Segmentation fault (SIGSEGV) libclrjit.so`GenTreeVisitor

[risperdal]

Description

I am using efcore to query my tables. Recently i got a crash which happens only linux enviroments. I was able to reproduce the bug.

POC repo: https://github.com/risperdal/jitcrashpoc.git

Minimal example looks like this

  var services = new ServiceCollection();

  services.AddDbContext<ClientDbContext>((serviceProvider, options) =>
  {
      options.EnableDetailedErrors();
      options.UseSqlite($"Data Source=:memory:");
  });

  var sp = services.BuildServiceProvider();

  using var scope = sp.CreateScope();
  var cctx = scope.ServiceProvider.GetService<ClientDbContext>();

  Console.WriteLine("executing");
  await cctx.Database.OpenConnectionAsync();
  await cctx.Database.MigrateAsync();

  await cctx.example_table.AddAsync(new example_table
  {
      col_1 = 1
  });

  await cctx.SaveChangesAsync();

  var rows = await cctx.example_table.ToListAsync();

  foreach (var item in rows)
  {
      Console.WriteLine(item.col_1);
  }

  Console.WriteLine("executed");

Reproduction Steps

git clone https://github.com/risperdal/jitcrashpoc.git
cd jitcrashpoc
dotnet run

Expected behavior

should be printing

executing
1
executed

Actual behavior

instead it crashes after printing executing

Regression?

No response

Known Workarounds

If i comment options.EnableDetailedErrors(); it is perfectly working.
Aside from commenting options.EnableDetailedErrors(); line i got it working by changing some column types to double, string and got it working some times with removing columns vice versa

Configuration

I got crashed it on my development machine both WSL2 and regular aspnet docker images. And it is crashing on my production enviroment too.

dotnet --info

.NET SDK:
 Version:           9.0.203
 Commit:            dc7acfa194
 Workload version:  9.0.200-manifests.9df47798
 MSBuild version:   17.13.20+a4ef1e90f

Runtime Environment:
 OS Name:     debian
 OS Version:  12
 OS Platform: Linux
 RID:         linux-x64
 Base Path:   /usr/share/dotnet/sdk/9.0.203/

.NET workloads installed:
There are no installed workloads to display.
Configured to use loose manifests when installing new manifests.

Host:
  Version:      9.0.4
  Architecture: x64
  Commit:       f57e6dc747

.NET SDKs installed:
  9.0.203 [/usr/share/dotnet/sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 9.0.4 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 9.0.4 [/usr/share/dotnet/shared/Microsoft.NETCore.App]

