GCRoot: Report GCFrame and in-flight exception objects

docs/design/datacontracts/StackWalk.md

@@ -149,6 +149,10 @@ This contract depends on the following descriptors:
 | `ExceptionInfo` | `PassNumber` | Exception handling pass (1 or 2) |
 | `ExceptionInfo` | `ClauseForCatchHandlerStartPC` | Start PC offset of the catch handler clause, used for interruptible offset override |
 | `ExceptionInfo` | `ClauseForCatchHandlerEndPC` | End PC offset of the catch handler clause, used for interruptible offset override |
+| `GCFrame` | `Next` | Pointer to the next `GCFrame` toward the top of the chain |
+| `GCFrame` | `ObjRefs` | Pointer to the array of protected object reference slots |
+| `GCFrame` | `NumObjRefs` | Count of protected object reference slots starting at `ObjRefs` |
+| `GCFrame` | `GCFlags` | `GC_CALL_*` promotion flags applied when reporting the protected slots |
 
 Global variables used:
 | Global Name | Type | Purpose |
@@ -168,6 +172,7 @@ Contracts used:
 | `Thread` |
 | `RuntimeTypeSystem` |
 | `GCInfo` |
+| `Exception` |
 
 
 ### Stackwalk Algorithm
@@ -594,7 +599,7 @@ If no Frame in the chain produces a usable context (thread is not running manage
 
 ### GC Stack Reference Scanning
 
-`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers. The native equivalent is `DacStackReferenceWalker` which calls `GcStackCrawlCallBack` at each frame.
+`WalkStackReferences` scans the stack for GC references by walking through each frame and reporting live object references and interior pointers, then reporting the thread's GCFrame (GCPROTECT) chain and in-flight exception (ExInfo) chain. This mirrors the GC's own root enumeration, `ScanStackRoots`.
 
 #### Stack Walk Integration
 
@@ -628,6 +633,15 @@ At each frame yielded by `Filter`, the walk determines whether to scan for GC re
 
 See [GCRefMap Format and Resolution](#gcrefmap-format-and-resolution) for the GCRefMap scanning path. The signature-based scanning fallback (`PromoteCallerStack`) is currently a stub awaiting an `ICallingConvention` contract port; the stress harness handles the resulting gaps via a deferred-frame sentinel (see [tests/StressTests/known-issues.md](../../../src/native/managed/cdac/tests/StressTests/known-issues.md) and tracking issue [dotnet/runtime#127765](https://github.com/dotnet/runtime/issues/127765)).
 
+#### GCFrame and Exception Tracker Roots
+
+After walking the thread's frames, `WalkStackReferences` reports two additional sets of roots that the GC keeps alive but that are not surfaced by per-frame GC info (matching native `gcenv.ee.cpp` `ScanStackRoots`):
+
+- **GCFrame (GCPROTECT) chain**: starting from `Thread.GCFrame` (obtained via the `Thread` contract's `GetThreadData`), each `GCFrame` is walked via its `Next` pointer until TargetPointer.Null is reached. For each node, the `NumObjRefs` slots starting at `ObjRefs` are reported, applying the node's `GCFlags` (`GC_CALL_INTERIOR` / `GC_CALL_PINNED`) as the promotion flags. This mirrors native `GCFrame::GcScanRoots`.
+- **Exception tracker (ExInfo) chain**: starting from the thread's exception tracker, each in-flight exception object (the current one and any superseded/nested ones reached via `PreviousNestedInfo`) is reported through its thrown-object slot.
+
+Both sets carry a non-zero, stack-resident `Source` and `StackPointer` set to the GCFrame / ExInfo node address (the node lives on the stack). A `GCFrame` node belongs to a separate chain from the explicit `Frame` chain, and an ExInfo node is likewise not a capital-F `Frame`, so neither is reported with the `Frame` source type. Both use the `Other` source type, which marks a root reported outside the per-frame walk.
+
 ### GCRefMap Format and Resolution
 
