egonelbre · April 21, 2026 11:48
diff --git a/.gitignore b/.gitignore
 bin/
 obj/
 libgolib.so
 libgolib.h
diff --git a/README.md b/README.md
diff --git a/go.mod b/go.mod
 module repro-sigaltstack

 go 1.25
diff --git a/golib.go b/golib.go
 package main

 import "C"

 // ping is a trivial cgo entry point. Each call from a non-Go thread
 // triggers needm (acquire M + install sigaltstack) on entry and dropm
 // (disable sigaltstack + release M) on return. Rapid calls from many
 // pthreads create the sigaltstack lifecycle churn needed to hit the race.
 //
 //export ping
 func ping() C.int { return 42 }

 func main() {}
diff --git a/Program.cs b/Program.cs
 // Minimal .NET host that mirrors the C reproducer in
 // scripts/repro-sigaltstack/ but runs the workers on the CoreCLR
 // threadpool. Keeping a CoreCLR runtime loaded alongside the Go
 // c-shared library is a closer match to the real crash environment
 // (xunit test host with cgo P/Invokes).
 //
 // Two modes:
 //
 //   REPRO_MODE=signal  (default)
 //     A dedicated thread fires kernel signal 34 (= glibc SIGRTMIN =
 //     CoreCLR PAL's INJECT_ACTIVATION_SIGNAL) at every other thread
 //     every REPRO_INTERVAL_US microseconds. strace labels this signal
 //     "SIGRT_2" (kernel-SIGRTMIN-relative: glibc reserves 32/33 for
 //     pthread cancel & setxid, so 34 is glibc's public SIGRTMIN).
 //     This synthesises what CoreCLR's GC / tiered-JIT machinery fires
 //     naturally. Most reliable way to reproduce.
 //
 //   REPRO_MODE=gc
 //     No synthetic signal sender. Each worker allocates a burst of
 //     garbage between Ping() calls, and a dedicated thread forces
 //     GC.Collect() at a high rate. The idea: let CoreCLR's own GC
 //     fire INJECT_ACTIVATION_SIGNAL at the TP Workers while they're
 //     inside cgo, no libc signalling from us. Answers the question
 //     "does it reproduce under realistic GC pressure alone?".
 //     Pair with Server GC in runtimeconfig for max pressure.
 //
 // The original investigation doc attributed the signal to Go's
 // cooperative preemption — that was wrong. Go uses SIGURG (signal 23)
 // for async preemption, not any RT signal.
 //
 // Build + run:
 //   cd scripts/repro-dotnet
 //   CGO_ENABLED=1 go build -buildmode=c-shared -o libgolib.so golib.go
 //   dotnet build -c Release
 //   LD_LIBRARY_PATH=. ./bin/Release/net10.0/repro-dotnet
 //
 // Tunables via env vars:
 //   REPRO_MODE         — "signal" (default) or "gc"
 //   REPRO_WORKERS      — concurrent worker tasks (default: 32)
 //   REPRO_ITERATIONS   — ping calls per worker  (default: 1000000)
 //   REPRO_INTERVAL_US  — signal / GC.Collect interval (default: 50)
 //   REPRO_ALLOC_BYTES  — garbage allocated per ping in gc mode
 //                         (default: 16384)

 using System;
 using System.Diagnostics;
 using System.Linq;
 using System.Runtime;
 using System.Runtime.InteropServices;
 using System.Threading;
 using System.Threading.Tasks;

 internal static class Native
 {
    [DllImport("golib", EntryPoint = "ping")]
    public static extern int Ping();

    [DllImport("libc", EntryPoint = "tgkill")]
    public static extern int Tgkill(int tgid, int tid, int sig);

    [DllImport("libc", EntryPoint = "getpid")]
    public static extern int Getpid();

    [DllImport("libc", EntryPoint = "syscall")]
    public static extern long Syscall(long number);

    [DllImport("sigstack_helper", EntryPoint = "ensure_large_sigaltstack")]
    public static extern void EnsureLargeSigaltstack();
 }

 internal static class Program
 {
    private const int SYS_GETTID = 186;  // x86_64

    // Kernel signal 34 = glibc SIGRTMIN = CoreCLR PAL's
    // INJECT_ACTIVATION_SIGNAL (GC thread suspension, JIT patching,
    // debugger activation). strace labels it SIGRT_2.
    private const int CoreClrActivationSignal = 34;

    private static volatile bool s_running = true;

    public static int Main()
    {
        var mode       = (Environment.GetEnvironmentVariable("REPRO_MODE") ?? "signal").ToLowerInvariant();
        var workers    = GetIntEnv("REPRO_WORKERS",    32);
        var iters      = GetIntEnv("REPRO_ITERATIONS", 1_000_000);
        var intervalUs = GetIntEnv("REPRO_INTERVAL_US", 50);
        var allocBytes = GetIntEnv("REPRO_ALLOC_BYTES", 16 * 1024);

        var useFix = Environment.GetEnvironmentVariable("REPRO_FIX") == "1";

