyncTask`1[System.Threading.Tasks.VoidTaskResult]:DispatchContinuations():this (FullOpts)
; Emitting BLENDED_CODE for x64 on Unix
; FullOpts code
; NativeAOT compilation
; optimized code
; rbp based frame
; fully interruptible
; Final local variable assignments
;
;  V00 this         [V00,T03] ( 11, 25   )     ref  ->  [rbp-0xB0]  this class-hnd exact EH-live single-def <System.Runtime.CompilerServices.AsyncHelpers+RuntimeAsyncTask`1[System.Threading.Tasks.VoidTaskResult]>
;  V01 loc0         [V01    ] (  4,  4   )  struct (72) [rbp-0x70]  do-not-enreg[XSF] must-init addr-exposed ld-addr-op <System.Runtime.CompilerServices.AsyncHelpers+RuntimeAsyncStackState>
;  V02 loc1         [V02,T00] ( 20, 42   )   byref  ->  [rbp-0xB8]  EH-live single-def
;  V03 loc2         [V03,T23] (  7,  8   )   byref  ->  [rbp-0xC0]  EH-live single-def
;  V04 loc3         [V04    ] ( 13, 33   )  struct (48) [rbp-0xA0]  do-not-enreg[XSF] must-init addr-exposed ld-addr-op <System.Runtime.CompilerServices.AsyncDispatcherInfo>
;* V05 loc4         [V05    ] (  0,  0   )     int  ->  zero-ref   
;  V06 loc5         [V06,T04] (  7, 24   )     ref  ->  r15         class-hnd <System.Runtime.CompilerServices.Continuation>
;  V07 loc6         [V07,T05] (  6, 24   )     ref  ->  r14         class-hnd <System.Runtime.CompilerServices.Continuation>
;* V08 loc7         [V08    ] (  0,  0   )   byref  ->  zero-ref   
;* V09 loc8         [V09    ] (  0,  0   )     ref  ->  zero-ref    class-hnd <System.Runtime.CompilerServices.Continuation>
;  V10 loc9         [V10,T10] (  5, 12.80)    long  ->  r12        
;* V11 loc10        [V11    ] (  0,  0   )     ref  ->  zero-ref    class-hnd <System.Exception>
;  V12 loc11        [V12    ] (  2,  0   )     int  ->  [rbp-0xA8]  do-not-enreg[X] addr-exposed ld-addr-op
;  V13 loc12        [V13,T36] (  5,  0   )     ref  ->  r15         class-hnd <System.Runtime.CompilerServices.Continuation>
;  V14 loc13        [V14,T38] (  4,  0   )     ref  ->  r14         class-hnd <System.OperationCanceledException>
;# V15 OutArgs      [V15    ] (  1,  1   )  struct ( 0) [rsp+0x00]  do-not-enreg[XS] addr-exposed "OutgoingArgSpace" <Empty>
;  V16 tmp1         [V16,T07] (  3, 24   )     ref  ->  r13         class-hnd exact "impAppendStmt" <System.Threading.Thread>
;  V17 tmp2         [V17,T11] (  4, 12   )   byref  ->  rdx        
;  V18 tmp3         [V18,T06] (  4, 24   )     ref  ->  rax         "calli"
;  V19 tmp4         [V19,T32] (  2,  4   )     int  ->  rbx         "impAppendStmt"
;  V20 tmp5         [V20,T37] (  5,  0   )     ref  ->  rbx         class-hnd "impSpillSpecialSideEff" <System.Exception>
;* V21 tmp6         [V21    ] (  0,  0   )  struct ( 8) zero-ref    multireg-ret "spilled call-like call argument" <System.Threading.CancellationToken>
;  V22 tmp7         [V22,T39] (  3,  0   )     int  ->  r14        
;  V23 tmp8         [V23,T30] (  2,  4   )     ref  ->  rax         class-hnd exact single-def "dup spill" <System.Threading.Thread>
;* V24 tmp9         [V24    ] (  0,  0   )    long  ->  zero-ref   
;  V25 tmp10        [V25,T25] (  5,  5   )     ref  ->  rax        
;* V26 tmp11        [V26    ] (  0,  0   )     ref  ->  zero-ref    class-hnd exact single-def "dup spill" <System.Threading.Thread>
;* V27 tmp12        [V27    ] (  0,  0   )     ref  ->  zero-ref    class-hnd exact single-def "Inline stloc first use temp" <System.Threading.Thread>
;  V28 tmp13        [V28,T31] (  2,  4   )     ref  ->  r15         class-hnd exact single-def "dup spill" <System.Threading.Thread>
;  V29 tmp14        [V29,T26] (  5,  5   )     ref  ->  r15        
;* V30 tmp15        [V30    ] (  0,  0   )     ref  ->  zero-ref    class-hnd exact single-def "Inlining Arg" <System.Threading.Thread>
;* V31 tmp16        [V31    ] (  0,  0   )   ubyte  ->  zero-ref    "Inlining Arg"
;* V32 tmp17        [V32    ] (  0,  0   )   ubyte  ->  zero-ref    "Inlining Arg"
;  V33 tmp18        [V33,T17] (  3, 12   )     int  ->  r12         "Inline stloc first use temp"
;* V34 tmp19        [V34    ] (  0,  0   )   ubyte  ->  zero-ref    "Inlining Arg"
;* V35 tmp20        [V35    ] (  0,  0   )   ubyte  ->  zero-ref    "Inlining Arg"
;  V36 tmp21        [V36,T12] (  3, 12   )     ref  ->  [rbp-0xC8]  class-hnd exact spill-single-def "Inline stloc first use temp" <System.Threading.ExecutionContext>
;  V37 tmp22        [V37,T02] (  4, 32   )     ref  ->  r12         class-hnd exact "Inlining Arg" <System.Threading.ExecutionContext>
;  V38 tmp23        [V38,T13] (  3, 12   )   byref  ->  rdx         "Inline return value spill temp"
;  V39 tmp24        [V39,T18] (  3, 12   )     int  ->  rdi         "Inline stloc first use temp"
;* V40 tmp25        [V40    ] (  0,  0   )   ubyte  ->  zero-ref    "Inlining Arg"
;  V41 tmp26        [V41,T08] (  3, 24   )   byref  ->  r15         "Inlining Arg"
;  V42 tmp27        [V42,T01] (  5, 40   )     ref  ->  r14         class-hnd exact "Inlining Arg" <System.Threading.Thread>
;  V43 tmp28        [V43,T14] (  3, 12   )     ref  ->  rdx         class-hnd exact "Inline stloc first use temp" <System.Threading.ExecutionContext>
;  V44 tmp29        [V44,T40] (  3,  0   )     int  ->  r14         "Inline stloc first use temp"
;* V45 tmp30        [V45    ] (  0,  0   )   ubyte  ->  zero-ref    "Inlining Arg"
;* V46 tmp31        [V46    ] (  0,  0   )   ubyte  ->  zero-ref    "Inlining Arg"
;* V47 tmp32        [V47    ] (  0,  0   )   ubyte  ->  zero-ref    "Inlining Arg"
;  V48 tmp33        [V48,T24] (  3,  6   )   byref  ->  r13         "Inlining Arg"
;  V49 tmp34        [V49,T22] (  5, 10   )     ref  ->  r14         class-hnd exact "Inlining Arg" <System.Threading.Thread>
;  V50 tmp35        [V50,T33] (  3,  3   )     ref  ->  rdx         class-hnd exact "Inline stloc first use temp" <System.Threading.ExecutionContext>
;  V51 tmp36        [V51,T41] (  2,  0   )     ref  ->  rsi         "field V21._source (fldOffset=0x0)" P-INDEP
;  V52 cse0         [V52,T15] (  3, 12   )     ref  ->  rsi         "CSE #01: moderate"
;  V53 cse1         [V53,T16] (  3, 12   )     ref  ->  rsi         "CSE #02: moderate"
;  V54 cse2         [V54,T34] (  3,  3   )     ref  ->  rsi         "CSE #04: moderate"
;  V55 cse3         [V55,T35] (  3,  3   )     ref  ->  rsi         "CSE #05: moderate"
;  V56 cse4         [V56,T09] (  3, 24   )     ref  ->  rsi         "CSE #03: moderate"
;  V57 rat0         [V57,T19] (  6, 10   )     ref  ->  rbx         "Final offset"
;  V58 rat1         [V58,T27] (  3,  4   )    long  ->  rax         "TlsRootAddr access"
;  V59 rat2         [V59,T20] (  6, 10   )     ref  ->  r15         "Final offset"
;  V60 rat3         [V60,T28] (  3,  4   )    long  ->  rax         "TlsRootAddr access"
;  V61 rat4         [V61,T21] (  6, 10   )     ref  ->  r15         "Final offset"
;  V62 rat5         [V62,T29] (  3,  4   )    long  ->  rax         "TlsRootAddr access"
;
; Lcl frame size = 168

