[CoreCLR] android-arm MAUI R2R app crashes during startup in PEDecoder::CheckCorHeader

[simonrozsival]

Summary

A .NET MAUI Android app built for CoreCLR + android-arm (32-bit) + ReadyToRun crashes during process startup on a Helix windows.11.amd64.android-armel.open device.

The app installs successfully and the launch intent is accepted, but the process exits immediately during coreclr_initialize. The native crash is a SIGBUS / BUS_ADRALN in libcoreclr.so while CoreCLR is checking/opening a ReadyToRun PE image.

Where observed

• PR: [ci] Add MAUI full R2R android-arm Helix test #12020
• Azure DevOps build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1500359
• Helix job: https://helix.dot.net/api/jobs/ec2a7c12-8e1f-4384-9c51-4c66c6528f1c/details?api-version=2019-06-17
• Helix work item: WorkItem on windows.11.amd64.android-armel.open
• Device from console: Pixel_6a (bluejay), ABI arm
• Failing app/package: com.xamarin.mauir2r.arm.baseline
• Logcat artifact: https://helix.dot.net/api/2019-06-17/jobs/ec2a7c12-8e1f-4384-9c51-4c66c6528f1c/workitems/WorkItem/files/logcat-android-arm-default.log
• Console artifact: https://helix.dot.net/api/2019-06-17/jobs/ec2a7c12-8e1f-4384-9c51-4c66c6528f1c/workitems/WorkItem/console

Test scenario

The failing matrix leg is:

• MAUI template app
• UseMonoRuntime=false
• RuntimeIdentifier=android-arm
• Release build
• default MAUI R2R settings
• APK run on windows.11.amd64.android-armel.open

The adjacent android-arm64 R2R Helix legs completed successfully in the same CI run. The android-arm APK also installed successfully before crashing.

Console excerpt

adb install -r "...\MauiR2R-android-arm-default-Signed.apk"
Performing Streamed Install
Success

adb shell monkey -p com.xamarin.mauir2r.arm.baseline -c android.intent.category.LAUNCHER 1
Events injected: 1

adb shell pidof com.xamarin.mauir2r.arm.baseline
# no output; script captures logcat and exits 1

Crash excerpt

E DOTNET  : Fatal error.
E DOTNET  : Got a SIGBUS while executing native code. This usually indicates
E DOTNET  : a fatal error in the runtime or one of the native libraries
E DOTNET  : used by your application.

F libc    : Fatal signal 7 (SIGBUS), code 1 (BUS_ADRALN), fault addr 0xe8c85be5 in tid 27396 (2r.arm.baseline), pid 27396 (2r.arm.baseline)
F DEBUG   : ABI: 'arm'
F DEBUG   : Cmdline: com.xamarin.mauir2r.arm.baseline
F DEBUG   : signal 7 (SIGBUS), code 1 (BUS_ADRALN), fault addr 0xe8c85be5 (read)

Symbolication

The crashing libcoreclr.so BuildId is:

57a51eea2c809d8247f652d21377a5e4cbae48b9

Symbols were retrieved with dotnet-symbol for:

Microsoft.NETCore.App.Runtime.android-arm/11.0.0-preview.7.26355.102

Symbolicated native stack:

#00 pc 000ce404  PEDecoder::CheckCorHeader() const
    src/coreclr/utilcode/pedecoder.cpp:1161
#01 pc 000cdccb  PEDecoder::CheckFormat() const
    src/coreclr/utilcode/pedecoder.cpp:35
#02 pc 000ce755  PEDecoder::CheckILOnlyFormat() const
    src/coreclr/utilcode/pedecoder.cpp:111
#03 pc 00291dc1  PEImageLayout::CheckILOnlyFormat() const
    src/coreclr/vm/peimagelayout.inl:230
#04 pc 001c2879  PEImage::CreateLoadedLayout(bool)
    src/coreclr/vm/peimage.cpp:674
#05 pc 001c23b3  PEImage::GetOrCreateLayout(unsigned int)
    src/coreclr/vm/peimage.cpp:586
#06 pc 001bf03b  OpenR2RFromPE(SString const&, char const*, READYTORUN_HEADER**)
    src/coreclr/vm/nativeimage.cpp:142
#07 pc 0016201d  AssemblyBinder::LoadNativeImage(Module*, char const*, bool)
    src/coreclr/vm/assemblybinder.cpp:38
#08 pc 001f1279  ReadyToRunInfo::Initialize(Module*, AllocMemTracker*)
    src/coreclr/vm/readytoruninfo.cpp:660
#09 pc 00166f87  Module::Initialize(AllocMemTracker*, char16_t const*)
    src/coreclr/vm/ceeload.cpp:464
#10 pc 00166553  Module::DoInit(AllocMemTracker*, char16_t const*)
    src/coreclr/vm/ceeload.cpp:162
#11 pc 001674e1  Module::Create(Assembly*, PEAssembly*, AllocMemTracker*)
    src/coreclr/vm/ceeload.cpp:633
#12 pc 0015ea0b  Assembly::Init(AllocMemTracker*)
    src/coreclr/vm/assembly.cpp:184
#13 pc 0015f23d  Assembly::Create(PEAssembly*, AllocMemTracker*, LoaderAllocator*)
    src/coreclr/vm/assembly.cpp:352
#14 pc 0015abe3  AppDomain::TryIncrementalLoad(FileLoadLevel, LifetimeHolder<FileLoadLock::HolderTraits>&)
    src/coreclr/vm/appdomain.cpp:2662
#15 pc 0015a5cb  AppDomain::LoadAssembly(FileLoadLock*, FileLoadLevel)
    src/coreclr/vm/appdomain.cpp:2592
#16 pc 0015a7ad  AppDomain::LoadAssemblyInternal(AssemblySpec*, PEAssembly*, FileLoadLevel)
    src/coreclr/vm/appdomain.cpp:2482
#17 pc 001587f3  AppDomain::LoadAssembly(AssemblySpec*, PEAssembly*, FileLoadLevel)
    src/coreclr/vm/appdomain.cpp:2370
#18 pc 00158689  SystemDomain::Init()
    src/coreclr/vm/appdomain.cpp:887
#19 pc 00290ee7  EEStartupHelper()
    src/coreclr/vm/ceemain.cpp:998
#20 pc 00290905  EEStartup()::$_0::operator()
    src/coreclr/vm/ceemain.cpp:1137
#21 pc 00290883  EnsureEEStarted()
    src/coreclr/vm/ceemain.cpp:307
#22 pc 00177401  CorHost2::Start()
    src/coreclr/vm/corhost.cpp:100
#23 pc 00292d3b  coreclr_initialize
    src/coreclr/dlls/mscoree/exports.cpp:382
#24 pc 000528cd  xamarin::android::Host::Java_mono_android_Runtime_initInternal(...)
    libmonodroid.so
#25 pc 00062187  Java_mono_android_Runtime_initInternal
    libmonodroid.so

Notes

This looks like an arm32 alignment-sensitive crash while CoreCLR checks an R2R PE image (PEDecoder::CheckCorHeader). The fault address is unaligned (0xe8c85be5), and the signal code is BUS_ADRALN.

The CI/payload plumbing has already been fixed enough to prove this is not an adb/Helix launch issue: the APK installs, the launch intent runs, and the crash happens in the app process during CoreCLR startup.