 A **GCRefMap** is a compact per-callsite encoding that describes which stack slots in a `TransitionBlock` contain GC references. GCRefMaps are pre-computed by the ReadyToRun compiler and stored in the PE image's import section auxiliary data.

docs/design/datacontracts/Thread.md

@@ -55,6 +55,7 @@ record struct ThreadData (
     TargetPointer ThreadHandle;
     bool IsInteropDebuggingHijacked;
     TargetPointer DebuggerFilterContext;
+    TargetPointer GCFrame;
 );
 ```
 
@@ -123,6 +124,7 @@ The contract additionally depends on these data descriptors
 | `Thread` | `DebuggerControlledThreadState` | Thread state flags controlled by the debugger |
 | `Thread` | `PreemptiveGCDisabled` | Flag indicating if preemptive GC is disabled |
 | `Thread` | `Frame` | Pointer to current frame |
+| `Thread` | `GCFrame` | Pointer to the head of the thread's GCFrame chain. |
 | `Thread` | `CachedStackBase` | Pointer to the base of the stack |
 | `Thread` | `CachedStackLimit` | Pointer to the limit of the stack |
 | `Thread` | `ExposedObject` | Handle to the managed `Thread` object exposed to the debugger |
@@ -237,6 +239,7 @@ ThreadData GetThreadData(TargetPointer address)
         LastThrownObjectHandle : lastThrownObjectHandle,
         FirstNestedException : firstNestedException,
         NextThread: target.ReadPointer(address + /* Thread::LinkNext offset */) - threadLinkOffset;
+        GCFrame: target.ReadPointer(address + /* Thread::GCFrame offset */),
     );
 }
 

src/coreclr/inc/sospriv.idl

@@ -111,6 +111,7 @@ typedef enum SOSStackSourceType
 {
     SOS_StackSourceIP,     // Instruction pointer in managed code
     SOS_StackSourceFrame,  // clr!Frame
+    SOS_StackSourceOther,  // Roots which do not come from managed code or Frames
 } SOSStackSourceType;
 
 typedef enum SOSRefFlags

src/coreclr/pal/prebuilt/inc/sospriv.h

@@ -462,7 +462,8 @@ typedef
 enum SOSStackSourceType
     {
         SOS_StackSourceIP   = 0,
-        SOS_StackSourceFrame    = ( SOS_StackSourceIP + 1 )
+        SOS_StackSourceFrame    = ( SOS_StackSourceIP + 1 ),
+        SOS_StackSourceOther    = ( SOS_StackSourceFrame + 1 )
     }   SOSStackSourceType;
 
 typedef

src/coreclr/vm/cdacstress.cpp

@@ -76,7 +76,7 @@ struct StackRef
     CLRDATA_ADDRESS Object;     // The object pointer value
     unsigned int    Flags;      // SOSRefFlags (interior, pinned)
     CLRDATA_ADDRESS Source;     // IP or Frame that owns this ref
-    int             SourceType; // SOS_StackSourceIP or SOS_StackSourceFrame
+    int             SourceType; // SOS_StackSourceIP, SOS_StackSourceFrame, or SOS_StackSourceOther
     int             Register;   // Processor-encoding reg number, -1 for stack slots
                                 // (cDAC populates from GcInfo; runtime populates
                                 // by inverting GetRegisterSlot on supported arches)
@@ -721,7 +721,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
     collectCtx.refs = outRefs;
     collectCtx.overflow = false;
     collectCtx.currentFrameSource = 0;
-    collectCtx.currentFrameSourceType = 0;
+    collectCtx.currentFrameSourceType = SOS_StackSourceIP;
     collectCtx.currentRegDisplay = nullptr;
 
     GCCONTEXT gcctx = {};