G_M10894_IG01:        ; bbWeight=1, gcrefRegs=0000 {}, byrefRegs=0000 {}, byref, nogc <-- Prolog IG
000000 push     rbp
000001 push     r15
000003 push     r14
000005 push     r13
000007 push     r12
000009 push     rbx
00000A sub      rsp, 168
000011 lea      rbp, [rsp+0xD0]
000019 xorps    xmm8, xmm8
00001D movaps   xmmword ptr [rbp-0xA0], xmm8
000025 mov      rax, -96
00002F movaps   xmmword ptr [rbp+rax-0x30], xmm8
000035 movaps   xmmword ptr [rbp+rax-0x20], xmm8
00003B movaps   xmmword ptr [rbp+rax-0x10], xmm8
000041 add      rax, 48
000045 jne      SHORT  -5 instr
000047 mov      qword ptr [rbp-0x30], rax
00004B mov      gword ptr [rbp-0xB0], rdi
                            ; GC ptr vars +{V00}
						;; size=82 bbWeight=1 PerfScore 14.58
G_M10894_IG02:        ; bbWeight=1, gcVars=0000000000000008 {V00}, gcrefRegs=0000 {}, byrefRegs=0000 {}, gcvars, byref
000052 call     System.Runtime.CompilerServices.AsyncInstrumentation:get_IsSupported():bool
                            ; gcr arg pop 0
000057 test     eax, eax
000059 jne      G_M10894_IG34
00005F data16   
000060 lea      rdi, [(reloc 0x40000000004293b8)]
000067 data16   
000068 data16   
000069 call     <unknown method>
00006F mov      rbx, gword ptr [rax]
                            ; gcrRegs +[rbx]
000072 test     rbx, rbx
000075 je       G_M10894_IG35
						;; size=41 bbWeight=1 PerfScore 7.75
G_M10894_IG03:        ; bbWeight=1, gcrefRegs=0008 {rbx}, byrefRegs=0000 {}, byref, isz
00007B add      rbx, 264
                            ; gcrRegs -[rbx]
                            ; byrRegs +[rbx]
000082 mov      bword ptr [rbp-0xB8], rbx
                            ; GC ptr vars +{V02}
000089 mov      rbx, bword ptr [rbp-0xB8]
000090 mov      rdi, qword ptr [rbx+0x10]
000094 mov      qword ptr [rbp-0x30], rdi
000098 lea      rdi, [rbp-0x70]
00009C mov      qword ptr [rbx+0x10], rdi
0000A0 mov      rax, gword ptr [rbx+0x08]
                            ; gcrRegs +[rax]
0000A4 test     rax, rax
0000A7 jne      SHORT G_M10894_IG06
0000A9 data16   
0000AA lea      rdi, [(reloc 0x40000000004293b8)]
0000B1 data16   
0000B2 data16   
0000B3 call     <unknown method>
                            ; gcrRegs -[rax]
0000B9 mov      r15, gword ptr [rax]
                            ; gcrRegs +[r15]
0000BC test     r15, r15
0000BF je       G_M10894_IG36
						;; size=74 bbWeight=1 PerfScore 15.50
G_M10894_IG04:        ; bbWeight=1, gcrefRegs=8000 {r15}, byrefRegs=0008 {rbx}, byref, isz
0000C5 mov      r15, gword ptr [r15+0x88]
0000CC test     r15, r15
0000CF jne      SHORT G_M10894_IG05
0000D1 call     System.Threading.Thread:InitializeCurrentThread():System.Threading.Thread
                            ; gcrRegs -[r15] +[rax]
                            ; gcr arg pop 0
0000D6 mov      r15, rax
                            ; gcrRegs +[r15]
						;; size=20 bbWeight=1 PerfScore 4.50
G_M10894_IG05:        ; bbWeight=1, gcrefRegs=8000 {r15}, byrefRegs=0008 {rbx}, byref
                            ; gcrRegs -[rax]
0000D9 lea      rdi, bword ptr [rbx+0x08]
                            ; byrRegs +[rdi]
0000DD mov      rsi, r15
                            ; gcrRegs +[rsi]
0000E0 call     CORINFO_HELP_CHECKED_ASSIGN_REF
                            ; gcrRegs -[rsi]
                            ; byrRegs -[rdi]
0000E5 mov      rax, r15
                            ; gcrRegs +[rax]
						;; size=15 bbWeight=1 PerfScore 2.00
G_M10894_IG06:        ; bbWeight=1, gcrefRegs=0001 {rax}, byrefRegs=0008 {rbx}, byref
                            ; gcrRegs -[r15]
0000E8 mov      rdi, gword ptr [rax+0x08]
                            ; gcrRegs +[rdi]
0000EC mov      gword ptr [rbp-0x40], rdi
0000F0 mov      rdi, gword ptr [rax+0x10]
0000F4 mov      gword ptr [rbp-0x38], rdi
0000F8 data16   
0000F9 lea      rdi, [(reloc 0x40000000004293b8)]
                            ; gcrRegs -[rdi]
000100 data16   
000101 data16   
000102 call     <unknown method>
                            ; gcrRegs -[rax]
000108 mov      r15, gword ptr [rax]
                            ; gcrRegs +[r15]
00010B test     r15, r15
00010E je       G_M10894_IG37
						;; size=44 bbWeight=1 PerfScore 11.50
G_M10894_IG07:        ; bbWeight=1, gcrefRegs=8000 {r15}, byrefRegs=0008 {rbx}, byref
000114 lea      rdi, bword ptr [r15+0x100]
                            ; byrRegs +[rdi]
00011B mov      bword ptr [rbp-0xC0], rdi
                            ; GC ptr vars +{V03}
000122 mov      rdi, bword ptr [rbp-0xC0]
000129 mov      rax, qword ptr [rdi]
00012C mov      qword ptr [rbp-0xA0], rax
000133 mov      rdi, gword ptr [rbp-0xB0]
                            ; gcrRegs +[rdi]
                            ; byrRegs -[rdi]
00013A call     System.Runtime.CompilerServices.AsyncHelpers+RuntimeAsyncTask`1[System.Threading.Tasks.VoidTaskResult]:MoveContinuationState():System.Runtime.CompilerServices.Continuation:this
                            ; gcrRegs -[rdi r15] +[rax]
                            ; gcr arg pop 0
00013F mov      gword ptr [rbp-0x98], rax
000146 lea      rdi, [rbp-0xA0]
00014D mov      rax, bword ptr [rbp-0xC0]
                            ; gcrRegs -[rax]
                            ; byrRegs +[rax]
000154 mov      qword ptr [rax], rdi
						;; size=67 bbWeight=1 PerfScore 11.00
G_M10894_IG08:        ; bbWeight=8, gcrefRegs=0000 {}, byrefRegs=0008 {rbx}, byref, isz
                            ; byrRegs -[rax]
000157 cmp      gword ptr [rbp-0x98], 0
00015F jne      SHORT G_M10894_IG10
						;; size=10 bbWeight=8 PerfScore 16.00
G_M10894_IG09:        ; bbWeight=4, gcrefRegs=0000 {}, byrefRegs=0008 {rbx}, byref
000161 lea      rdi, gword ptr [(reloc 0x4000000000469730)]      ; '"asyncDispatcherInfo.NextContinuation != null"'
                            ; gcrRegs +[rdi]
000168 lea      rsi, gword ptr [(reloc 0x40000000004274a0)]      ; '""'
                            ; gcrRegs +[rsi]
00016F call     System.Diagnostics.Debug:Fail(System.String,System.String)
                            ; gcrRegs -[rsi rdi]
                            ; gcr arg pop 0
000174 nop      
						;; size=20 bbWeight=4 PerfScore 9.00
G_M10894_IG10:        ; bbWeight=4, gcrefRegs=0000 {}, byrefRegs=0008 {rbx}, byref, isz
000175 mov      r15, gword ptr [rbp-0x98]
                            ; gcrRegs +[r15]
00017C mov      r14, gword ptr [r15+0x08]
                            ; gcrRegs +[r14]
000180 mov      gword ptr [rbp-0x98], r14
000187 cmp      gword ptr [rbx+0x08], 0
00018C jne      SHORT G_M10894_IG11
00018E lea      rdi, gword ptr [(reloc 0x4000000000469738)]      ; '"awaitState.CurrentThread != null"'
                            ; gcrRegs +[rdi]
000195 lea      rsi, gword ptr [(reloc 0x40000000004274a0)]      ; '""'
                            ; gcrRegs +[rsi]
00019C call     System.Diagnostics.Debug:Fail(System.String,System.String)
                            ; gcrRegs -[rsi rdi]
                            ; gcr arg pop 0
						;; size=44 bbWeight=4 PerfScore 36.00
G_M10894_IG11:        ; bbWeight=4, gcrefRegs=C000 {r14 r15}, byrefRegs=0008 {rbx}, byref, isz
0001A1 mov      r13, gword ptr [rbx+0x08]
                            ; gcrRegs +[r13]
0001A5 mov      r12d, dword ptr [r15+0x18]
0001A9 shr      r12d, 3
0001AD and      r12d, 3
0001B1 jne      SHORT G_M10894_IG12
0001B3 lea      rdi, gword ptr [(reloc 0x4000000000469740)]      ; '"index != 0"'
                            ; gcrRegs +[rdi]
0001BA lea      rsi, gword ptr [(reloc 0x40000000004274a0)]      ; '""'
                            ; gcrRegs +[rsi]
0001C1 call     System.Diagnostics.Debug:Fail(System.String,System.String)
