Implicit byref arguments are never on the GC heap

[EgorBo]

Implicit byref arguments (structs passed by reference under the hood: not 1/2/4/8 bytes on win-x64, larger than 16 bytes on arm64) are now guaranteed to never live on the GC heap, so callees can store into them without write barriers.

struct S16 { public object A; public object B; }

[MethodImpl(MethodImplOptions.NoInlining)]
static void Store(S16 s, object o) { s.A = o; Sink(ref s); }

 ; P:Store(S16,System.Object)   win-x64
-       push     rbx
-       sub      rsp, 32
-       mov      rbx, rcx
-       mov      rcx, rbx
-       call     CORINFO_HELP_CHECKED_ASSIGN_REF
-       mov      rcx, rbx
+       sub      rsp, 40
+       mov      gword ptr [rcx], rdx
        call     [P:Sink(byref)]
        nop
-       add      rsp, 32
-       pop      rbx
+       add      rsp, 40
        ret
-; Total bytes of code 32
+; Total bytes of code 19

Bumps READYTORUN_MAJOR_VERSION to 29: crossgen2 now emits barrier-free stores, so older runtimes must reject these images. MINIMUM_READYTORUN_MAJOR_VERSION stays at 26 - existing images can only forward an incoming implicit byref, never originate heap-backed storage for one.

[azure-pipelines]

Azure Pipelines:
Successfully started running 6 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[Copilot]

🟡 Changes recommended

The behavioral code-generation change lacks targeted regression coverage for write-barrier omission and GC reporting.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the implicit-byref ABI contract so argument storage is guaranteed outside the GC heap, allowing the JIT to omit write barriers safely.

Changes:

• Marks implicit-byref stores as non-heap and updates promotion costing.
• Copies debugger func-eval arguments into GC-protected native memory.
• Documents the contract and advances ReadyToRun to version 29.

File summaries

File	Description
src/coreclr/vm/callhelpers.h	Documents caller ownership and GC-reporting requirements.
src/coreclr/vm/callhelpers.cpp	Asserts implicit-byref arguments are not heap-backed.
src/coreclr/tools/Common/Internal/Runtime/ModuleHeaders.cs	Advances managed R2R version.
src/coreclr/nativeaot/Runtime/inc/ModuleHeaders.h	Advances NativeAOT R2R version.
src/coreclr/jit/promotion.cpp	Removes obsolete write-barrier costing.
src/coreclr/jit/morph.cpp	Marks implicit-byref stores as non-heap.
src/coreclr/jit/lclvars.cpp	Documents the new storage invariant.
src/coreclr/inc/readytorun.h	Advances and documents R2R version 29.
src/coreclr/debug/ee/funceval.cpp	Creates protected native copies for func-eval arguments.
docs/design/coreclr/botr/clr-abi.md	Documents the revised ABI contract.

Review details

• Files reviewed: 10/10 changed files
• Comments generated: 1
• Review effort level: Balanced

[jkotas]

This applies to all architectures now. This section should be reworded so that it does not start with explaining Windows Amd64 calling convention.

[EgorBo]

Addressed, although, it looks like the diffs are quite minimal, let's see on CI SPMI once it finishes 🤔

[jkotas]

This should be moved to AMD64-only note in "Return buffers" section

[EgorBo]

Diffs aren't too motivating. Perhaps, a bit more can be improved with proper alias analysis (implicit byref never aliases with gc heap), but closing for now.