crossgen2 crashes with SIGTRAP (exit 133) during composite R2R for iossimulator/tvos arm64

[steveisok]

Description

crossgen2 crashes with exit code 133 (SIGTRAP) during composite R2R compilation targeting iossimulator/arm64 and tvos/arm64 with Mach-O output. The crash is a native signal (no managed exception stack trace), preventing tests from building and running on Helix.

Affected Legs

• iossimulator-arm64 Debug AllSubsets_CoreCLR_Smoke — DI.ExternalContainers.Tests (exit 4), ComponentModel.Primitives.Tests (exit 4)
• tvos-arm64 Debug AllSubsets_CoreCLR_Smoke — ComponentModel.Primitives.Tests (exit 21)

crossgen2 Command

crossgen2 --targetos:iossimulator --targetarch:arm64 -O --obj-format:macho --composite \
  --out:".../Microsoft.Extensions.DependencyInjection.ExternalContainers.Tests.r2r.o" \
  [170+ DLLs - composite R2R of full framework + test assemblies]

Error

Microsoft.NET.CrossGen.targets(489,5): error MSB6006: "crossgen2" exited with code 133.
clang: error: no such file or directory: .../Tests.r2r.o
Microsoft.NET.CrossGen.targets(667,5): error MSB3073: clang exited with code 1.

Exit code 133 = 128 + 5 = SIGTRAP (native assertion/debugger trap). No managed stack trace captured.

Build Reference

Build 1369438 — runtime-extra-platforms rolling, main branch, 2026-04-08.

Helix job: 9602d89d-288a-460e-94c5-c04a6bd29c2b (iossimulator-arm64 Debug)
Helix job: 5e34fca3-b431-47e4-9e44-3651acda8be0 (tvos-arm64 Debug)

AOTBuild.binlog available from work items.

Related

• [clr-ios] Crossgen2 fails to compile async2 RESUME methods on Apple mobile #125726 — crossgen2 fails to compile async2 RESUME methods on Apple mobile (managed exception, different manifestation)
• Crossgen2 Mach-O R2R output has LC_SEGMENT_64 filesize > vmsize, rejected by llvm-objdump/otool #124982 — crossgen2 Mach-O R2R output LC_SEGMENT_64 issue (closed)

[dotnet-policy-service]

Tagging subscribers to 'os-ios': @vitek-karas, @kotlarmilos, @steveisok, @akoeplinger
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to 'os-tvos': @vitek-karas, @kotlarmilos, @steveisok, @akoeplinger
See info in area-owners.md if you want to be subscribed.

[agocke]

@steveisok are we sure there's no managed stack trace? I've seen the output sometimes get trimmed out in low MSBuild verbosity modes. Do we have a binlog or other verbose log from MSBuild?

[steveisok]

Update: Root cause identified from binlog analysis

Per @agocke's suggestion, I pulled the AOTBuild.binlog files from the Helix work items. Andy was right — the crossgen2 stderr output was captured in the binlog but not surfaced in the MSBuild console output.

Root cause: JIT assertion failure in morph.cpp:5058

All three failing work items hit the same assertion in the JIT's Morph - Global phase:

/Users/runner/work/1/s/src/coreclr/jit/morph.cpp:5058
Assertion failed '!"Unexpected tree op after call marked as tailcall"'

Leg	Work Item	Triggering Method	IL Size
iossimulator-arm64	DI.ExternalContainers.Tests	DryIoc.Container+<>c__DisplayClass28_0:<DryIoc.IResolver.ResolveMany>b__4(ServiceRegistrationInfo):bool	81
tvos-arm64	ComponentModel.Primitives.Tests	System.ComponentModel.Tests.ComponentTests+SubComponent:get_DesignMode():bool	7

Both hit during FullOpts, composite R2R with --obj-format:macho targeting arm64. The tvos case is notable — a 7-byte property getter triggering the assertion suggests the issue is in how the JIT marks/handles tailcall-eligible patterns on Apple arm64 Mach-O targets, not specific to complex IL.

Note: The iossimulator ComponentModel.Primitives.Tests work item (exit code 4) built successfully — its binlog had zero errors. That exit code is from a downstream XHarness/test execution failure, not crossgen2.

This should be area-CodeGen-coreclr rather than (or in addition to) area-crossgen.

cc @agocke

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.