                            ; gcrRegs -[rsi rdi]
                            ; gcr arg pop 0
						;; size=37 bbWeight=4 PerfScore 31.00
G_M10894_IG12:        ; bbWeight=4, gcrefRegs=E000 {r13 r14 r15}, byrefRegs=0008 {rbx}, byref, isz
0001C6 lea      ecx, [8*r12+0x10]
0001CE mov      r12, gword ptr [r15+rcx+0x08]
                            ; gcrRegs +[r12]
0001D3 mov      rcx, gword ptr [r13+0x08]
                            ; gcrRegs +[rcx]
0001D7 mov      gword ptr [rbp-0xC8], rcx
                            ; GC ptr vars +{V36}
0001DE cmp      r12, rcx
0001E1 je       SHORT G_M10894_IG14
0001E3 mov      rcx, gword ptr [rbp-0xC8]
0001EA lea      rdx, [(reloc 0x4000000000469750)]
0001F1 cmp      qword ptr [rdx-0x08], 0
0001F6 jne      G_M10894_IG25
						;; size=54 bbWeight=4 PerfScore 45.00
G_M10894_IG13:        ; bbWeight=4, gcVars=0000000000801009 {V00 V02 V03 V36}, gcrefRegs=F002 {rcx r12 r13 r14 r15}, byrefRegs=0008 {rbx}, gcvars, byref, isz
0001FC mov      rdi, qword ptr [(reloc 0x4000000000469758)]
000203 cmp      gword ptr [rdi+0x10], r12
000207 je       SHORT G_M10894_IG14
000209 mov      rdi, r13
                            ; gcrRegs +[rdi]
00020C mov      rsi, r12
                            ; gcrRegs +[rsi]
00020F mov      rdx, rcx
                            ; gcrRegs +[rdx]
                            ; GC ptr vars -{V36}
000212 call     System.Threading.ExecutionContext:RestoreChangedContextToThread(System.Threading.Thread,System.Threading.ExecutionContext,System.Threading.ExecutionContext)
                            ; gcrRegs -[rcx rdx rsi rdi r12-r13]
                            ; gcr arg pop 0
						;; size=27 bbWeight=4 PerfScore 27.00
G_M10894_IG14:        ; bbWeight=4, gcrefRegs=C000 {r14 r15}, byrefRegs=0008 {rbx}, byref, isz
000217 test     r14, r14
00021A je       SHORT G_M10894_IG17
00021C mov      edi, dword ptr [r14+0x18]
000220 shr      edi, 10
000223 and      edi, 0x3FFFFF
000229 je       SHORT G_M10894_IG15
00022B lea      edi, [8*rdi+0x10]
000232 lea      rdx, bword ptr [r14+rdi+0x08]
                            ; byrRegs +[rdx]
000237 jmp      SHORT G_M10894_IG16
						;; size=34 bbWeight=4 PerfScore 34.00
G_M10894_IG15:        ; bbWeight=4, gcrefRegs=C000 {r14 r15}, byrefRegs=0008 {rbx}, byref
                            ; byrRegs -[rdx]
000239 xor      rdx, rdx
                            ; byrRegs +[rdx]
						;; size=2 bbWeight=4 PerfScore 1.00
G_M10894_IG16:        ; bbWeight=4, gcrefRegs=C000 {r14 r15}, byrefRegs=000C {rdx rbx}, byref, isz
00023B mov      r13, gword ptr [rbp-0xB0]
                            ; gcrRegs +[r13]
000242 jmp      SHORT G_M10894_IG18
						;; size=9 bbWeight=4 PerfScore 12.00
G_M10894_IG17:        ; bbWeight=4, gcrefRegs=C000 {r14 r15}, byrefRegs=0008 {rbx}, byref
                            ; gcrRegs -[r13]
                            ; byrRegs -[rdx]
000244 mov      r13, gword ptr [rbp-0xB0]
                            ; gcrRegs +[r13]
00024B cmp      byte  ptr [r13], r13b
00024F lea      rdx, bword ptr [r13+0x38]
                            ; byrRegs +[rdx]
						;; size=15 bbWeight=4 PerfScore 14.00
G_M10894_IG18:        ; bbWeight=4, gcrefRegs=E000 {r13 r14 r15}, byrefRegs=000C {rdx rbx}, byref, isz
000253 mov      rdi, qword ptr [r15+0x10]
000257 mov      r12, qword ptr [rdi]
00025A test     r12b, 2
00025E je       SHORT G_M10894_IG20
						;; size=13 bbWeight=4 PerfScore 21.00
G_M10894_IG19:        ; bbWeight=0.80, gcrefRegs=E000 {r13 r14 r15}, byrefRegs=000C {rdx rbx}, byref, isz
000260 mov      rdi, qword ptr [r12+0x06]
000265 mov      rsi, r15
                            ; gcrRegs +[rsi]
000268 call     [r12-0x02]
                            ; gcrRegs -[rsi r15] +[rax]
                            ; byrRegs -[rdx]
                            ; gcr arg pop 0
00026D jmp      SHORT G_M10894_IG21
						;; size=15 bbWeight=0.80 PerfScore 5.80
G_M10894_IG20:        ; bbWeight=3.20, gcrefRegs=E000 {r13 r14 r15}, byrefRegs=000C {rdx rbx}, byref
                            ; gcrRegs -[rax] +[r15]
                            ; byrRegs +[rdx]
00026F mov      rdi, r15
                            ; gcrRegs +[rdi]
000272 mov      rsi, rdx
                            ; byrRegs +[rsi]
000275 call     r12
                            ; gcrRegs -[rdi r15] +[rax]
                            ; byrRegs -[rdx rsi]
                            ; gcr arg pop 0
						;; size=9 bbWeight=3.20 PerfScore 11.20
G_M10894_IG21:        ; bbWeight=4, gcrefRegs=6001 {rax r13 r14}, byrefRegs=0008 {rbx}, byref, isz
000278 test     rax, rax
00027B je       G_M10894_IG26
000281 lea      rdi, bword ptr [rax+0x08]
                            ; byrRegs +[rdi]
000285 mov      rsi, r14
                            ; gcrRegs +[rsi]
000288 call     CORINFO_HELP_ASSIGN_REF
                            ; gcrRegs -[rax rsi r14]
                            ; byrRegs -[rdi]
00028D mov      rdi, r13
                            ; gcrRegs +[rdi]
000290 mov      rsi, rbx
                            ; byrRegs +[rsi]
000293 call     System.Runtime.CompilerServices.AsyncHelpers+RuntimeAsyncTask`1[System.Threading.Tasks.VoidTaskResult]:HandleSuspended(byref):bool:this
                            ; gcrRegs -[rdi]
                            ; byrRegs -[rsi]
                            ; gcr arg pop 0
000298 cmp      gword ptr [rbx+0x08], 0
00029D jne      SHORT G_M10894_IG22
00029F lea      rdi, gword ptr [(reloc 0x4000000000469748)]      ; '"CurrentThread != null"'
                            ; gcrRegs +[rdi]
0002A6 lea      rsi, gword ptr [(reloc 0x40000000004274a0)]      ; '""'
                            ; gcrRegs +[rsi]
0002AD call     System.Diagnostics.Debug:Fail(System.String,System.String)
                            ; gcrRegs -[rsi rdi]
                            ; gcr arg pop 0
						;; size=58 bbWeight=4 PerfScore 38.00
G_M10894_IG22:        ; bbWeight=4, gcrefRegs=2000 {r13}, byrefRegs=0008 {rbx}, byref, isz
0002B2 mov      r15, qword ptr [rbx+0x10]
0002B6 mov      r14, gword ptr [rbx+0x08]
                            ; gcrRegs +[r14]
0002BA mov      rsi, gword ptr [r15+0x38]
                            ; gcrRegs +[rsi]
0002BE cmp      rsi, gword ptr [r14+0x10]
0002C2 je       SHORT G_M10894_IG23
0002C4 lea      rdi, bword ptr [r14+0x10]
                            ; byrRegs +[rdi]
0002C8 call     CORINFO_HELP_ASSIGN_REF
                            ; gcrRegs -[rsi]
                            ; byrRegs -[rdi] +[r15]
						;; size=27 bbWeight=4 PerfScore 42.00
G_M10894_IG23:        ; bbWeight=4, gcrefRegs=6000 {r13 r14}, byrefRegs=8008 {rbx r15}, byref, isz
0002CD mov      rdx, gword ptr [r14+0x08]
                            ; gcrRegs +[rdx]
0002D1 mov      rsi, gword ptr [r15+0x30]
                            ; gcrRegs +[rsi]
0002D5 cmp      rsi, rdx
0002D8 je       SHORT G_M10894_IG24
0002DA mov      rdi, r14
                            ; gcrRegs +[rdi]
0002DD call     System.Threading.ExecutionContext:RestoreChangedContextToThread(System.Threading.Thread,System.Threading.ExecutionContext,System.Threading.ExecutionContext)
                            ; gcrRegs -[rdx rsi rdi r14]
                            ; byrRegs -[r15]
                            ; gcr arg pop 0
						;; size=21 bbWeight=4 PerfScore 26.00
G_M10894_IG24:        ; bbWeight=4, gcrefRegs=2000 {r13}, byrefRegs=0008 {rbx}, byref, isz
0002E2 mov      rdi, qword ptr [rbx+0x10]
0002E6 mov      rdi, qword ptr [rdi+0x40]
0002EA mov      qword ptr [rbx+0x10], rdi
0002EE mov      rdi, qword ptr [rbp-0xA0]
0002F5 mov      rax, bword ptr [rbp-0xC0]