Other architectures found:
  None

Environment variables:
  Not set

global.json file:
  Not found

Learn more:
  https://aka.ms/dotnet/info

Download .NET:
  https://aka.ms/dotnet/download

Other information

I run it with lldb.
bt

(lldb) bt
* thread #1, name = 'dotnet', stop reason = signal SIGSEGV: invalid address (fault address: 0x88000003be)
  * frame #0: 0x00007ffff2d1179a libclrjit.so`GenTreeVisitor<GenericTreeWalker<false, true, false, true> >::WalkTree(GenTree**, GenTree*) [inlined] GenTree::OperGet(this=0x00000088000003be) const at gentree.h:701:16
    frame #1: 0x00007ffff2d1179a libclrjit.so`GenTreeVisitor<GenericTreeWalker<false, true, false, true> >::WalkTree(this=0x00007fffffffa878, use=0x000055555636aeb8, user=0x000055555636ae88) at compiler.h:11701:23
    frame #2: 0x00007ffff2d117ed libclrjit.so`GenTreeVisitor<GenericTreeWalker<false, true, false, true> >::WalkTree(this=0x00007fffffffa878, use=0x000055555636aed0, user=0x000055555643eb50) at compiler.h:0
    frame #3: 0x00007ffff2d11902 libclrjit.so`GenTreeVisitor<GenericTreeWalker<false, true, false, true> >::WalkTree(this=0x00007fffffffa878, use=0x000055555643ebc0, user=0x000055555643eb98) at compiler.h:11812:30
    frame #4: 0x00007ffff2d117ed libclrjit.so`GenTreeVisitor<GenericTreeWalker<false, true, false, true> >::WalkTree(this=0x00007fffffffa878, use=0x000055555643ebe0, user=0x0000000000000000) at compiler.h:0
    frame #5: 0x00007ffff2d08e5c libclrjit.so`Compiler::optAssertionPropMain() at compiler.hpp:3118:25
    frame #6: 0x00007ffff2d08de4 libclrjit.so`Compiler::optAssertionPropMain() [inlined] Compiler::optVNAssertionPropCurStmt(this=0x0000555556065b28, block=0x0000555556092148, stmt=0x000055555643ebe0) at assertionprop.cpp:6603:5
    frame #7: 0x00007ffff2d08dae libclrjit.so`Compiler::optAssertionPropMain(this=0x0000555556065b28) at assertionprop.cpp:6658:39
    frame #8: 0x00007ffff2b7f5b0 libclrjit.so`jitNativeCode(CORINFO_METHOD_STRUCT_*, CORINFO_MODULE_STRUCT_*, ICorJitInfo*, CORINFO_METHOD_INFO*, void**, unsigned int*, JitFlags*, void*) [inlined] Phase::Run(this=0x00007fffffffb518) at phase.cpp:61:26
    frame #9: 0x00007ffff2b7f599 libclrjit.so`jitNativeCode(CORINFO_METHOD_STRUCT_*, CORINFO_MODULE_STRUCT_*, ICorJitInfo*, CORINFO_METHOD_INFO*, void**, unsigned int*, JitFlags*, void*) [inlined] DoPhase(_compiler=0x0000555556065b28, _phase=PHASE_ASSERTION_PROP_MAIN, _action=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00)()) at phase.h:143:11
    frame #10: 0x00007ffff2b7f553 libclrjit.so`jitNativeCode(CORINFO_METHOD_STRUCT_*, CORINFO_MODULE_STRUCT_*, ICorJitInfo*, CORINFO_METHOD_INFO*, void**, unsigned int*, JitFlags*, void*) at compiler.cpp:5141:17
    frame #11: 0x00007ffff2b7eb07 libclrjit.so`jitNativeCode(CORINFO_METHOD_STRUCT_*, CORINFO_MODULE_STRUCT_*, ICorJitInfo*, CORINFO_METHOD_INFO*, void**, unsigned int*, JitFlags*, void*) [inlined] Compiler::compCompileHelper(this=0x0000555556065b28, classPtr=<unavailable>, compHnd=<unavailable>, methodInfo=0x00007fffffffcaa0, methodCodePtr=0x00007fffffffc8a8, methodCodeSize=0x00007fffffffca5c, compileFlags=0x00007fffffffc8d0) at compiler.cpp:7396:5
