Skip to content

[mono][sgen] Fix card scanning in LOS non-array objects#125116

Open
BrzVlad wants to merge 1 commit intodotnet:mainfrom
BrzVlad:fix-sgen-card-scan
Open

[mono][sgen] Fix card scanning in LOS non-array objects#125116
BrzVlad wants to merge 1 commit intodotnet:mainfrom
BrzVlad:fix-sgen-card-scan

Conversation

@BrzVlad
Copy link
Member

@BrzVlad BrzVlad commented Mar 3, 2026

sgen_card_table_region_begin_scanning needs to determine whether any cards are marked in the object starting at start address. The current card size in 512 bytes. Consider an object with start 500 and size 20, so this object lives within 2 cards. We will check the card associated with the address 500. Once this iteration is done, we will check whether start + card_size < end => 500 + 512 < 520. This is false, so we will no longer scan the second card. The algorithm was expecting the start address to be aligned to the card start, which is what the fix does.

This bug is severe, but, in practice, this code path is not as frequent. This bug would only affect objects greater than 8k, that are not arrays.

Fixes #124941

`sgen_card_table_region_begin_scanning` needs to determine whether any cards are marked in the object starting at `start` address. The current card size in 512 bytes. Consider an object with start 500 and size 20, so this object lives within 2 cards. We will check the card associated with the address 500. Once this iteration is done, we will check whether  `start + card_size < end` => `500 + 512 < 520`. This is false, so we will no longer scan the second card. The algorithm was expecting the start address to be aligned to the card start, which is what the fix does.

This bug is severe, but, in practice, this code path is not as frequent. This bug would only affect objects greater than 8k, that are not arrays.
@BrzVlad BrzVlad requested a review from steveisok as a code owner March 3, 2026 13:43
Copilot AI review requested due to automatic review settings March 3, 2026 13:43
@BrzVlad BrzVlad requested a review from vitek-karas as a code owner March 3, 2026 13:43
@BrzVlad BrzVlad requested a review from lateralusX March 3, 2026 13:43
@dotnet-policy-service
Copy link
Contributor

Tagging subscribers to this area: @BrzVlad
See info in area-owners.md if you want to be subscribed.

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes SGen card-table scanning for large (LOS) non-array objects when the object start address is not aligned to a card boundary, ensuring all cards that overlap the object are checked for marks before deciding whether to scan the object.

Changes:

  • Align the start address down to the containing card boundary in sgen_card_table_region_begin_scanning (overlapping-cards configuration).
  • Ensures multi-card objects that begin mid-card do not skip subsequent cards during the per-card iteration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Mono] Interpreter: Missing write barrier in Delegate field assignment (+=) causes GC consistency error and crash in Delegate.Remove

2 participants