                            ; byrRegs +[rax]
0002FC mov      qword ptr [rax], rdi
0002FF jmp      SHORT G_M10894_IG29
						;; size=31 bbWeight=4 PerfScore 40.00
G_M10894_IG25:        ; bbWeight=0, gcVars=0000000000801009 {V00 V02 V03 V36}, gcrefRegs=F002 {rcx r12 r13 r14 r15}, byrefRegs=0008 {rbx}, gcvars, byref, isz
                            ; gcrRegs +[rcx r12 r14-r15]
                            ; byrRegs -[rax]
                            ; GC ptr vars +{V36}
000301 call     CORINFO_HELP_READYTORUN_GCSTATIC_BASE
                            ; gcrRegs -[rcx]
                            ; gcr arg pop 0
000306 mov      rcx, gword ptr [rbp-0xC8]
                            ; gcrRegs +[rcx]
00030D jmp      G_M10894_IG13
000312 align    [0 bytes for IG27]
						;; size=17 bbWeight=0 PerfScore 0.00
G_M10894_IG26:        ; bbWeight=8, gcVars=0000000000800009 {V00 V02 V03}, gcrefRegs=0000 {}, byrefRegs=0000 {}, gcvars, byref, isz
                            ; gcrRegs -[rcx r12-r15]
                            ; byrRegs -[rbx]
                            ; GC ptr vars -{V36}
000312 mov      rsi, gword ptr [rbp-0x98]
                            ; gcrRegs +[rsi]
000319 test     rsi, rsi
00031C je       SHORT G_M10894_IG30
00031E mov      rdi, gword ptr [rbp-0xB0]
                            ; gcrRegs +[rdi]
000325 call     System.Runtime.CompilerServices.AsyncHelpers+RuntimeAsyncTask`1[System.Threading.Tasks.VoidTaskResult]:QueueContinuationFollowUpActionIfNecessary(System.Runtime.CompilerServices.Continuation):bool:this
                            ; gcrRegs -[rsi rdi]
                            ; gcr arg pop 0
00032A test     eax, eax
00032C jne      SHORT G_M10894_IG28
00032E call     System.Runtime.CompilerServices.AsyncInstrumentation:get_IsSupported():bool
                            ; gcr arg pop 0
000333 test     eax, eax
000335 mov      rbx, bword ptr [rbp-0xB8]
                            ; byrRegs +[rbx]
00033C je       G_M10894_IG08
						;; size=48 bbWeight=8 PerfScore 70.00
G_M10894_IG27:        ; bbWeight=8, gcVars=0000000000000000 {}, gcrefRegs=0000 {}, byrefRegs=0000 {}, loop=IG27, gcvars, byref, isz
                            ; byrRegs -[rbx]
                            ; GC ptr vars -{V00 V02 V03}
000342 jmp      SHORT G_M10894_IG27
						;; size=2 bbWeight=8 PerfScore 16.00
G_M10894_IG28:        ; bbWeight=1, gcVars=0000000000800001 {V02 V03}, gcrefRegs=0000 {}, byrefRegs=0000 {}, gcvars, byref
                            ; GC ptr vars +{V00 V02 V03 V23}
000344 mov      rdi, bword ptr [rbp-0xB8]
                            ; byrRegs +[rdi]
                            ; GC ptr vars -{V00 V02 V23}
00034B call     System.Runtime.CompilerServices.AsyncHelpers+RuntimeAsyncAwaitState:Pop():this
                            ; byrRegs -[rdi]
                            ; gcr arg pop 0
000350 mov      rsi, qword ptr [rbp-0xA0]
000357 mov      rax, bword ptr [rbp-0xC0]
                            ; byrRegs +[rax]
00035E mov      qword ptr [rax], rsi
						;; size=29 bbWeight=1 PerfScore 5.00
G_M10894_IG29:        ; bbWeight=1, gcVars=0000000000000000 {}, gcrefRegs=0000 {}, byrefRegs=0000 {}, gcvars, byref, epilog, nogc
                            ; byrRegs -[rax]
                            ; GC ptr vars -{V03}
000361 add      rsp, 168
000368 pop      rbx
000369 pop      r12
00036B pop      r13
00036D pop      r14
00036F pop      r15
000371 pop      rbp
000372 ret      
						;; size=18 bbWeight=1 PerfScore 4.25
G_M10894_IG30:        ; bbWeight=1, gcVars=0000000000800009 {V00 V02 V03}, gcrefRegs=0000 {}, byrefRegs=0000 {}, gcvars, byref, isz
                            ; GC ptr vars +{V00 V02 V03 V23}
000373 mov      r13, gword ptr [rbp-0xB0]
                            ; gcrRegs +[r13]
00037A movzx    rsi, byte  ptr [r13+0x38]
00037F mov      rdi, r13
                            ; gcrRegs +[rdi]
                            ; GC ptr vars -{V00 V03 V23}
000382 call     System.Threading.Tasks.Task`1[System.Threading.Tasks.VoidTaskResult]:TrySetResult(System.Threading.Tasks.VoidTaskResult):bool:this
                            ; gcrRegs -[rdi r13]
                            ; gcr arg pop 0
000387 mov      ebx, eax
000389 mov      r15, bword ptr [rbp-0xB8]
                            ; byrRegs +[r15]
000390 cmp      gword ptr [r15+0x08], 0
000395 jne      SHORT G_M10894_IG31
000397 lea      rdi, gword ptr [(reloc 0x4000000000469748)]      ; '"CurrentThread != null"'
                            ; gcrRegs +[rdi]
00039E lea      rsi, gword ptr [(reloc 0x40000000004274a0)]      ; '""'
                            ; gcrRegs +[rsi]
0003A5 call     System.Diagnostics.Debug:Fail(System.String,System.String)
                            ; gcrRegs -[rsi rdi]
                            ; gcr arg pop 0
						;; size=55 bbWeight=1 PerfScore 10.50
G_M10894_IG31:        ; bbWeight=1, gcrefRegs=0000 {}, byrefRegs=8000 {r15}, byref, isz
0003AA mov      r13, qword ptr [r15+0x10]
0003AE mov      r14, gword ptr [r15+0x08]
                            ; gcrRegs +[r14]
0003B2 mov      rsi, gword ptr [r13+0x38]
                            ; gcrRegs +[rsi]
0003B6 cmp      rsi, gword ptr [r14+0x10]
0003BA je       SHORT G_M10894_IG32
0003BC lea      rdi, bword ptr [r14+0x10]
                            ; byrRegs +[rdi]
0003C0 call     CORINFO_HELP_ASSIGN_REF
                            ; gcrRegs -[rsi]
                            ; byrRegs -[rdi] +[r13]
						;; size=27 bbWeight=1 PerfScore 10.50
G_M10894_IG32:        ; bbWeight=1, gcrefRegs=4000 {r14}, byrefRegs=A000 {r13 r15}, byref, isz
0003C5 mov      rdx, gword ptr [r14+0x08]
                            ; gcrRegs +[rdx]
0003C9 mov      rsi, gword ptr [r13+0x30]
                            ; gcrRegs +[rsi]
0003CD cmp      rsi, rdx
0003D0 je       SHORT G_M10894_IG33
0003D2 mov      rdi, r14
                            ; gcrRegs +[rdi]
0003D5 call     System.Threading.ExecutionContext:RestoreChangedContextToThread(System.Threading.Thread,System.Threading.ExecutionContext,System.Threading.ExecutionContext)
                            ; gcrRegs -[rdx rsi rdi r14]
                            ; byrRegs -[r13]
                            ; gcr arg pop 0
						;; size=21 bbWeight=1 PerfScore 6.50
G_M10894_IG33:        ; bbWeight=1, gcrefRegs=0000 {}, byrefRegs=8000 {r15}, byref, isz
0003DA mov      rdi, qword ptr [r15+0x10]
0003DE mov      rdi, qword ptr [rdi+0x40]
0003E2 mov      qword ptr [r15+0x10], rdi
0003E6 mov      rdi, qword ptr [rbp-0xA0]
0003ED mov      rax, bword ptr [rbp-0xC0]
                            ; byrRegs +[rax]
0003F4 mov      qword ptr [rax], rdi
0003F7 test     ebx, ebx
0003F9 jne      G_M10894_IG29
0003FF jmp      SHORT G_M10894_IG38
000401 align    [0 bytes for IG34]
						;; size=39 bbWeight=1 PerfScore 11.25
G_M10894_IG34:        ; bbWeight=8, gcVars=0000000000000000 {}, gcrefRegs=0000 {}, byrefRegs=0000 {}, loop=IG34, gcvars, byref, isz
                            ; byrRegs -[rax r15]
                            ; GC ptr vars -{V02}
000401 jmp      SHORT G_M10894_IG34
						;; size=2 bbWeight=8 PerfScore 16.00
G_M10894_IG35:        ; bbWeight=0, gcVars=0000000000000008 {V00}, gcrefRegs=0000 {}, byrefRegs=0000 {}, gcvars, byref
                            ; GC ptr vars +{V00 V03}
000403 mov      rdi, rax
000406 lea      rax, [(reloc 0x40000000004293c0)]
00040D call     rax
                            ; gcrRegs +[rax]
                            ; gcr arg pop 0
00040F mov      rbx, rax
                            ; gcrRegs +[rbx]
000412 jmp      G_M10894_IG03
						;; size=20 bbWeight=0 PerfScore 0.00
