Crash in MethodTable::MethodDataObject::FillEntryDataForAncestor

[rolfbjarne]

Description

This is a crash I saw once on our bots, I have no way to reproduce it, nor do I know what the process in question was doing (probably 'dotnet build', but it can be any number of things we do during our build).

However, I have a crash report:

dotnet-2025-09-12-093407.ips.txt

This is what the crash report claims the crashing thread was doing:

Thread 12 Crashed:: .NET TP Worker
0   libcoreclr.dylib              	       0x101887444 MethodTable::MethodDataObject::FillEntryDataForAncestor(MethodTable*) + 396
1   libcoreclr.dylib              	       0x1018874e8 MethodTable::MethodDataObject::GetDeclMethodDesc(unsigned int) + 132
2   libcoreclr.dylib              	       0x1018741e0 MemberLoader::FindMethod(MethodTable*, char const*, unsigned char const*, unsigned int, ModuleBase*, MemberLoader::FM_Flags, Substitution const*) + 392
3   libcoreclr.dylib              	       0x1018736f0 MemberLoader::GetDescFromMemberRef(ModuleBase*, unsigned int, MethodDesc**, FieldDesc**, SigTypeContext const*, int, TypeHandle*, int, unsigned char const**, unsigned int*) + 1252
4   libcoreclr.dylib              	       0x1018e0e60 ZapSig::DecodeMethod(ModuleBase*, unsigned char const*, SigTypeContext*, ZapSig::Context*, TypeHandle*, unsigned char const**, unsigned char const**, unsigned char const**, int) + 940
5   libcoreclr.dylib              	       0x1018e0aa8 ZapSig::DecodeMethod(Module*, ModuleBase*, unsigned char const*, TypeHandle*) + 84
6   libcoreclr.dylib              	       0x1018a1d90 ExternalMethodFixupWorker + 544
7   libcoreclr.dylib              	       0x101a6f514 DelayLoad_MethodCall + 88
[...]

I also have a minidump (~6gb), can be found here: https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=12376959&view=artifacts&pathAsName=false&type=publishedArtifacts (expand the "minidumps" folder).

If the build has been deleted, or get an access denied error, I can provide a download link to the minidump (note to self: it's in the 'dotnet-runtime-issue-119761' directory in OneDrive).

Configuration

macOS 15.6, arm64

.NET 9.0.110-servicing.25418.5 (probably)

[dotnet-policy-service]

Tagging subscribers to this area: @mangod9
See info in area-owners.md if you want to be subscribed.

[agocke]

@davidwrighton Can you take a quick look at this?

[rolfbjarne]

Just got another one of this crash in CI: https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=12630631&view=artifacts&pathAsName=false&type=publishedArtifacts (the dump file is in the "minidumps" folder).

Crash report: https://gist.github.com/rolfbjarne/372a35458f5a56eed409173def872103

[rolfbjarne]

Another one: https://gist.github.com/rolfbjarne/d69c1586d793012b24f935698da188e9 - https://dev.azure.com/devdiv/DevDiv/_build/results?buildId=12774594&view=artifacts&pathAsName=false&type=publishedArtifacts

[jkotas]

I looked at the dump. I am not able to figure out the context of the crash since the context pointer was optimized out. #121773 should make that better.