dotnet / dotnet/runtime

RegMeta::ApplyEditAndContinue mutates state without obtaining locks

Open
#131,895 2 comments 0 reactions 0 assignees View on GitHub
area-Diagnostics-coreclr
Dominant language
C#
Stars
18.3k
Forks
5.6k
PR merge metrics
PR metrics pending

Description

`RegMeta::` mutates its `CMiniMdRW` through `ApplyDelta` without acquiring the `RegMeta` read/write semaphore.

Other exported metadata APIs acquire that semaphore when `MetaDataThreadSafetyOptions` is enabled. A concurrent reader or writer can therefore access metadata while `ApplyDelta` changes tables, heaps, and lookup caches.

## Reachability

The path is exposed through the native metadata dispenser:

1. Obtain `IMetaDataDispenserEx`.
2. Enable `MetaDataThreadSafetyOptions`.
3. Open a writable scope and request `IMetaDataEmit`.
4. Call `IMetaDataEmit::ApplyEditAndContinue`.
5. Concurrently call another metadata API on the same scope.

This is not the `MetadataUpdater.ApplyUpdate` path used in HR scenarios, which uses the separately locked `MDInternalRW::ApplyEditAndContinue`.

Contributor guide

Open the contributing guide

Research direction

Begin at IMetaDataEmit::ApplyEditAndContinue and trace RegMeta::ApplyEditAndContinue through CMiniMdRW::ApplyDelta, comparing the locking behavior of other exported metadata APIs and MDInternalRW::ApplyEditAndContinue. Reproduce the concurrent reader/writer scenario with thread safety enabled; done when ApplyEditAndContinue is protected by the same semaphore and concurrent access is safe.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.