G_M10894_IG36:        ; bbWeight=0, gcVars=0000000000000009 {V00 V02}, gcrefRegs=0000 {}, byrefRegs=0008 {rbx}, gcvars, byref
                            ; gcrRegs -[rax rbx]
                            ; byrRegs +[rbx]
                            ; GC ptr vars -{V03} +{V02}
000417 mov      rdi, rax
00041A lea      rax, [(reloc 0x40000000004293c0)]
000421 call     rax
                            ; gcrRegs +[rax]
                            ; gcr arg pop 0
000423 mov      r15, rax
                            ; gcrRegs +[r15]
000426 jmp      G_M10894_IG04
						;; size=20 bbWeight=0 PerfScore 0.00
G_M10894_IG37:        ; bbWeight=0, gcrefRegs=0000 {}, byrefRegs=0008 {rbx}, byref
                            ; gcrRegs -[rax r15]
00042B mov      rdi, rax
00042E lea      rax, [(reloc 0x40000000004293c0)]
000435 call     rax
                            ; gcrRegs +[rax]
                            ; gcr arg pop 0
000437 mov      r15, rax
                            ; gcrRegs +[r15]
00043A jmp      G_M10894_IG07
						;; size=20 bbWeight=0 PerfScore 0.00
G_M10894_IG38:        ; bbWeight=0, gcVars=0000000000000000 {}, gcrefRegs=0000 {}, byrefRegs=0000 {}, gcvars, byref
                            ; gcrRegs -[rax r15]
                            ; byrRegs -[rbx]
                            ; GC ptr vars -{V00 V02}
00043F mov      edi, 24
000444 call     System.ThrowHelper:ThrowInvalidOperationException(int)
                            ; gcr arg pop 0
000449 int3     
						;; size=11 bbWeight=0 PerfScore 0.00
G_M10894_IG39:        ; bbWeight=0, gcVars=0000000000800009 {V00 V02 V03}, gcrefRegs=0080 {rdi}, byrefRegs=0000 {}, gcvars, byref, funclet prolog, nogc
                            ; gcrRegs +[rdi]
                            ; GC ptr vars +{V00 V02 V03 V23}
00044A push     rax
						;; size=1 bbWeight=0 PerfScore 0.00
G_M10894_IG40:        ; bbWeight=0, gcVars=0000000000800009 {V00 V02 V03}, gcrefRegs=0080 {rdi}, byrefRegs=0000 {}, gcvars, byref, isz
00044B mov      rbx, rdi
                            ; gcrRegs +[rbx]
00044E mov      dword ptr [rbp-0xA8], 1
000458 lea      rdx, [rbp-0xA8]
00045F mov      rdi, gword ptr [rbp-0x98]
000466 mov      rsi, rbx
                            ; gcrRegs +[rsi]
000469 call     System.Runtime.CompilerServices.AsyncHelpers+RuntimeAsyncTask`1[System.Threading.Tasks.VoidTaskResult]:UnwindToPossibleHandler(System.Runtime.CompilerServices.Continuation,System.Exception,byref):System.Runtime.CompilerServices.Continuation
                            ; gcrRegs -[rsi rdi] +[rax]
                            ; gcr arg pop 0
00046E mov      r15, rax
                            ; gcrRegs +[r15]
000471 test     r15, r15
000474 jne      G_M10894_IG45
00047A mov      r15, bword ptr [rbp-0xB8]
                            ; gcrRegs -[r15]
                            ; byrRegs +[r15]
000481 mov      rsi, rbx
                            ; gcrRegs +[rsi]
000484 lea      rdi, [(reloc 0x4000000000457a78)]      ; System.OperationCanceledException
00048B call     CORINFO_HELP_ISINSTANCEOFCLASS
                            ; gcrRegs -[rsi]
                            ; gcr arg pop 0
000490 mov      r14, rax
                            ; gcrRegs +[r14]
000493 test     r14, r14
000496 jne      SHORT G_M10894_IG41
000498 mov      rdi, gword ptr [rbp-0xB0]
                            ; gcrRegs +[rdi]
00049F mov      rsi, rbx
                            ; gcrRegs +[rsi]
                            ; GC ptr vars -{V00 V03 V23}
0004A2 call     System.Threading.Tasks.Task:TrySetException(System.Object):bool:this
                            ; gcrRegs -[rax rbx rsi rdi r14]
                            ; gcr arg pop 0
0004A7 mov      r14d, eax
0004AA jmp      SHORT G_M10894_IG42
						;; size=97 bbWeight=0 PerfScore 0.00
G_M10894_IG41:        ; bbWeight=0, gcVars=0000000000800009 {V00 V02 V03}, gcrefRegs=4000 {r14}, byrefRegs=8000 {r15}, gcvars, byref
                            ; gcrRegs +[r14]
                            ; GC ptr vars +{V00 V03}
0004AC mov      rdi, r14
                            ; gcrRegs +[rdi]
0004AF call     System.OperationCanceledException:get_CancellationToken():System.Threading.CancellationToken:this
                            ; gcrRegs -[rdi] +[rax]
                            ; gcr arg pop 0
0004B4 mov      rsi, rax
                            ; gcrRegs +[rsi]
0004B7 mov      rdi, gword ptr [rbp-0xB0]
                            ; gcrRegs +[rdi]
0004BE mov      rdx, r14
                            ; gcrRegs +[rdx]
                            ; GC ptr vars -{V00 V03}
0004C1 call     System.Threading.Tasks.Task:TrySetCanceled(System.Threading.CancellationToken,System.Object):bool:this
                            ; gcrRegs -[rax rdx rsi rdi r14]
                            ; gcr arg pop 0
0004C6 mov      r14d, eax
						;; size=29 bbWeight=0 PerfScore 0.00
G_M10894_IG42:        ; bbWeight=0, gcrefRegs=0000 {}, byrefRegs=8000 {r15}, byref, isz
0004C9 mov      rdi, r15
                            ; byrRegs +[rdi]
                            ; GC ptr vars -{V02} +{V03}
0004CC call     System.Runtime.CompilerServices.AsyncHelpers+RuntimeAsyncAwaitState:Pop():this
                            ; byrRegs -[rdi r15]
                            ; gcr arg pop 0
0004D1 mov      rdi, qword ptr [rbp-0xA0]
0004D8 mov      rax, bword ptr [rbp-0xC0]
                            ; byrRegs +[rax]
0004DF mov      qword ptr [rax], rdi
0004E2 test     r14d, r14d
0004E5 jne      SHORT G_M10894_IG43
0004E7 mov      edi, 24
                            ; GC ptr vars -{V03}
0004EC call     System.ThrowHelper:ThrowInvalidOperationException(int)
                            ; byrRegs -[rax]
                            ; gcr arg pop 0
						;; size=40 bbWeight=0 PerfScore 0.00
G_M10894_IG43:        ; bbWeight=0, gcrefRegs=0000 {}, byrefRegs=0000 {}, byref
0004F1 lea      rax, G_M10894_IG29
						;; size=7 bbWeight=0 PerfScore 0.00
G_M10894_IG44:        ; bbWeight=0, funclet epilog, nogc, extend
0004F8 add      rsp, 8
0004FC ret      
						;; size=5 bbWeight=0 PerfScore 0.00
G_M10894_IG45:        ; bbWeight=0, gcVars=0000000000800009 {V00 V02 V03}, gcrefRegs=8008 {rbx r15}, byrefRegs=0000 {}, gcvars, byref, isz
                            ; gcrRegs +[rbx r15]
                            ; GC ptr vars +{V00 V02 V03 V23}
0004FD mov      r14d, dword ptr [r15+0x18]
000501 shr      r14d, 7
000505 and      r14d, 7
000509 jne      SHORT G_M10894_IG46
00050B lea      rdi, gword ptr [(reloc 0x4000000000469740)]      ; '"index != 0"'
                            ; gcrRegs +[rdi]
000512 lea      rsi, gword ptr [(reloc 0x40000000004274a0)]      ; '""'
                            ; gcrRegs +[rsi]
000519 call     System.Diagnostics.Debug:Fail(System.String,System.String)
                            ; gcrRegs -[rsi rdi]
                            ; gcr arg pop 0
						;; size=33 bbWeight=0 PerfScore 0.00
G_M10894_IG46:        ; bbWeight=0, gcrefRegs=8008 {rbx r15}, byrefRegs=0000 {}, byref
00051E lea      edi, [8*r14+0x10]
000526 lea      rdi, bword ptr [r15+rdi+0x08]
                            ; byrRegs +[rdi]
00052B mov      rsi, rbx
                            ; gcrRegs +[rsi]
00052E call     CORINFO_HELP_ASSIGN_REF
                            ; gcrRegs -[rbx rsi]
                            ; byrRegs -[rdi]
000533 mov      gword ptr [rbp-0x98], r15
00053A lea      rax, G_M10894_IG26
						;; size=35 bbWeight=0 PerfScore 0.00
G_M10894_IG47:        ; bbWeight=0, funclet epilog, nogc, extend
000541 add      rsp, 8
000545 ret      
						;; size=5 bbWeight=0 PerfScore 0.00

