Mono.Android-Tests crash when AOT is enabled

[jonathanpeppers]

Description

We're hitting a test causes the test app to crash when using -p:RunAOTCompilation=true, but it works fine with JIT:

********** Crash dump: **********
Build fingerprint: 'google/sdk_gphone_x86_64/generic_x86_64:9/PSR1.180720.075/5124027:user/release-keys'
#00 0x00059eac /data/app/Mono.Android.NET_Tests-vtnerz4bHqSkZSQWYCTLvw==/lib/x86/libmonosgen-2.0.so
ves_icall_System_IO_Stream_HasOverriddenBeginEndWrite
/__w/1/s\src/mono/mono/metadata/icall.c:3261:38
ves_icall_System_IO_Stream_HasOverriddenBeginEndWrite_raw
/__w/1/s\src/mono/mono/metadata/icall-def-netcore.h:128:0
#01 0x0000d84f <anonymous:e25e6000>
Crash dump is completed

It seems to happen during this test:

07-26 10:50:51.003  8393  8410 I NUnit   : Redirect_POST_With_Content_Works 

https://github.com/xamarin/xamarin-android/blob/e4debf72015549e6e19cbfb247a47fead6ce7a01/tests/Mono.Android-Tests/Xamarin.Android.Net/AndroidClientHandlerTests.cs#L387-L408

Configuration

dotnet --version
6.0.100-rc.1.21372.10

Runtime version:

~\.nuget\packages\microsoft.netcore.app.runtime.mono.android-x86\6.0.0-rc.1.21372.1\runtimes\android-x86\native\libmonosgen-2.0.so

Regression?

No, Android AOT is new.

Other information

Full logcat output: aot.txt

/cc @steveisok

Tagging subscribers to this area: @directhex
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

We're hitting a test that fails when using -p:RunAOTCompilation=true, but it works fine with JIT:

********** Crash dump: **********
Build fingerprint: 'google/sdk_gphone_x86_64/generic_x86_64:9/PSR1.180720.075/5124027:user/release-keys'
#00 0x00059eac /data/app/Mono.Android.NET_Tests-vtnerz4bHqSkZSQWYCTLvw==/lib/x86/libmonosgen-2.0.so
ves_icall_System_IO_Stream_HasOverriddenBeginEndWrite
/__w/1/s\src/mono/mono/metadata/icall.c:3261:38
ves_icall_System_IO_Stream_HasOverriddenBeginEndWrite_raw
/__w/1/s\src/mono/mono/metadata/icall-def-netcore.h:128:0
#01 0x0000d84f <anonymous:e25e6000>
Crash dump is completed

It seems to happen during this test:

07-26 10:50:51.003  8393  8410 I NUnit   : Redirect_POST_With_Content_Works 

https://github.com/xamarin/xamarin-android/blob/e4debf72015549e6e19cbfb247a47fead6ce7a01/tests/Mono.Android-Tests/Xamarin.Android.Net/AndroidClientHandlerTests.cs#L387-L408

Configuration

dotnet --version
6.0.100-rc.1.21372.10

Regression?

No, Android AOT is new.

Other information

Full logcat output: aot.txt

/cc @steveisok

Author:	jonathanpeppers
Assignees:	-
Labels:	area-Infrastructure-mono, untriaged
Milestone:	-

[jonathanpeppers]

-p:UseNativeHttpHandler=false makes the crash go away. But then we get other test failures because AndroidMessageHandler isn't used.

[steveisok]

/cc @lambdageek @vargaz

[lambdageek]

@jonathanpeppers does the IL trimmer run when you AOT this test?

I see that in the HasOverridenBeginEndRead implementation we explicitly check whether the linker removed the Stream BeginRead / EndRead methods, but in HasOverridenBeginEndWrite we don't

runtime/src/mono/mono/metadata/icall.c

Lines 3231 to 3265 in 6d35185

	ves_icall_System_IO_Stream_HasOverriddenBeginEndRead (MonoObjectHandle stream, MonoError *error)
	{
	MonoClass* curr_klass = MONO_HANDLE_GET_CLASS (stream);
	MonoClass* base_klass = mono_class_try_get_stream_class ();
	if (!io_stream_slots_set)
	init_io_stream_slots ();
	// slots can still be -1 and it means Linker removed the methods from the base class (Stream)
	// in this case we can safely assume the methods are not overridden
	// otherwise - check vtable
	MonoMethod **curr_klass_vtable = m_class_get_vtable (curr_klass);
	gboolean begin_read_is_overriden = io_stream_begin_read_slot != -1 && curr_klass_vtable [io_stream_begin_read_slot]->klass != base_klass;
	gboolean end_read_is_overriden = io_stream_end_read_slot != -1 && curr_klass_vtable [io_stream_end_read_slot]->klass != base_klass;
	// return true if BeginRead or EndRead were overriden
	return begin_read_is_overriden || end_read_is_overriden;
	}
	MonoBoolean
	ves_icall_System_IO_Stream_HasOverriddenBeginEndWrite (MonoObjectHandle stream, MonoError *error)
	{
	MonoClass* curr_klass = MONO_HANDLE_GETVAL (stream, vtable)->klass;
	MonoClass* base_klass = mono_class_try_get_stream_class ();
	if (!io_stream_slots_set)
	init_io_stream_slots ();
	MonoMethod **curr_klass_vtable = m_class_get_vtable (curr_klass);
	gboolean begin_write_is_overriden = curr_klass_vtable [io_stream_begin_write_slot]->klass != base_klass;
	gboolean end_write_is_overriden = curr_klass_vtable [io_stream_end_write_slot]->klass != base_klass;
	// return true if BeginWrite or EndWrite were overriden
	return begin_write_is_overriden || end_write_is_overriden;
	}

So curr_klass_vtable [io_stream_begin_write_slot]->klass might be a bad access.