AV under coreclr!GlobalStringLiteralMap::AddStringLiteral

[jkotas]

Stacktrace:

coreclr!memcpy+0x470 [D:\a\_work\1\s\src\vctools\crt\vcruntime\src\string\i386\memcpy.asm @ 596] 
coreclr!memcpyNoGCRefs+0x9 [D:\a\_work\1\s\src\coreclr\vm\common.h @ 248] 
coreclr!AllocateStringObject+0xc9 [D:\a\_work\1\s\src\coreclr\vm\stringliteralmap.cpp @ 478] 
coreclr!GlobalStringLiteralMap::AddStringLiteral+0xa6 [D:\a\_work\1\s\src\coreclr\vm\stringliteralmap.cpp @ 500] 
coreclr!GlobalStringLiteralMap::AddInternedString+0xb7 [D:\a\_work\1\s\src\coreclr\vm\stringliteralmap.cpp @ 551] 
coreclr!GlobalStringLiteralMap::GetInternedString+0x325 [D:\a\_work\1\s\src\coreclr\vm\stringliteralmap.cpp @ 433] 
coreclr!LCGMethodResolver::GetOrInternString+0xe4 [D:\a\_work\1\s\src\coreclr\vm\dynamicmethod.cpp @ 1278] 
coreclr!LCGMethodResolver::ConstructStringLiteral+0xfb [D:\a\_work\1\s\src\coreclr\vm\dynamicmethod.cpp @ 1212] 
coreclr!CEEJitInfo::constructStringLiteral+0x10c [D:\a\_work\1\s\src\coreclr\vm\jitinterface.cpp @ 11640] 

coreclr!memcpy+0x470:
721d99d0 660f6f06        movdqa  xmm0,xmmword ptr [esi] ds:002b:12239780=????????????????????????????????

Hit in #76466. Dump: https://dev.azure.com/dnceng-public/public/_build/results?buildId=36807&view=ms.vss-test-web.build-test-results-tab&runId=734726&resultId=194901&paneView=dotnet-dnceng.dnceng-anon-build-release-tasks.helix-anon-test-information-tab

[dotnet-issue-labeler]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[ghost]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Stacktrace:

coreclr!memcpy+0x470 [D:\a\_work\1\s\src\vctools\crt\vcruntime\src\string\i386\memcpy.asm @ 596] 
coreclr!memcpyNoGCRefs+0x9 [D:\a\_work\1\s\src\coreclr\vm\common.h @ 248] 
coreclr!AllocateStringObject+0xc9 [D:\a\_work\1\s\src\coreclr\vm\stringliteralmap.cpp @ 478] 
coreclr!GlobalStringLiteralMap::AddStringLiteral+0xa6 [D:\a\_work\1\s\src\coreclr\vm\stringliteralmap.cpp @ 500] 
coreclr!GlobalStringLiteralMap::AddInternedString+0xb7 [D:\a\_work\1\s\src\coreclr\vm\stringliteralmap.cpp @ 551] 
coreclr!GlobalStringLiteralMap::GetInternedString+0x325 [D:\a\_work\1\s\src\coreclr\vm\stringliteralmap.cpp @ 433] 
coreclr!LCGMethodResolver::GetOrInternString+0xe4 [D:\a\_work\1\s\src\coreclr\vm\dynamicmethod.cpp @ 1278] 
coreclr!LCGMethodResolver::ConstructStringLiteral+0xfb [D:\a\_work\1\s\src\coreclr\vm\dynamicmethod.cpp @ 1212] 
coreclr!CEEJitInfo::constructStringLiteral+0x10c [D:\a\_work\1\s\src\coreclr\vm\jitinterface.cpp @ 11640] 

coreclr!memcpy+0x470:
721d99d0 660f6f06        movdqa  xmm0,xmmword ptr [esi] ds:002b:12239780=????????????????????????????????

Hit in #76466. Dump: https://dev.azure.com/dnceng-public/public/_build/results?buildId=36807&view=ms.vss-test-web.build-test-results-tab&runId=734726&resultId=194901&paneView=dotnet-dnceng.dnceng-anon-build-release-tasks.helix-anon-test-information-tab

Author:	jkotas
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[jkotas]

@EgorBo Looks like there may be a race condition introduced by the frozen string changes.

[EgorBo]

@EgorBo Looks like there may be a race condition introduced by the frozen string changes.

Ah, I think I know why, let me check

[jkotas]

This change in GlobalStringLiteralMap::AddInternedString introduced the problem: https://github.com/dotnet/runtime/pull/49576/files#diff-d86558f39cd09fa14c22d6e7ec315bb6dcd717784d90a69680508862ea7d893cR551 . The new code has a GC hole. Also, it is inefficient to allocate a new string object if we have one already.

[EgorBo]

@jkotas yes, that was exactly my first though when I saw this issue - it was supposed to remove "duplicated" code that is not actually dup.