; Total bytes of code 1350, prolog size 82, PerfScore 625.83, instruction count 315, allocated bytes for code 1350 (MethodHash=7bb3d571) for method System.Runtime.CompilerServices.AsyncHelpers+RuntimeAsyncTask`1[System.Threading.Tasks.VoidTaskResult]:DispatchContinuations():this (FullOpts)
; ============================================================

Cfi Info:
  >> Start offset   : 0x000000 
  >>   End offset   : 0x00044a 
    CodeOffset: 0x01 Op: AdjustCfaOffset Offset:0x8
    CodeOffset: 0x01 Op: RelOffset DwarfReg:0x6 Offset:0x0
    CodeOffset: 0x03 Op: AdjustCfaOffset Offset:0x8
    CodeOffset: 0x03 Op: RelOffset DwarfReg:0xf Offset:0x0
    CodeOffset: 0x05 Op: AdjustCfaOffset Offset:0x8
    CodeOffset: 0x05 Op: RelOffset DwarfReg:0xe Offset:0x0
    CodeOffset: 0x07 Op: AdjustCfaOffset Offset:0x8
    CodeOffset: 0x07 Op: RelOffset DwarfReg:0xd Offset:0x0
    CodeOffset: 0x09 Op: AdjustCfaOffset Offset:0x8
    CodeOffset: 0x09 Op: RelOffset DwarfReg:0xc Offset:0x0
    CodeOffset: 0x0A Op: AdjustCfaOffset Offset:0x8
    CodeOffset: 0x0A Op: RelOffset DwarfReg:0x3 Offset:0x0
    CodeOffset: 0x11 Op: AdjustCfaOffset Offset:0xA8
Cfi Info:
  >> Start offset   : 0x00044a 
  >>   End offset   : 0x000546 
    CodeOffset: 0x01 Op: AdjustCfaOffset Offset:0x8
Set code length to 1350.
Set stack base register to rbp.
Set WantsReportOnlyLeaf.
Set Outgoing stack arg area size to 0.
Stack slot id for offset -112 (-0x70) (frame) (untracked) = 0.
Stack slot id for offset -104 (-0x68) (frame) (untracked) = 1.
Stack slot id for offset -96 (-0x60) (frame) (untracked) = 2.
Stack slot id for offset -88 (-0x58) (frame) (untracked) = 3.
Stack slot id for offset -80 (-0x50) (frame) (untracked) = 4.
Stack slot id for offset -72 (-0x48) (frame) (untracked) = 5.
Stack slot id for offset -64 (-0x40) (frame) (untracked) = 6.
Stack slot id for offset -56 (-0x38) (frame) (untracked) = 7.
Stack slot id for offset -152 (-0x98) (frame) (untracked) = 8.
Stack slot id for offset -144 (-0x90) (frame) (untracked) = 9.
Stack slot id for offset -136 (-0x88) (frame) (untracked) = 10.
Stack slot id for offset -128 (-0x80) (frame) (byref, untracked) = 11.
Stack slot id for offset -176 (-0xb0) (frame) = 12.
Stack slot id for offset -184 (-0xb8) (frame) (byref) = 13.
Stack slot id for offset -192 (-0xc0) (frame) (byref) = 14.
Stack slot id for offset -200 (-0xc8) (frame) = 15.
Register slot id for reg rbx = 16.
Register slot id for reg rbx (byref) = 17.
Register slot id for reg rax = 18.
Register slot id for reg r15 = 19.
Register slot id for reg rdi (byref) = 20.
Register slot id for reg rsi = 21.
Register slot id for reg rdi = 22.
Register slot id for reg rax (byref) = 23.
Register slot id for reg r14 = 24.
Register slot id for reg r13 = 25.
Register slot id for reg r12 = 26.
Register slot id for reg rcx = 27.
Register slot id for reg rdx = 28.
Register slot id for reg rdx (byref) = 29.
Register slot id for reg rsi (byref) = 30.
Register slot id for reg r15 (byref) = 31.
Register slot id for reg r13 (byref) = 32.
Set state of slot 12 at instr offset 0x52 to Live.
Set state of slot 12 at instr offset 0x342 to Dead.
Set state of slot 13 at instr offset 0x89 to Live.
Set state of slot 13 at instr offset 0x342 to Dead.
Set state of slot 14 at instr offset 0x122 to Live.
Set state of slot 14 at instr offset 0x342 to Dead.
Set state of slot 15 at instr offset 0x1de to Live.
Set state of slot 15 at instr offset 0x212 to Dead.
Set state of slot 15 at instr offset 0x301 to Live.
Set state of slot 15 at instr offset 0x312 to Dead.
Set state of slot 13 at instr offset 0x344 to Live.
Set state of slot 13 at instr offset 0x34b to Dead.
Set state of slot 14 at instr offset 0x344 to Live.
Set state of slot 14 at instr offset 0x361 to Dead.
Set state of slot 13 at instr offset 0x373 to Live.
Set state of slot 13 at instr offset 0x401 to Dead.
Set state of slot 12 at instr offset 0x373 to Live.
Set state of slot 12 at instr offset 0x382 to Dead.
Set state of slot 14 at instr offset 0x373 to Live.
Set state of slot 14 at instr offset 0x401 to Dead.
Set state of slot 12 at instr offset 0x403 to Live.
Set state of slot 12 at instr offset 0x43f to Dead.
Set state of slot 13 at instr offset 0x417 to Live.
Set state of slot 13 at instr offset 0x43f to Dead.
Set state of slot 13 at instr offset 0x44a to Live.
Set state of slot 13 at instr offset 0x4cc to Dead.
Set state of slot 12 at instr offset 0x44a to Live.
Set state of slot 12 at instr offset 0x4a2 to Dead.
Set state of slot 14 at instr offset 0x44a to Live.
Set state of slot 14 at instr offset 0x4ec to Dead.
Set state of slot 12 at instr offset 0x4ac to Live.
Set state of slot 12 at instr offset 0x4c1 to Dead.
Set state of slot 13 at instr offset 0x4fd to Live.
Set state of slot 13 at instr offset 0x546 to Dead.
Set state of slot 12 at instr offset 0x4fd to Live.
Set state of slot 12 at instr offset 0x546 to Dead.
Set state of slot 14 at instr offset 0x4fd to Live.
Set state of slot 14 at instr offset 0x546 to Dead.
Set state of slot 16 at instr offset 0x72 to Live.
Set state of slot 16 at instr offset 0x82 to Dead.
Set state of slot 17 at instr offset 0x82 to Live.
Set state of slot 18 at instr offset 0xa4 to Live.
Set state of slot 18 at instr offset 0xb9 to Dead.
Set state of slot 19 at instr offset 0xbc to Live.
Set state of slot 18 at instr offset 0xd6 to Live.
Set state of slot 19 at instr offset 0xd6 to Dead.
Set state of slot 19 at instr offset 0xd9 to Live.
Set state of slot 18 at instr offset 0xd9 to Dead.
Set state of slot 20 at instr offset 0xdd to Live.
Set state of slot 21 at instr offset 0xe0 to Live.
Set state of slot 21 at instr offset 0xe5 to Dead.
Set state of slot 20 at instr offset 0xe5 to Dead.
Set state of slot 18 at instr offset 0xe8 to Live.
Set state of slot 19 at instr offset 0xe8 to Dead.
Set state of slot 22 at instr offset 0xec to Live.
Set state of slot 22 at instr offset 0x100 to Dead.
Set state of slot 18 at instr offset 0x108 to Dead.
Set state of slot 19 at instr offset 0x10b to Live.
Set state of slot 20 at instr offset 0x11b to Live.
Set state of slot 20 at instr offset 0x13a to Dead.
Set state of slot 22 at instr offset 0x13a to Live.
Set state of slot 18 at instr offset 0x13f to Live.
Set state of slot 22 at instr offset 0x13f to Dead.
Set state of slot 19 at instr offset 0x13f to Dead.
Set state of slot 18 at instr offset 0x154 to Dead.
Set state of slot 23 at instr offset 0x154 to Live.
Set state of slot 23 at instr offset 0x157 to Dead.
Set state of slot 22 at instr offset 0x168 to Live.
Set state of slot 21 at instr offset 0x16f to Live.
Set state of slot 21 at instr offset 0x174 to Dead.
Set state of slot 22 at instr offset 0x174 to Dead.
Set state of slot 19 at instr offset 0x17c to Live.
Set state of slot 24 at instr offset 0x180 to Live.
Set state of slot 22 at instr offset 0x195 to Live.
Set state of slot 21 at instr offset 0x19c to Live.
Set state of slot 21 at instr offset 0x1a1 to Dead.
Set state of slot 22 at instr offset 0x1a1 to Dead.
Set state of slot 25 at instr offset 0x1a5 to Live.
Set state of slot 22 at instr offset 0x1ba to Live.
Set state of slot 21 at instr offset 0x1c1 to Live.
Set state of slot 21 at instr offset 0x1c6 to Dead.
Set state of slot 22 at instr offset 0x1c6 to Dead.
Set state of slot 26 at instr offset 0x1d3 to Live.
Set state of slot 27 at instr offset 0x1d7 to Live.
Set state of slot 22 at instr offset 0x20c to Live.
Set state of slot 21 at instr offset 0x20f to Live.
Set state of slot 28 at instr offset 0x212 to Live.
Set state of slot 27 at instr offset 0x217 to Dead.
Set state of slot 28 at instr offset 0x217 to Dead.
Set state of slot 21 at instr offset 0x217 to Dead.
Set state of slot 22 at instr offset 0x217 to Dead.
Set state of slot 26 at instr offset 0x217 to Dead.
Set state of slot 25 at instr offset 0x217 to Dead.
Set state of slot 29 at instr offset 0x237 to Live.
Set state of slot 29 at instr offset 0x239 to Dead.
Set state of slot 29 at instr offset 0x23b to Live.
Set state of slot 25 at instr offset 0x242 to Live.
Set state of slot 25 at instr offset 0x244 to Dead.
Set state of slot 29 at instr offset 0x244 to Dead.
Set state of slot 25 at instr offset 0x24b to Live.
Set state of slot 29 at instr offset 0x253 to Live.