    frame #12: 0x00007ffff2b7e9b1 libclrjit.so`jitNativeCode(CORINFO_METHOD_STRUCT_*, CORINFO_MODULE_STRUCT_*, ICorJitInfo*, CORINFO_METHOD_INFO*, void**, unsigned int*, JitFlags*, void*) [inlined] Compiler::compCompile(this=<unavailable>, __JITpParam=<unavailable>)::$_0::operator()(Compiler::compCompile(CORINFO_MODULE_STRUCT_*, void**, unsigned int*, JitFlags*)::__JITParam*) const at compiler.cpp:6533:28
    frame #13: 0x00007ffff2b7e9b1 libclrjit.so`jitNativeCode(CORINFO_METHOD_STRUCT_*, CORINFO_MODULE_STRUCT_*, ICorJitInfo*, CORINFO_METHOD_INFO*, void**, unsigned int*, JitFlags*, void*) at compiler.cpp:6552:5
    frame #14: 0x00007ffff2b7e9b1 libclrjit.so`jitNativeCode(CORINFO_METHOD_STRUCT_*, CORINFO_MODULE_STRUCT_*, ICorJitInfo*, CORINFO_METHOD_INFO*, void**, unsigned int*, JitFlags*, void*) at compiler.cpp:8036:20
    frame #15: 0x00007ffff2b7e9b1 libclrjit.so`jitNativeCode(CORINFO_METHOD_STRUCT_*, CORINFO_MODULE_STRUCT_*, ICorJitInfo*, CORINFO_METHOD_INFO*, void**, unsigned int*, JitFlags*, void*) at compiler.cpp:8060:1
    frame #16: 0x00007ffff2b7e74a libclrjit.so`jitNativeCode(methodHnd=0x00007fff7bca6fd0, classPtr=0x00007fff7bca7911, compHnd=0x00007fffffffcc40, methodInfo=0x00007fffffffcaa0, methodCodePtr=0x00007fffffffc8a8, methodCodeSize=0x00007fffffffca5c, compileFlags=0x00007fffffffc8d0, inlineInfoPtr=0x0000000000000000) at compiler.cpp:8062:1
    frame #17: 0x00007ffff2b79fa4 libclrjit.so`CILJit::compileMethod(this=<unavailable>, compHnd=0x00007fffffffcc40, methodInfo=0x00007fffffffcaa0, flags=<unavailable>, entryAddress=0x00007fffffffca60, nativeSizeOfCode=0x00007fffffffca5c) at ee_il_dll.cpp:291:14
    frame #18: 0x00007ffff7514076 libcoreclr.so`invokeCompileMethodHelper(jitMgr=0x00005555555b1cc0, comp=0x00007fffffffcc40, info=0x00007fffffffcaa0, jitFlags=CORJIT_FLAGS @ 0x00007fffffffc9a8, nativeEntry=0x00007fffffffca60, nativeSizeOfCode=0x00007fffffffca5c) at jitinterface.cpp:12464:30 [opt]
    frame #19: 0x00007ffff751426a libcoreclr.so`invokeCompileMethod(jitMgr=0x00005555555b1cc0, comp=0x00007fffffffcc40, info=0x00007fffffffcaa0, jitFlags=CORJIT_FLAGS @ 0x00007fffffffcbf8, nativeEntry=0x00007fffffffca60, nativeSizeOfCode=0x00007fffffffca5c) at jitinterface.cpp:12527:24 [opt]
    frame #20: 0x00007ffff7514df7 libcoreclr.so`UnsafeJitFunction(config=0x00007fffffffd118, ILHeader=0x0000000000000000, pJitFlags=0x00007fffffffce30, pSizeOfCode=0x00007fffffffcf4c) at jitinterface.cpp:12971:19 [opt]
    frame #21: 0x00007ffff754f6ea libcoreclr.so`MethodDesc::JitCompileCodeLocked(this=0x00007fff7bca6fd0, pConfig=0x00007fffffffd118, pilHeader=0x0000000000000000, pEntry=0x00007fbec4003b50, pSizeOfCode=0x00007fffffffcf4c) at prestub.cpp:937:17 [opt]
    frame #22: 0x00007ffff754efce libcoreclr.so`MethodDesc::JitCompileCodeLockedEventWrapper(this=0x00007fff7bca6fd0, pConfig=0x00007fffffffd118, pEntry=0x00007fbec4003b50) at prestub.cpp:818:17 [opt]
    frame #23: 0x00007ffff754e735 libcoreclr.so`MethodDesc::JitCompileCode(this=0x00007fff7bca6fd0, pConfig=0x00007fffffffd118) at prestub.cpp:705:20 [opt]
    frame #24: 0x00007ffff754e0fe libcoreclr.so`MethodDesc::PrepareILBasedCode(this=0x00007fff7bca6fd0, pConfig=0x00007fffffffd118) at prestub.cpp:431:17 [opt]
    frame #25: 0x00007ffff7553491 libcoreclr.so`MethodDesc::DoPrestub(MethodTable*, CallerGCMode) [inlined] MethodDesc::PrepareCode(this=0x00007fff7bca6fd0, pConfig=0x00007fffffffd118) at prestub.cpp:319:19 [opt]
