[release/7.0-rc2] Fixing SpanHelpers.LastIndexOfAnyValueType to no longer create out of bounds GC refs

[github-actions]

Backport of #75857 to release/7.0-rc2

/cc @tannergooding

Customer Impact

Customers utilizing the Span<T>.LastIndexOf APIs may get invalid results. This is due to a "GC Hole" in the algorithm caused by creating a byref that points to before the managed object it was originally meant to be tracking.

Testing

In addition to the existing tests, additional manual testing was done to validate the logic no longer causes a crash under GCStress=0xC

Risk

The new logic avoids the GC hole by tracking a byref + offset rather than mutating the byref each iteration. This ensures we don't end up with an exterior byref and thus avoids the GC hole entirely.

[ghost]

Tagging subscribers to this area: @dotnet/area-system-memory
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Backport of #75857 to release/7.0-rc2

/cc @tannergooding

Customer Impact

Testing

Risk

IMPORTANT: Is this backport for a servicing release? If so and this change touches code that ships in a NuGet package, please make certain that you have added any necessary package authoring and gotten it explicitly reviewed.

Author:	github-actions[bot]
Assignees:	-
Labels:	area-System.Memory
Milestone:	-

[danmoseley]

@rainersigwald does the stack below simply mean that a child process couldn't start for some reason (not necessarily MSBuild issue)?

      Unhandled exception: System.IO.IOException: Connection timed out : 'Global\msbuild-server-launch-MmOQLObCTwIYk+VOCXULoCbHQULmwZ_RzAzo+dJyqpI'
         at System.Threading.Mutex.CreateMutexCore(Boolean initiallyOwned, String name, Boolean& createdNew)
         at Microsoft.Build.Experimental.MSBuildClient.TryLaunchServer()
         at Microsoft.Build.Experimental.MSBuildClient.Execute(CancellationToken cancellationToken)
         at Microsoft.Build.CommandLine.MSBuildClientApp.Execute(String[] commandLine, String msbuildLocation, CancellationToken cancellationToken)
         at Microsoft.Build.CommandLine.MSBuildApp.Main(String[] args)
         at Microsoft.DotNet.Cli.Utils.MSBuildForwardingAppWithoutLogging.ExecuteInProc(String[] arguments)

[rainersigwald]

That is a good question. @rokonec / @AR-May / @MichalPavlik?

I'm not super familiar with this area but it looks to me like this is before we even try to create a new process. I don't know why creating a mutex would fail with a timeout--that's not one of the common failures in the docs.

[carlossanlop]

cc @mmitche - We still have the above failure to figure out. This is the last RC2 PR backport to merge today.

[rainersigwald]

Is the failure happening consistently? And is that MSBuild running on a just-built runtime, or the "LKG" one from the SDK?

[danmoseley]

The stack above was WASM only, on 3 test jobs. eg https://helixre107v0xdeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-pull-75885-merge-61dd6e0950934df3aa/JIT.CodeGenBringUpTests/1/console.81010852.log?helixlogtype=result
@lewing is this a known failure mode ?

also
https://helixre107v0xdeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-pull-75885-merge-61dd6e0950934df3aa/JIT.HardwareIntrinsics.X86.Sse1/1/console.0d3c3828.log?helixlogtype=result
https://helixre107v0xdeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-pull-75885-merge-61dd6e0950934df3aa/JIT.HardwareIntrinsics.X86.AvxVnni/1/console.1aa11bf1.log?helixlogtype=result

[carlossanlop]

I just remembered that the failure mentioned above in MSBuild is happening in other PRs. I had already opened this issue yesterday: #75867

So we can consider it unrelated to this change.