Set state of slot 21 at instr offset 0x268 to Live.
Set state of slot 18 at instr offset 0x26d to Live.
Set state of slot 21 at instr offset 0x26d to Dead.
Set state of slot 19 at instr offset 0x26d to Dead.
Set state of slot 29 at instr offset 0x26d to Dead.
Set state of slot 18 at instr offset 0x26f to Dead.
Set state of slot 19 at instr offset 0x26f to Live.
Set state of slot 29 at instr offset 0x26f to Live.
Set state of slot 22 at instr offset 0x272 to Live.
Set state of slot 30 at instr offset 0x275 to Live.
Set state of slot 18 at instr offset 0x278 to Live.
Set state of slot 22 at instr offset 0x278 to Dead.
Set state of slot 19 at instr offset 0x278 to Dead.
Set state of slot 29 at instr offset 0x278 to Dead.
Set state of slot 30 at instr offset 0x278 to Dead.
Set state of slot 20 at instr offset 0x285 to Live.
Set state of slot 21 at instr offset 0x288 to Live.
Set state of slot 18 at instr offset 0x28d to Dead.
Set state of slot 21 at instr offset 0x28d to Dead.
Set state of slot 24 at instr offset 0x28d to Dead.
Set state of slot 20 at instr offset 0x28d to Dead.
Set state of slot 22 at instr offset 0x290 to Live.
Set state of slot 30 at instr offset 0x293 to Live.
Set state of slot 22 at instr offset 0x298 to Dead.
Set state of slot 30 at instr offset 0x298 to Dead.
Set state of slot 22 at instr offset 0x2a6 to Live.
Set state of slot 21 at instr offset 0x2ad to Live.
Set state of slot 21 at instr offset 0x2b2 to Dead.
Set state of slot 22 at instr offset 0x2b2 to Dead.
Set state of slot 24 at instr offset 0x2ba to Live.
Set state of slot 21 at instr offset 0x2be to Live.
Set state of slot 20 at instr offset 0x2c8 to Live.
Set state of slot 21 at instr offset 0x2cd to Dead.
Set state of slot 20 at instr offset 0x2cd to Dead.
Set state of slot 31 at instr offset 0x2cd to Live.
Set state of slot 28 at instr offset 0x2d1 to Live.
Set state of slot 21 at instr offset 0x2d5 to Live.
Set state of slot 22 at instr offset 0x2dd to Live.
Set state of slot 28 at instr offset 0x2e2 to Dead.
Set state of slot 21 at instr offset 0x2e2 to Dead.
Set state of slot 22 at instr offset 0x2e2 to Dead.
Set state of slot 24 at instr offset 0x2e2 to Dead.
Set state of slot 31 at instr offset 0x2e2 to Dead.
Set state of slot 23 at instr offset 0x2fc to Live.
Set state of slot 27 at instr offset 0x301 to Live.
Set state of slot 26 at instr offset 0x301 to Live.
Set state of slot 24 at instr offset 0x301 to Live.
Set state of slot 19 at instr offset 0x301 to Live.
Set state of slot 23 at instr offset 0x301 to Dead.
Set state of slot 27 at instr offset 0x306 to Dead.
Set state of slot 27 at instr offset 0x30d to Live.
Set state of slot 27 at instr offset 0x312 to Dead.
Set state of slot 26 at instr offset 0x312 to Dead.
Set state of slot 25 at instr offset 0x312 to Dead.
Set state of slot 24 at instr offset 0x312 to Dead.
Set state of slot 19 at instr offset 0x312 to Dead.
Set state of slot 17 at instr offset 0x312 to Dead.
Set state of slot 21 at instr offset 0x319 to Live.
Set state of slot 22 at instr offset 0x325 to Live.
Set state of slot 21 at instr offset 0x32a to Dead.
Set state of slot 22 at instr offset 0x32a to Dead.
Set state of slot 17 at instr offset 0x33c to Live.
Set state of slot 17 at instr offset 0x342 to Dead.
Set state of slot 20 at instr offset 0x34b to Live.
Set state of slot 20 at instr offset 0x350 to Dead.
Set state of slot 23 at instr offset 0x35e to Live.
Set state of slot 23 at instr offset 0x361 to Dead.
Set state of slot 25 at instr offset 0x37a to Live.
Set state of slot 22 at instr offset 0x382 to Live.
Set state of slot 22 at instr offset 0x387 to Dead.
Set state of slot 25 at instr offset 0x387 to Dead.
Set state of slot 31 at instr offset 0x390 to Live.
Set state of slot 22 at instr offset 0x39e to Live.
Set state of slot 21 at instr offset 0x3a5 to Live.
Set state of slot 21 at instr offset 0x3aa to Dead.
Set state of slot 22 at instr offset 0x3aa to Dead.
Set state of slot 24 at instr offset 0x3b2 to Live.
Set state of slot 21 at instr offset 0x3b6 to Live.
Set state of slot 20 at instr offset 0x3c0 to Live.
Set state of slot 21 at instr offset 0x3c5 to Dead.
Set state of slot 20 at instr offset 0x3c5 to Dead.
Set state of slot 32 at instr offset 0x3c5 to Live.
Set state of slot 28 at instr offset 0x3c9 to Live.
Set state of slot 21 at instr offset 0x3cd to Live.
Set state of slot 22 at instr offset 0x3d5 to Live.
Set state of slot 28 at instr offset 0x3da to Dead.
Set state of slot 21 at instr offset 0x3da to Dead.
Set state of slot 22 at instr offset 0x3da to Dead.
Set state of slot 24 at instr offset 0x3da to Dead.
Set state of slot 32 at instr offset 0x3da to Dead.
Set state of slot 23 at instr offset 0x3f4 to Live.
Set state of slot 23 at instr offset 0x401 to Dead.
Set state of slot 31 at instr offset 0x401 to Dead.
Set state of slot 18 at instr offset 0x40f to Live.
Set state of slot 16 at instr offset 0x412 to Live.
Set state of slot 18 at instr offset 0x417 to Dead.
Set state of slot 16 at instr offset 0x417 to Dead.
Set state of slot 17 at instr offset 0x417 to Live.
Set state of slot 18 at instr offset 0x423 to Live.
Set state of slot 19 at instr offset 0x426 to Live.
Set state of slot 18 at instr offset 0x42b to Dead.
Set state of slot 19 at instr offset 0x42b to Dead.
Set state of slot 18 at instr offset 0x437 to Live.
Set state of slot 19 at instr offset 0x43a to Live.
Set state of slot 18 at instr offset 0x43f to Dead.
Set state of slot 19 at instr offset 0x43f to Dead.
Set state of slot 17 at instr offset 0x43f to Dead.
Set state of slot 22 at instr offset 0x44a to Live.
Set state of slot 16 at instr offset 0x44e to Live.
Set state of slot 21 at instr offset 0x469 to Live.
Set state of slot 18 at instr offset 0x46e to Live.
Set state of slot 21 at instr offset 0x46e to Dead.
Set state of slot 22 at instr offset 0x46e to Dead.
Set state of slot 19 at instr offset 0x471 to Live.
Set state of slot 19 at instr offset 0x481 to Dead.
Set state of slot 31 at instr offset 0x481 to Live.
Set state of slot 21 at instr offset 0x484 to Live.
Set state of slot 21 at instr offset 0x490 to Dead.
Set state of slot 24 at instr offset 0x493 to Live.
Set state of slot 22 at instr offset 0x49f to Live.
Set state of slot 21 at instr offset 0x4a2 to Live.
Set state of slot 18 at instr offset 0x4a7 to Dead.
Set state of slot 16 at instr offset 0x4a7 to Dead.
Set state of slot 21 at instr offset 0x4a7 to Dead.
Set state of slot 22 at instr offset 0x4a7 to Dead.
Set state of slot 24 at instr offset 0x4a7 to Dead.
Set state of slot 24 at instr offset 0x4ac to Live.
Set state of slot 22 at instr offset 0x4af to Live.
Set state of slot 18 at instr offset 0x4b4 to Live.
Set state of slot 22 at instr offset 0x4b4 to Dead.
Set state of slot 21 at instr offset 0x4b7 to Live.
Set state of slot 22 at instr offset 0x4be to Live.
Set state of slot 28 at instr offset 0x4c1 to Live.
Set state of slot 18 at instr offset 0x4c6 to Dead.
Set state of slot 28 at instr offset 0x4c6 to Dead.
Set state of slot 21 at instr offset 0x4c6 to Dead.
Set state of slot 22 at instr offset 0x4c6 to Dead.
Set state of slot 24 at instr offset 0x4c6 to Dead.
Set state of slot 20 at instr offset 0x4cc to Live.
Set state of slot 20 at instr offset 0x4d1 to Dead.
Set state of slot 31 at instr offset 0x4d1 to Dead.
Set state of slot 23 at instr offset 0x4df to Live.
Set state of slot 23 at instr offset 0x4f1 to Dead.
Set state of slot 16 at instr offset 0x4fd to Live.
Set state of slot 19 at instr offset 0x4fd to Live.
Set state of slot 22 at instr offset 0x512 to Live.
Set state of slot 21 at instr offset 0x519 to Live.
Set state of slot 21 at instr offset 0x51e to Dead.
Set state of slot 22 at instr offset 0x51e to Dead.
Set state of slot 20 at instr offset 0x52b to Live.
Set state of slot 21 at instr offset 0x52e to Live.
Set state of slot 16 at instr offset 0x533 to Dead.
Set state of slot 21 at instr offset 0x533 to Dead.
Set state of slot 20 at instr offset 0x533 to Dead.
Set state of slot 19 at instr offset 0x546 to Dead.
Defining interruptible range: [0x52, 0x368).
Defining interruptible range: [0x373, 0x44a).
Defining interruptible range: [0x44b, 0x4fc).
Defining interruptible range: [0x4fd, 0x545).