@@ -780,7 +780,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
                 // safepoint (matches DAC SOS_StackSourceIP convention).
                 collectCtx->currentFrameSource =
                     (CLRDATA_ADDRESS)PCODEToPINSTR(GetControlPC(pCF->GetRegisterSet()));
-                collectCtx->currentFrameSourceType = 0; // SOS_StackSourceIP
+                collectCtx->currentFrameSourceType = SOS_StackSourceIP;
                 collectCtx->currentRegDisplay = pCF->GetRegisterSet();
 
                 ICodeManager* pCM = pCF->GetCodeManager();
@@ -801,7 +801,7 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
                 // emit register-resident refs, so leave currentRegDisplay null.
                 Frame* pFrame = pCF->GetFrame();
                 collectCtx->currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pFrame);
-                collectCtx->currentFrameSourceType = 1; // SOS_StackSourceFrame
+                collectCtx->currentFrameSourceType = SOS_StackSourceFrame;
 
                 pFrame->GcScanRoots(gcctx->f, gcctx->sc);
             }
@@ -812,10 +812,36 @@ static HRESULT CollectRuntimeStackRefs(Thread* pThread, PCONTEXT regs, SArray<St
 
     pThread->StackWalkFrames(dacLikeCallback, &diagCtx, flagsStackWalk);
 
-    // NOTE: ScanStackRoots also scans the separate GCFrame linked list
-    // (Thread::GetGCFrame), but the DAC's GetStackReferences / DacStackReferenceWalker
-    // does NOT include those. We intentionally omit GCFrame scanning here so our
-    // runtime-side collection matches what the cDAC is expected to produce.
+    // ScanStackRoots also scans two root sets that are not part of the frame walk: the
+    // GCFrame (GCPROTECT) chain and the in-flight ExInfo chain. GetStackReferences reports
+    // both, so mirror them here to keep the runtime-side collection in parity. See
+    // ScanStackRoots in gcenv.ee.cpp.
+    GCFrame* pGCFrame = pThread->GetGCFrame();
+    while (pGCFrame != nullptr)
+    {
+        // A GCFrame node is a separate chain from the explicit Frame chain, so it is not a
+        // capital-F Frame. Report it with the Other source type and the GCFrame node address as
+        // the Source, matching cDAC (GcScanContext stamps Source = GCFrame node, SourceType = Other).
+        collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pGCFrame);
+        collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+        collectCtx.currentRegDisplay = nullptr;
+        pGCFrame->GcScanRoots(gcctx.f, gcctx.sc);
+        pGCFrame = pGCFrame->PtrNextFrame();
+    }
+
+    PTR_ExInfo pExInfo = pThread->GetExceptionState()->GetCurrentExceptionTracker();
+    while (pExInfo != NULL)
+    {
+        // The ExInfo is not a Frame either; GetStackReferences surfaces the in-flight exception
+        // object with the Other source type and the ExInfo node address as the Source, the same
+        // way it reports a GCFrame root. Mirror that here so the runtime-side collection matches cDAC.
+        collectCtx.currentFrameSource = (CLRDATA_ADDRESS)dac_cast<TADDR>(pExInfo);
+        collectCtx.currentFrameSourceType = SOS_StackSourceOther;
+        collectCtx.currentRegDisplay = nullptr;