      Unhandled exception: System.IO.IOException: Connection timed out : 'Global\msbuild-server-launch-MmOQLObCTwIYk+VOCXULoCbHQULmwZ_RzAzo+dJyqpI'
         at System.Threading.Mutex.CreateMutexCore(Boolean initiallyOwned, String name, Boolean& createdNew)
         at Microsoft.Build.Experimental.MSBuildClient.TryLaunchServer()
         at Microsoft.Build.Experimental.MSBuildClient.Execute(CancellationToken cancellationToken)
         at Microsoft.Build.CommandLine.MSBuildClientApp.Execute(String[] commandLine, String msbuildLocation, CancellationToken cancellationToken)
         at Microsoft.Build.CommandLine.MSBuildApp.Main(String[] args)
         at Microsoft.DotNet.Cli.Utils.MSBuildForwardingAppWithoutLogging.ExecuteInProc(String[] arguments)

[carlossanlop]

This other failure is also unrelated to this change. It's being tracked in this issue: #75391

Microsoft.DotNet.XUnitConsoleRunner v2.5.0 (64-bit .NET 7.0.0-rc.1.22423.16)
  Discovering: JIT.Math.XUnitWrapper (method display = ClassAndMethod, method display options = None)
  Discovered:  JIT.Math.XUnitWrapper (found 2 test cases)
  Starting:    JIT.Math.XUnitWrapper (parallel test collections = on, max threads = 2)
    JIT/Math/Functions/Functions_ro/Functions_ro.sh [FAIL]
      
      Return code:      1
      Raw output file:      /datadisks/disk1/work/B44709B0/w/A6DF0914/uploads/Reports/JIT.Math/Functions/Functions_ro/Functions_ro.output.txt
      Raw output:
      BEGIN EXECUTION
      MSBuild version 17.4.0-preview-22416-02+5d102ae37 for .NET
      /datadisks/disk1/work/B44709B0/p/wasm-test-runner/WasmTestRunner.proj : error : Failed to resolve SDK 'Microsoft.Build.NoTargets/3.5.0'. Package restore was successful but a package with the ID of "Microsoft.Build.NoTargets" was not installed.
      /datadisks/disk1/work/B44709B0/p/wasm-test-runner/WasmTestRunner.proj : error MSB4236: The SDK 'Microsoft.Build.NoTargets/3.5.0' specified could not be found.
      Test Harness Exitcode is : 1
      To run the test:
      > set CORE_ROOT=/datadisks/disk1/work/B44709B0/p
      > /datadisks/disk1/work/B44709B0/w/A6DF0914/e/JIT/Math/Functions/Functions_ro/Functions_ro.sh
      Expected: True
      Actual:   False
      Stack Trace:
           at JIT_Math._Functions_Functions_ro_Functions_ro_._Functions_Functions_ro_Functions_ro_sh()
           at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
           at System.Reflection.MethodInvoker.Invoke(Object obj, IntPtr* args, BindingFlags invokeAttr)
      Output:
        
        Return code:      1
        Raw output file:      /datadisks/disk1/work/B44709B0/w/A6DF0914/uploads/Reports/JIT.Math/Functions/Functions_ro/Functions_ro.output.txt
        Raw output:
        BEGIN EXECUTION
        MSBuild version 17.4.0-preview-22416-02+5d102ae37 for .NET
        /datadisks/disk1/work/B44709B0/p/wasm-test-runner/WasmTestRunner.proj : error : Failed to resolve SDK 'Microsoft.Build.NoTargets/3.5.0'. Package restore was successful but a package with the ID of "Microsoft.Build.NoTargets" was not installed.
        /datadisks/disk1/work/B44709B0/p/wasm-test-runner/WasmTestRunner.proj : error MSB4236: The SDK 'Microsoft.Build.NoTargets/3.5.0' specified could not be found.
        Test Harness Exitcode is : 1
        To run the test:
        > set CORE_ROOT=/datadisks/disk1/work/B44709B0/p
        > /datadisks/disk1/work/B44709B0/w/A6DF0914/e/JIT/Math/Functions/Functions_ro/Functions_ro.sh
  Finished:    JIT.Math.XUnitWrapper
=== TEST EXECUTION SUMMARY ===
   JIT.Math.XUnitWrapper  Total: 2, Errors: 0, Failed: 1, Skipped: 0, Time: 4.675s

[carlossanlop]

CI failures are unrelated, pre-existing: #75391
Signed off. Approved by Tactics. Ready to merge.