[mangod9]

For some reason there are no dumps captured for the failures, but assume Michal has a local repro/dump. Based on the analysis above here is the root cause in the JIT:

The Bug

In helperexpansion.cpp:663, the TLS access for NativeAOT on Linux x64 is expanded as:

 GenTreeCall* tlsRefCall = gtNewIndCallNode(tls_get_addr_val, TYP_I_IMPL);
 tlsRefCall->gtFlags |= GTF_TLS_GET_ADDR;

This creates a call node typed TYP_I_IMPL (native int, NOT a GC ref). The call returns the TLS root address in rax.
The JIT correctly assigns rax for the return value.

But the problem is in the caller. Before the TLS call, rax holds a GC ref (V18 tmp3, the calli result from 
DispatchContinuations). The JIT's GC tracking records rax as live GC ref at offset 0xE8. The TLS call at 0xF8-0x108
is supposed to kill rax as GC ref (since it returns TYP_I_IMPL), which it does — but only at offset 0x108 (after
the call returns).

Why the GC Info Is Wrong

The data16; data16; call __tls_get_addr sequence at 0xF8-0x108 is special:

 1. The JIT emits it as a single call instruction with noSafePoint = true (line 6318)
 2. The noSafePoint = true means the JIT doesn't record this as a GC safepoint — it assumes no GC can happen during
 this call
 3. Since the method is fully interruptible, GC can stop at ANY instruction, including the data16 prefix bytes and 
the lea rdi argument setup at 0xF8-0x101

The JIT thinks the sequence is atomic (no GC can interrupt), but:

 - The method is fully interruptible, so GC can stop between any two instructions
 - The data16; lea rdi, [rip+tls]; data16; data16; call __tls_get_addr is 4 separate instructions in the emitted 
code
 - The linker then relaxes this to mov rax, fs:0; lea rax, [rax-offset] which clobbers rax at 0xF8

The Fundamental Problem

The JIT marks noSafePoint = true but the code is fully interruptible. noSafePoint only prevents recording a 
call-site safepoint, but in a fully interruptible method, every instruction boundary is a potential GC point. The
GC info still shows rax as a live GC ref through the entire range [0xE8, 0x108) because the JIT only kills rax at
the call return point 0x108.

Even without linker relaxation, the original TLSGD sequence clobbers rdi (the argument register) at 0xF9 with lea
rdi, [rip+tls] while the previous GC ref in rdi is still live. But the critical issue is rax — the linker
relaxation rewrites the lea rdi + call __tls_get_addr into mov rax, fs:0 + lea rax, [rax-offset], which directly
clobbers the GC-tracked rax.

Fix

The JIT needs to kill GC liveness for rax (and rdi) before emitting the TLS access sequence, not after. In 
codegenxarch.cpp around line 6312, before the data16 prefix:

 // Kill any GC refs in registers that will be clobbered by the TLS sequence
 gcInfo.gcMarkRegSetNpt(RBM_RAX | RBM_RDI);  // or equivalent

Or alternatively, spill any live GC refs from rax/rdi to the stack before the TLS call and reload after.

[MichalStrehovsky]

For some reason there are no dumps captured for the failures

I got a dump with runfo get-helix-payload -j 009fd0b4-f852-4791-a1b3-e3399e5acba6 -w System.Threading.Tasks.Parallel.Tests -o c:\helix\009fd0b4-f852-4791-a1b3-e3399e5acba6\System.Threading.Tasks.Parallel.Tests\

[mangod9]

Looks like #126041 possibly caused the regression which forces TLS access into DispatchContinuations at a point
where rax holds a live GC ref

[jakobbotsch]

Looks like #126041 possibly caused the regression which forces TLS access into DispatchContinuations at a point where rax holds a live GC ref

That PR does not touch DispatchContinuations.

If the analysis is true this bug sounds like an old one, likely to have been in the product since optimized TLS access was implemented.