    frame #26: 0x00007ffff7553489 libcoreclr.so`MethodDesc::DoPrestub(MethodTable*, CallerGCMode) [inlined] MethodDesc::PrepareInitialCode(this=0x00007fff7bca6fd0, callerGCMode=Unknown) at prestub.cpp:309:12 [opt]
    frame #27: 0x00007ffff7553427 libcoreclr.so`MethodDesc::DoPrestub(this=0x00007fff7bca6fd0, pDispatchingMT=0x0000000000000000, callerGCMode=Unknown) at prestub.cpp:2917:17 [opt]
    frame #28: 0x00007ffff765858a libcoreclr.so`::ReflectionInvocation_CompileMethod(pMD=0x00007fff7bca6fd0) at reflectioninvocation.cpp:1305:10 [opt]
    frame #29: 0x00007fff78603ebf
    frame #30: 0x00007fff7bcb0c9a
    frame #31: 0x00007fff7b73e19f
    frame #32: 0x00007fff7b73df31
    frame #33: 0x00007fff7b73dea5
    frame #34: 0x00007fff7b73ddae
    frame #35: 0x00007fff7b73d51c
    frame #36: 0x00007fff788358f4
    frame #37: 0x00007fff7b73cc6f
    frame #38: 0x00007fff7b73c8a3
    frame #39: 0x00007fff7b73c7a0
    frame #40: 0x00007fff7b73c6bf
    frame #41: 0x00007fff792b22bb
    frame #42: 0x00007fff792b19e2
    frame #43: 0x00007fff792b194c
    frame #44: 0x00007fff792b1906
    frame #45: 0x00007fff792b187e
    frame #46: 0x00007ffff776fe04 libcoreclr.so`CallDescrWorkerInternal at calldescrworkeramd64.S:70
    frame #47: 0x00007ffff75ae11c libcoreclr.so`MethodDescCallSite::CallTargetWorker(unsigned long const*, unsigned long*, int) at callhelpers.cpp:63:5 [opt]
    frame #48: 0x00007ffff75ae0c3 libcoreclr.so`MethodDescCallSite::CallTargetWorker(this=<unavailable>, pArguments=0x00007fffffffdf18, pReturnValue=0x0000000000000000, cbReturnValue=0) at callhelpers.cpp:585:9 [opt]
    frame #49: 0x00007ffff74950c4 libcoreclr.so`RunMain(MethodDesc*, short, int*, PtrArray**) [inlined] MethodDescCallSite::Call(this=0x00007fffffffdf78, pArguments=0x00007fffffffdf18) at callhelpers.h:465:9 [opt]
    frame #50: 0x00007ffff74950bb libcoreclr.so`RunMain(MethodDesc*, short, int*, PtrArray**) at assembly.cpp:1234:21 [opt]
    frame #51: 0x00007ffff7494f69 libcoreclr.so`RunMain(MethodDesc*, short, int*, PtrArray**) [inlined] RunMain(this=<unavailable>, pParam=0x00007fffffffdee0)::$_0::operator()(Param*) const::'lambda'(Param*)::operator()(Param*) const at assembly.cpp:1306:9 [opt]
    frame #52: 0x00007ffff7494f69 libcoreclr.so`RunMain(MethodDesc*, short, int*, PtrArray**) at assembly.cpp:1308:5 [opt]
    frame #53: 0x00007ffff7494f5c libcoreclr.so`RunMain(pFD=0x00007fff79359760, numSkipArgs=1, piRetVal=0x00007fffffffe0cc, stringArgs=0x00007fffffffe3a0) at assembly.cpp:1308:5 [opt]
    frame #54: 0x00007ffff749553c libcoreclr.so`Assembly::ExecuteMainMethod(this=0x00005555555b2260, stringArgs=0x00007fffffffe3a0, waitForOtherThreads=YES) at assembly.cpp:1434:18 [opt]
    frame #55: 0x00007ffff74beb34 libcoreclr.so`CorHost2::ExecuteAssembly(this=<unavailable>, dwAppDomainId=<unavailable>, pwzAssemblyPath=<unavailable>, argc=0, argv=0x0000000000000000, pReturnValue=0x00007fffffffe500) at corhost.cpp:349:39 [opt]
    frame #56: 0x00007ffff7481340 libcoreclr.so`::coreclr_execute_assembly(hostHandle=0x000055555557d1f0, domainId=1, argc=0, argv=<unavailable>, managedAssemblyPath=<unavailable>, exitCode=0x00007fffffffe500) at exports.cpp:494:24
    frame #57: 0x00007ffff7a49301 libhostpolicy.so`run_app_for_context(context=0x000055555557f380, argc=0, argv=0x00007fffffffec38) at hostpolicy.cpp:250:32 [opt]
