Test Failure: System.Net.Http.WinHttpHandler.Functional.Tests

[JulieLeeMSFT]

Summary:
System.Net.Http.WinHttpHandler.Functional.Tests crashes with a fatal AccessViolationException (0xC0000005) under jitosr_stress_random on windows-x64. This is a new failure not previously tracked.

Failed in:

• runtime-coreclr libraries-pgo 20260301.1

Failed tests:

- net11.0-windows-Release-x64-jitosr_stress_random-Windows.10.Amd64.Open
  - System.Net.Http.WinHttpHandler.Functional.Tests

Error Message:

Fatal error.
System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.

Stack Trace:

   at System.Net.Http.Functional.Tests.HttpClientHandler_Proxy_Test.ProxyTunnelRequest_MaxConnectionsSetButDoesNotApplyToProxyConnect_Success()
   at System.RuntimeMethodHandle.InvokeMethod(System.Runtime.CompilerServices.ObjectHandleOnStack, Void**, System.Runtime.CompilerServices.ObjectHandleOnStack, BOOL, System.Runtime.CompilerServices.ObjectHandleOnStack)

Analysis:
This is a new failure where System.Net.Http.WinHttpHandler.Functional.Tests crashes with a fatal AccessViolationException (0xC0000005) on windows-x64 under jitosr_stress_random. The AV occurs during WinHttpHandler functional tests, which involve native interop with the Windows WinHTTP library. Under JIT OSR stress with random configuration, miscompiled code at OSR entry points could produce invalid pointers when calling into native WinHTTP APIs, leading to access violations. This is a critical failure as it indicates potential memory safety issues in JIT-compiled code under stress. Investigation should focus on obtaining a crash dump to identify the exact OSR transition point causing the AV.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[JulieLeeMSFT]

@AndyAyersMS, PTAL.

[AndyAyersMS]

Seems to crash consistently on the same test; method at the top of the stack is OSR, so the likely suspect:

23139: JIT compiled System.Net.Http.Functional.Tests.HttpClientHandler_Proxy_Test:ProxyTunnelRequest_MaxConnectionsSetButDoesNotApplyToProxyConnect_Success():this [Tier1-OSR @0x7, IL size=251, code size=130, hash=0xca725d54]

looks like things pass with that one hash excluded from OSR:

set DOTNET_JitEnablePatchpointRange=0-ca725d53,ca725d55-ffffffff

So the likely suspect is very likely indeed.

[AndyAyersMS]

The failing method is async, so perhaps I'll defer to @jakobbotsch here.

****** START compiling System.Net.Http.Functional.Tests.HttpClientHandler_Proxy_Test:ProxyTunnelRequest_MaxConnectionsSetButDoesNotApplyToProxyConnect_Success():this (MethodHash=ca725d54)
Generating code for Windows x64
OPTIONS: Tier-1 compilation
OPTIONS: OSR variant with entry point 0x7
OPTIONS: compCodeOpt = FAST_CODE
OPTIONS: compDbgCode = false
OPTIONS: compDbgInfo = true
OPTIONS: compDbgEnC  = false
OPTIONS: compProcedureSplitting   = false
OPTIONS: compProcedureSplittingEH = false
OPTIONS: optimizer should use profile data
OPTIONS: compilation is an async state machine
...

Note OSR stress will put patchpoints in "unusual" places that are not loop headers.

I reproed just with the runfo bits. Jit dump attached

jit.ca725d54.zip