+        PTR_PTR_Object pRef = dac_cast<PTR_PTR_Object>(&pExInfo->m_exception);
+        gcctx.f(pRef, gcctx.sc, 0);
+        pExInfo = pExInfo->GetPreviousExceptionTracker();
+    }
 
     return collectCtx.overflow ? S_FALSE : S_OK;
 }
@@ -867,7 +893,7 @@ static void ReportMismatch(const char* message, Thread* pThread, PCONTEXT regs)
 struct FrameRefGroup
 {
     CLRDATA_ADDRESS Source;
-    int SourceType;     // 0 = IP, 1 = Frame
+    int SourceType;     // 0 = IP, 1 = Frame, 2 = Other
     int StartIdx;       // Index into the original ref array
     int Count;          // Number of refs in this group
 };
@@ -1624,7 +1650,15 @@ static void ResolveMethodName(CLRDATA_ADDRESS source, int sourceType, char* buf,
     if (bufLen <= 0)
         return;
 
-    if (sourceType != 0) // SOS_StackSourceFrame
+    if (sourceType == SOS_StackSourceOther)
+    {
+        // A root reported outside the frame walk (GCFrame/GCPROTECT or ExInfo chain). Source is a
+        // node address, not a capital-F Frame, so do not dereference it as a Frame*.
+        snprintf(buf, bufLen, "<other 0x%llx>", (unsigned long long)source);
+        return;
+    }
+
+    if (sourceType == SOS_StackSourceFrame)
     {
         Frame* pFrame = reinterpret_cast<Frame*>(source);
         LPCSTR typeName = Frame::GetFrameTypeName(pFrame->GetFrameIdentifier());

src/coreclr/vm/datadescriptor/datadescriptor.inc

@@ -41,6 +41,7 @@ CDAC_TYPE_FIELD(Thread, T_UINT32, State, cdac_data<Thread>::State)
 CDAC_TYPE_FIELD(Thread, T_UINT32, PreemptiveGCDisabled, cdac_data<Thread>::PreemptiveGCDisabled)
 CDAC_TYPE_FIELD(Thread, T_POINTER, RuntimeThreadLocals, cdac_data<Thread>::RuntimeThreadLocals)
 CDAC_TYPE_FIELD(Thread, T_POINTER, Frame, cdac_data<Thread>::Frame)
+CDAC_TYPE_FIELD(Thread, T_POINTER, GCFrame, cdac_data<Thread>::GCFrame)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackBase, cdac_data<Thread>::CachedStackBase)
 CDAC_TYPE_FIELD(Thread, T_POINTER, CachedStackLimit, cdac_data<Thread>::CachedStackLimit)
 CDAC_TYPE_FIELD(Thread, T_POINTER, ExceptionTracker, cdac_data<Thread>::ExceptionTracker)
@@ -71,6 +72,14 @@ CDAC_TYPE_FIELD(ThreadStore, T_INT32, PendingCount, cdac_data<ThreadStore>::Pend
 CDAC_TYPE_FIELD(ThreadStore, T_INT32, DeadCount, cdac_data<ThreadStore>::DeadCount)
 CDAC_TYPE_END(ThreadStore)
 
+CDAC_TYPE_BEGIN(GCFrame)
+CDAC_TYPE_INDETERMINATE(GCFrame)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, Next, cdac_data<GCFrame>::Next)
+CDAC_TYPE_FIELD(GCFrame, T_POINTER, ObjRefs, cdac_data<GCFrame>::ObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, NumObjRefs, cdac_data<GCFrame>::NumObjRefs)
+CDAC_TYPE_FIELD(GCFrame, T_UINT32, GCFlags, cdac_data<GCFrame>::GCFlags)
+CDAC_TYPE_END(GCFrame)
+
 CDAC_TYPE_BEGIN(RuntimeThreadLocals)
 CDAC_TYPE_INDETERMINATE(RuntimeThreadLocals)
 CDAC_TYPE_FIELD(RuntimeThreadLocals, TYPE(EEAllocContext), AllocContext, offsetof(RuntimeThreadLocals, alloc_context))

src/coreclr/vm/exceptionhandling.cpp

@@ -512,7 +512,7 @@ static void PopExplicitFrames(Thread *pThread, void *targetSp, void *targetCalle
     if (popGCFrames)
     {
         GCFrame* pGCFrame = pThread->GetGCFrame();
-        while ((pGCFrame != GCFRAME_TOP) && pGCFrame->GetOSStackLocation() < targetSp)