    frame #58: 0x00007ffff7a4a3f9 libhostpolicy.so`::corehost_main(const int, const pal::char_t **) [inlined] run_app(argc=0, argv=0x00007fffffffec38) at hostpolicy.cpp:285:12 [opt]
    frame #59: 0x00007ffff7a4a3d9 libhostpolicy.so`::corehost_main(argc=2, argv=<unavailable>) at hostpolicy.cpp:426:12 [opt]
    frame #60: 0x00007ffff7a89685 libhostfxr.so`fx_muxer_t::handle_exec_host_command(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, host_startup_info_t const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<known_options, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, known_options_hash, std::equal_to<known_options>, std::allocator<std::pair<known_options const, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > > > const&, int, char const**, int, host_mode_t, bool, char*, int, int*) at fx_muxer.cpp:145:20 [opt]
    frame #61: 0x00007ffff7a8941b libhostfxr.so`fx_muxer_t::handle_exec_host_command(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, host_startup_info_t const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::unordered_map<known_options, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, known_options_hash, std::equal_to<known_options>, std::allocator<std::pair<known_options const, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > > > > const&, int, char const**, int, host_mode_t, bool, char*, int, int*) [inlined] (anonymous namespace)::read_config_and_execute(host_command=<unavailable>, host_info=<unavailable>, app_candidate="\xf0", opts=<unavailable>, new_argc=2, new_argv=0x00007fffffffec28, mode=<unavailable>, is_sdk_command=<unavailable>, out_buffer=<unavailable>, buffer_size=<unavailable>, required_buffer_size=<unavailable>) at fx_muxer.cpp:532:18 [opt]
    frame #62: 0x00007ffff7a89316 libhostfxr.so`fx_muxer_t::handle_exec_host_command(host_command="", host_info=0x00007fffffffe8c0, app_candidate="\xf0", opts=size=0, argc=2, argv=0x00007fffffffec28, argoff=1, mode=muxer, is_sdk_command=<unavailable>, result_buffer=0x0000000000000000, buffer_size=0, required_buffer_size=0x0000000000000000) at fx_muxer.cpp:1007:12 [opt]
    frame #63: 0x00007ffff7a8867d libhostfxr.so`fx_muxer_t::execute(host_command=<unavailable>, argc=2, argv=0x00007fffffffec28, host_info=0x00007fffffffe8c0, result_buffer=0x0000000000000000, buffer_size=0, required_buffer_size=0x0000000000000000) at fx_muxer.cpp:578:18 [opt]
    frame #64: 0x00007ffff7a825f2 libhostfxr.so`::hostfxr_main_startupinfo(argc=2, argv=0x00007fffffffec28, host_path="/usr/share/dotnet/dotnet", dotnet_root="/usr/share/dotnet/", app_path="/usr/share/dotnet/dotnet.dll") at hostfxr.cpp:63:12 [opt]
    frame #65: 0x000055555555b9db dotnet`exe_start(argc=2, argv=0x00007fffffffec28) at corehost.cpp:253:18 [opt]
    frame #66: 0x000055555555bcbf dotnet`main(argc=2, argv=0x00007fffffffec28) at corehost.cpp:321:21 [opt]
    frame #67: 0x00007ffff7add24a libc.so.6`__libc_start_call_main(main=(dotnet`main at corehost.cpp:303), argc=2, argv=0x00007fffffffec28) at libc_start_call_main.h:58:16
    frame #68: 0x00007ffff7add305 libc.so.6`__libc_start_main_impl(main=(dotnet`main at corehost.cpp:303), argc=2, argv=0x00007fffffffec28, init=0x00007ffff7ffd020, fini=<unavailable>, rtld_fini=<unavailable>, stack_end=0x00007fffffffec18) at libc-start.c:360:3
    frame #69: 0x000055555555add9 dotnet`_start + 41

