altjit backout is broken

[BruceForstall]

Repro: create a new app, dotnet new console, build it, dotnet build, run it with altjit, e.g.:

set COMPlus_AltJit=Main
set COMPlus_AltJitName=clrjit_win_arm64_x64.dll
set COMPlus_TieredCompilation=0
c:\gh\runtime2\artifacts\tests\coreclr\windows.x64.Debug\Tests\Core_Root\corerun.exe C:\bugs\altjit\bin\Debug\net6.0\altjit.dll

I see:

Assert failure(PID 19820 [0x00004d6c], Thread: 23544 [0x5bf8]): Consistency check failed: AV in clr at this callstack:
------
CORECLR! hpCodeHdr::GetMethodDesc + 0x16 (0x00007ff9`5f9375b6)
CORECLR! EEJitManager::RemoveJitData + 0x181 (0x00007ff9`5f943c81)
CORECLR! CEEJitInfo::BackoutJitData + 0x1BF (0x00007ff9`5edd59df)
CORECLR! invokeCompileMethodHelper + 0x18E (0x00007ff9`5ee14d3e)
CORECLR! invokeCompileMethod + 0x213 (0x00007ff9`5ee14b03)
CORECLR! UnsafeJitFunction + 0xCB9 (0x00007ff9`5edea119)
CORECLR! MethodDesc::JitCompileCodeLocked + 0x318 (0x00007ff9`5eef59a8)
CORECLR! MethodDesc::JitCompileCodeLockedEventWrapper + 0x430 (0x00007ff9`5eef61c0)
CORECLR! MethodDesc::JitCompileCode + 0x659 (0x00007ff9`5eef55e9)
CORECLR! MethodDesc::PrepareILBasedCode + 0x5E2 (0x00007ff9`5eef85d2)
CORECLR! MethodDesc::PrepareCode + 0x21C (0x00007ff9`5eef7f8c)
CORECLR! CodeVersionManager::PublishVersionableCodeIfNecessary + 0x5AE (0x00007ff9`5ecd1e0e)
CORECLR! MethodDesc::DoPrestub + 0x790 (0x00007ff9`5eeed8c0)
CORECLR! PreStubWorker + 0x4B1 (0x00007ff9`5eefc9a1)
CORECLR! ThePreStub + 0x55 (0x00007ff9`5f61f7e5)
CORECLR! CallDescrWorkerInternal + 0x83 (0x00007ff9`5f61e663)
CORECLR! CallDescrWorkerWithHandler + 0x12E (0x00007ff9`5f029c8e)
CORECLR! MethodDescCallSite::CallTargetWorker + 0xCA4 (0x00007ff9`5f02a944)
CORECLR! MethodDescCallSite::Call + 0x24 (0x00007ff9`5eb69364)
-----
.AV on tid=0x5bf8 (23544), cxr=000000865D97A080, exr=000000865D97A570
FAILED: false

CORECLR! CHECK::Trigger + 0x299 (0x00007ff9`5f64ffa9)
CORECLR! CLRVectoredExceptionHandlerPhase3 + 0x374 (0x00007ff9`5ed3bd24)
CORECLR! CLRVectoredExceptionHandlerPhase2 + 0xA6 (0x00007ff9`5ed3b616)
CORECLR! CLRVectoredExceptionHandler + 0x2A8 (0x00007ff9`5ed3b538)
CORECLR! CLRVectoredExceptionHandlerShim + 0x2CD (0x00007ff9`5ed3c16d)
NTDLL! RtlDeleteAce + 0x3CC (0x00007ff9`e6148a4c)
NTDLL! RtlRaiseException + 0x256 (0x00007ff9`e6121276)
NTDLL! KiUserExceptionDispatcher + 0x2E (0x00007ff9`e6170cae)
CORECLR! hpCodeHdr::GetMethodDesc + 0x16 (0x00007ff9`5f9375b6)
CORECLR! EEJitManager::RemoveJitData + 0x181 (0x00007ff9`5f943c81)
    File: C:\gh\runtime2\src\coreclr\vm\excep.cpp Line: 7502
    Image: c:\gh\runtime2\artifacts\tests\coreclr\windows.x64.Debug\Tests\Core_Root\corerun.exe

If I generate altjit disasm output using:

set COMPlus_JitDisasm=Main
set COMPlus_JitStdOutFile=C:\bugs\altjit\out.txt

I do get the arm64 output before the crash.

Did some recent change in this area for W^X or similar regress this?

@dotnet/jit-contrib @trylek @janvorli

[sandreenko]

Thanks for reporting this, I saw it but thought it was my local issue and decided to reset the env.

[janvorli]

I'll take a look, I've touched areas around this, so it is possible that I've caused it.

[janvorli]

I've found the bug, I'll send out a PR with a fix soon.