+        while ((pGCFrame != nullptr) && pGCFrame->GetOSStackLocation() < targetSp)
         {
             pGCFrame->Pop();
             pGCFrame = pThread->GetGCFrame();

src/coreclr/vm/frames.cpp

@@ -1185,28 +1185,29 @@ GCFrame::~GCFrame()
         NOTHROW;
         GC_NOTRIGGER;
         MODE_ANY;
-        PRECONDITION(m_pCurThread != NULL);
     }
     CONTRACTL_END;
 
-    // m_pNext is NULL when the frame was already popped from the stack.
-    if (m_Next != NULL)
+    // Normally the destructor performs the pop for a GCPROTECT_BEGIN/END scope, so the frame is
+    // still linked when we get here. If it was already popped explicitly - by PopExplicitFrames
+    // during EH unwind, or by the interpreter's GCReporting::Unregister - then m_pCurThread is
+    // NULL and there is nothing left to do.
+    if (m_pCurThread != NULL)
     {
-        // This is a GCFrame that was not popped.  This is a problem.
-        // We should have popped it before we destruct
         // Do a manual switch to the GC cooperative mode instead of using the GCX_COOP_THREAD_EXISTS
         // macro so that this function isn't slowed down by having to deal with FS:0 chain on x86 Windows.
-        BOOL wasCoop = m_pCurThread->PreemptiveGCDisabled();
+        Thread *pThread = m_pCurThread;
+        BOOL wasCoop = pThread->PreemptiveGCDisabled();
         if (!wasCoop)
         {
-            m_pCurThread->DisablePreemptiveGC();
+            pThread->DisablePreemptiveGC();
         }
 
         Pop();
 
         if (!wasCoop)
         {
-            m_pCurThread->EnablePreemptiveGC();
+            pThread->EnablePreemptiveGC();
         }
     }
 }
@@ -1233,7 +1234,7 @@ void GCFrame::Push(Thread* pThread)
     // in which the compiler will lay them out in the stack frame.
     // So minipal_getpagesize() is a guess of the maximum stack frame size of any method
     // with multiple GCFrames in coreclr.dll
-    _ASSERTE(((m_Next == GCFRAME_TOP) ||
+    _ASSERTE(((m_Next == NULL) ||
               (PBYTE(m_Next->GetOSStackLocation()) + (2 * minipal_getpagesize())) > PBYTE(this->GetOSStackLocation())) &&
              "Pushing a GCFrame out of order ?");
 
@@ -1258,13 +1259,15 @@ void GCFrame::Pop()
     _ASSERTE(m_pCurThread->GetGCFrame() == this && "Popping a GCFrame out of order ?");
 
     m_pCurThread->SetGCFrame(m_Next);
-    m_Next = NULL;
 
 #ifdef _DEBUG
     m_pCurThread->EnableStressHeap();
     for(UINT i = 0; i < m_numObjRefs; i++)
         Thread::ObjectRefNew(&m_pObjRefs[i]);       // Unprotect them
 #endif
+
+    // The frame is no longer linked on the thread's GCFrame chain.
+    m_pCurThread = NULL;
 }
 
 void GCFrame::Remove()
@@ -1280,7 +1283,7 @@ void GCFrame::Remove()
 
     GCFrame *pPrevFrame = NULL;
     GCFrame *pFrame = m_pCurThread->GetGCFrame();
-    while (pFrame != GCFRAME_TOP)
+    while (pFrame != NULL)
     {
         if (pFrame == this)
         {
@@ -1293,8 +1296,6 @@ void GCFrame::Remove()
                 m_pCurThread->SetGCFrame(m_Next);
             }
 
-            m_Next = NULL;
-
 #ifdef _DEBUG
             m_pCurThread->EnableStressHeap();
             for(UINT i = 0; i < m_numObjRefs; i++)