clrstack

(lldb) clrstack
OS Thread Id: 0x37 (1)
        Child SP               IP Call Site
00007FFFFFFFD248 00007ffff2d1179a [InlinedCallFrame: 00007fffffffd248]
00007FFFFFFFD248 00007fff78603eaf [InlinedCallFrame: 00007fffffffd248]
00007FFFFFFFD210 00007FFF78603EAF System.Reflection.Emit.DynamicMethod.CreateDelegate(System.Type, System.Object) [/_/src/coreclr/System.Private.CoreLib/src/System/Reflection/Emit/DynamicMethod.CoreCLR.cs @ 54]
00007FFFFFFFD2D0 00007FFF7BCB0C9A SOS Warning: Loading symbols for dynamic assemblies is not yet supported
DynamicClass.lambda_method1219(System.Runtime.CompilerServices.Closure, Microsoft.EntityFrameworkCore.Query.QueryContext)
00007FFFFFFFD310 00007FFF7B73E19F Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.ExecuteCore[[System.__Canon, System.Private.CoreLib]](System.Linq.Expressions.Expression, Boolean, System.Threading.CancellationToken) [/_/src/EFCore/Query/Internal/QueryCompiler.cs @ 79]
00007FFFFFFFD3C0 00007FFF7B73DF31 Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.ExecuteAsync[[System.__Canon, System.Private.CoreLib]](System.Linq.Expressions.Expression, System.Threading.CancellationToken) [/_/src/EFCore/Query/Internal/QueryCompiler.cs @ 69]
00007FFFFFFFD410 00007FFF7B73DEA5 Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryProvider.ExecuteAsync[[System.__Canon, System.Private.CoreLib]](System.Linq.Expressions.Expression, System.Threading.CancellationToken)
00007FFFFFFFD470 00007FFF7B73DDAE Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryable`1[[System.__Canon, System.Private.CoreLib]].GetAsyncEnumerator(System.Threading.CancellationToken)
00007FFFFFFFD4F0 00007FFF7B73D51C Microsoft.EntityFrameworkCore.Internal.InternalDbSet`1[[System.__Canon, System.Private.CoreLib]].System.Collections.Generic.IAsyncEnumerable<TEntity>.GetAsyncEnumerator(System.Threading.CancellationToken) [/_/src/EFCore/Internal/InternalDbSet.cs @ 495]
00007FFFFFFFD520 00007FFF788358F4 System.Runtime.CompilerServices.ConfiguredCancelableAsyncEnumerable`1[[System.__Canon, System.Private.CoreLib]].GetAsyncEnumerator() [/_/src/libraries/System.Private.CoreLib/src/System/Runtime/CompilerServices/ConfiguredCancelableAsyncEnumerable.cs @ 44]
00007FFFFFFFD540 00007FFF7B73CC6F Microsoft.EntityFrameworkCore.EntityFrameworkQueryableExtensions+<ToListAsync>d__67`1[[System.__Canon, System.Private.CoreLib]].MoveNext()
00007FFFFFFFD7B0 00007FFF7B73C8A3 System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start[[Microsoft.EntityFrameworkCore.EntityFrameworkQueryableExtensions+<ToListAsync>d__67`1[[System.__Canon, System.Private.CoreLib]], Microsoft.EntityFrameworkCore]](<ToListAsync>d__67`1<System.__Canon> ByRef) [/_/src/libraries/System.Private.CoreLib/src/System/Runtime/CompilerServices/AsyncMethodBuilderCore.cs @ 38]
00007FFFFFFFD880 00007FFF7B73C7A0 System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1[[System.__Canon, System.Private.CoreLib]].Start[[Microsoft.EntityFrameworkCore.EntityFrameworkQueryableExtensions+<ToListAsync>d__67`1[[System.__Canon, System.Private.CoreLib]], Microsoft.EntityFrameworkCore]](<ToListAsync>d__67`1<System.__Canon> ByRef) [/_/src/libraries/System.Private.CoreLib/src/System/Runtime/CompilerServices/AsyncTaskMethodBuilderT.cs @ 35]
00007FFFFFFFD8C0 00007FFF7B73C6BF Microsoft.EntityFrameworkCore.EntityFrameworkQueryableExtensions.ToListAsync[[System.__Canon, System.Private.CoreLib]](System.Linq.IQueryable`1<System.__Canon>, System.Threading.CancellationToken)
00007FFFFFFFD980 00007FFF792B22BB JitCrashPoc.Program+<Main>d__0.MoveNext() [/src/Program.cs @ 34]
00007FFFFFFFDB50 00007FFF792B19E2 System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start[[JitCrashPoc.Program+<Main>d__0, JitCrashPoc]](<Main>d__0 ByRef) [/_/src/libraries/System.Private.CoreLib/src/System/Runtime/CompilerServices/AsyncMethodBuilderCore.cs @ 38]
00007FFFFFFFDBE0 00007FFF792B194C System.Runtime.CompilerServices.AsyncTaskMethodBuilder.Start[[JitCrashPoc.Program+<Main>d__0, JitCrashPoc]](<Main>d__0 ByRef) [/_/src/libraries/System.Private.CoreLib/src/System/Runtime/CompilerServices/AsyncTaskMethodBuilder.cs @ 33]
00007FFFFFFFDC00 00007FFF792B1906 JitCrashPoc.Program.Main(System.String[])
00007FFFFFFFDC70 00007FFF792B187E JitCrashPoc.Program.<Main>(System.String[])
(lldb)

parallelstacks

(lldb) parallelstacks

________________________________________________
 ~~~~ 37
    1 System.Reflection.Emit.DynamicMethod.CreateDelegate(Type, Object)
    1 lambda_method1219(Closure, QueryContext)
    1 Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.ExecuteCore(Expression, Boolean, CancellationToken)
    1 Microsoft.EntityFrameworkCore.Query.Internal.QueryCompiler.ExecuteAsync(Expression, CancellationToken)
    1 Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryProvider.ExecuteAsync(Expression, CancellationToken)
    1 Microsoft.EntityFrameworkCore.Query.Internal.EntityQueryable<System.__Canon>.GetAsyncEnumerator(CancellationToken)
    1 Microsoft.EntityFrameworkCore.Internal.InternalDbSet<System.__Canon>.GetAsyncEnumerator(CancellationToken)
    1 System.Runtime.CompilerServices.ConfiguredCancelableAsyncEnumerable<System.__Canon>.GetAsyncEnumerator()
    1 Microsoft.EntityFrameworkCore.EntityFrameworkQueryableExtensions+<ToListAsync>d__67<System.__Canon>.MoveNext()
    1 System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start(<ToListAsync>d__67<__Canon> ByRef)
    1 System.Runtime.CompilerServices.AsyncTaskMethodBuilder<System.__Canon>.AsyncTaskMethodBuilder`1(<ToListAsync>d__67<__Canon> ByRef)
    1 Microsoft.EntityFrameworkCore.EntityFrameworkQueryableExtensions.ToListAsync(IQueryable<__Canon>, CancellationToken)
    1 JitCrashPoc.Program+<Main>d__0.MoveNext()
    1 System.Runtime.CompilerServices.AsyncMethodBuilderCore.Start(<Main>d__0 ByRef)
    1 System.Runtime.CompilerServices.AsyncTaskMethodBuilder.Start(<Main>d__0 ByRef)
    1 JitCrashPoc.Program.Main(String[])
    1 JitCrashPoc.Program.<Main>(String[])


________________________________________________
 ~~~~ 94,96
    2 System.Threading.LowLevelLifoSemaphore.WaitNative(SafeWaitHandle, Int32)
    2 System.Threading.LowLevelLifoSemaphore.WaitForSignal(Int32)
    2 System.Threading.LowLevelLifoSemaphore.Wait(Int32, Boolean)
    2 System.Threading.PortableThreadPool+WorkerThread.WorkerThreadStart()


________________________________________________
 ~~~~ 95
    1 System.Threading.WaitHandle.WaitOneNoCheck(Int32, Boolean, Object, WaitHandleWaitSourceMap)
    1 System.Threading.PortableThreadPool+GateThread.GateThreadStart()


________________________________________________
 ~~~~ 97
    1 System.Threading.WaitHandle.WaitOneNoCheck(Int32, Boolean, Object, WaitHandleWaitSourceMap)
    1 System.Threading.TimerQueue.TimerThread()


==> 5 threads with 4 roots

(lldb)

[jakobbotsch]

cc @dotnet/jit-contrib

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[jakobbotsch]

Does not repro with .NET 10, so seems to be fixed in main (or affected in some other way). Have not narrowed down further yet.

[jakobbotsch]

This only repros with a release JIT, but I can repro it both with Linux and Windows cross jit (using an SPMI collection) so there's likely some JIT bug here.

[jakobbotsch]

Reopening to track a backport to .NET 9