@@ -1308,6 +1309,9 @@ void GCFrame::Remove()
     }
 
     _ASSERTE_MSG(pFrame != NULL, "GCFrame not found in the current thread's stack");
+
+    // The frame is no longer linked on the thread's GCFrame chain.
+    m_pCurThread = NULL;
 }
 
 #endif // !DACCESS_COMPILE
@@ -1393,7 +1397,7 @@ BOOL IsProtectedByGCFrame(OBJECTREF *ppObjectRef)
     GetThread()->StackWalkFrames(IsProtectedByGCFrameStackWalkFramesCallback, &d);
 
     GCFrame* pGCFrame = GetThread()->GetGCFrame();
-    while (pGCFrame != GCFRAME_TOP)
+    while (pGCFrame != NULL)
     {
         if (pGCFrame->Protects(ppObjectRef)) {
             d.count++;

src/coreclr/vm/frames.h

@@ -184,7 +184,6 @@ class DacDbiInterfaceImpl;
 // whenever we compare it to a PTR_Frame value (the usual use of the value).
 #define FRAME_TOP_VALUE  ~0     // we want to say -1 here, but gcc has trouble with the signed value
 #define FRAME_TOP (PTR_Frame(FRAME_TOP_VALUE))
-#define GCFRAME_TOP (PTR_GCFrame(FRAME_TOP_VALUE))
 
 
 enum class FrameIdentifier : TADDR
@@ -1808,6 +1807,17 @@ class GCFrame
 #ifdef FEATURE_INTERPRETER
     PTR_VOID      m_osStackLocation;
 #endif
+
+    friend struct ::cdac_data<GCFrame>;
+};
+
+template<>
+struct cdac_data<GCFrame>
+{
+    static constexpr size_t Next = offsetof(GCFrame, m_Next);
+    static constexpr size_t ObjRefs = offsetof(GCFrame, m_pObjRefs);
+    static constexpr size_t NumObjRefs = offsetof(GCFrame, m_numObjRefs);
+    static constexpr size_t GCFlags = offsetof(GCFrame, m_gcFlags);
 };
 
 //-----------------------------------------------------------------------------

src/coreclr/vm/gcenv.ee.cpp

@@ -200,7 +200,7 @@ static void ScanStackRoots(Thread * pThread, promote_func* fn, ScanContext* sc)
     }
 
     GCFrame* pGCFrame = pThread->GetGCFrame();
-    while (pGCFrame != GCFRAME_TOP)
+    while (pGCFrame != NULL)
     {
         pGCFrame->GcScanRoots(fn, sc);
         pGCFrame = pGCFrame->PtrNextFrame();

src/coreclr/vm/threads.cpp

@@ -1185,7 +1185,7 @@ Thread::Thread()
     CONTRACTL_END;
 
     m_pFrame                = FRAME_TOP;
-    m_pGCFrame              = GCFRAME_TOP;
+    m_pGCFrame              = NULL;
 
     m_fPreemptiveGCDisabled = 0;
 
@@ -6752,7 +6752,7 @@ PTR_GCFrame Thread::GetGCFrame()
     {
         void* curSP;
         curSP = (void *)GetCurrentSP();
-        _ASSERTE((m_pGCFrame == (GCFrame*)-1) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
+        _ASSERTE((m_pGCFrame == NULL) || (curSP <= m_pGCFrame->GetOSStackLocation() && m_pGCFrame->GetOSStackLocation() < m_CacheStackBase));
     }
 #endif
 

src/coreclr/vm/threads.h

@@ -3769,6 +3769,7 @@ struct cdac_data<Thread>
     static constexpr size_t PreemptiveGCDisabled = offsetof(Thread, m_fPreemptiveGCDisabled);
     static constexpr size_t RuntimeThreadLocals = offsetof(Thread, m_pRuntimeThreadLocals);
     static constexpr size_t Frame = offsetof(Thread, m_pFrame);
+    static constexpr size_t GCFrame = offsetof(Thread, m_pGCFrame);
     static constexpr size_t CachedStackBase = offsetof(Thread, m_CacheStackBase);
     static constexpr size_t CachedStackLimit = offsetof(Thread, m_CacheStackLimit);
     static constexpr size_t ExposedObject = offsetof(Thread, m_ExposedObject);