        Console.Error.WriteLine(
            $"[dotnet-repro] mode={mode} workers={workers} iters={iters} "
          + $"interval={intervalUs}µs gc={GCSettings.IsServerGC} "
          + $"fix={useFix} pid={Environment.ProcessId}");

        if (useFix) Native.EnsureLargeSigaltstack(); // main thread
        Native.Ping(); // warm cgo

        Thread? driver = mode switch
        {
            "signal" => StartSignalSender(intervalUs),
            "gc"     => StartGcDriver(intervalUs),
            _ => throw new ArgumentException($"unknown REPRO_MODE={mode}"),
        };

        var tasks = new Task[workers];
        for (int i = 0; i < workers; i++)
        {
            tasks[i] = Task.Run(() =>
            {
                // Install the large sigaltstack BEFORE the first Ping() on
                // this threadpool thread. Go's minitSignalStack will see it
                // on needm and not install its own 32 KB stack.
                if (useFix) Native.EnsureLargeSigaltstack();
                for (int k = 0; k < iters; k++)
                {
                    if (Native.Ping() != 42)
                        throw new Exception("ping returned unexpected value");
                    if (mode == "gc")
                        GenerateGarbage(allocBytes);
                }
            });
        }

        Task.WaitAll(tasks);
        s_running = false;
        driver?.Join();
        Console.Error.WriteLine("[dotnet-repro] PASS");
        return 0;
    }

    // Signal-sender thread: fires the CoreCLR activation signal at
    // every other thread in the process. In a real .NET process this
    // would be CoreCLR's own GC / tiered JIT machinery; we fire it
    // explicitly so the race happens under a light synthetic load.
    private static Thread StartSignalSender(int intervalUs)
    {
        var t = new Thread(() =>
        {
            int myTid = (int)Native.Syscall(SYS_GETTID);
            int pid = Native.Getpid();
            while (s_running)
            {
                try
                {
                    foreach (var proc in Process.GetCurrentProcess().Threads.Cast<ProcessThread>())
                    {
                        if (proc.Id == myTid) continue;
                        Native.Tgkill(pid, proc.Id, CoreClrActivationSignal);
                    }
                }
                catch { /* thread list churns under contention */ }
                Thread.Sleep(TimeSpan.FromMicroseconds(intervalUs));
            }
        }) { IsBackground = true, Name = "activation-sender" };
        t.Start();
        return t;
    }

    // GC driver: forces CoreCLR to do full-blocking GCs at a high rate
    // so its INJECT_ACTIVATION_SIGNAL path fires "naturally" at the TP
    // Workers. No libc-level tgkill from us.
    private static Thread StartGcDriver(int intervalUs)
    {
        var t = new Thread(() =>
        {
            while (s_running)
            {
                // Mode=Forced guarantees a blocking, thread-suspending
                // collection rather than a background/concurrent one —
                // this is the path that needs to park every thread
                // (including ones currently in cgo), which is the
                // INJECT_ACTIVATION_SIGNAL code path we want exercised.
                GC.Collect(2, GCCollectionMode.Forced, blocking: true);
                Thread.Sleep(TimeSpan.FromMicroseconds(intervalUs));
            }
        }) { IsBackground = true, Name = "gc-driver" };
        t.Start();
        return t;
    }

    // Burn `bytes` worth of short-lived allocations to keep GC busy
    // between cgo calls.
    private static void GenerateGarbage(int bytes)
    {
        // A mix of arrays of different element types so the allocator
        // touches multiple heap regions and promotion patterns.
        var a = new byte[bytes];
        var b = new int[bytes / 4];
        var c = new object[bytes / 64];
        for (int i = 0; i < c.Length; i++) c[i] = new string('x', 8);
        GC.KeepAlive(a);
        GC.KeepAlive(b);
        GC.KeepAlive(c);
    }

    private static int GetIntEnv(string name, int def)
    {
        var s = Environment.GetEnvironmentVariable(name);
        return int.TryParse(s, out var v) && v > 0 ? v : def;
    }
 }
diff --git a/repro-dotnet.csproj b/repro-dotnet.csproj
 <Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net10.0</TargetFramework>
    <Nullable>enable</Nullable>
    <LangVersion>latest</LangVersion>
    <RootNamespace>repro_dotnet</RootNamespace>
    <AssemblyName>repro-dotnet</AssemblyName>
    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
    <!-- Server GC so GC suspension uses more threads and fires
         INJECT_ACTIVATION_SIGNAL more aggressively; relevant for
         REPRO_MODE=gc. -->
    <ServerGarbageCollection>true</ServerGarbageCollection>
    <ConcurrentGarbageCollection>false</ConcurrentGarbageCollection>
  </PropertyGroup>
 </Project>
diff --git a/run.sh b/run.sh
 #!/usr/bin/env bash
 # Build and run the .NET + Go cgo sigaltstack-race reproducer.
 #
 # Usage:
 #   ./run.sh                  Build once, run until it crashes (max 10 attempts).
 #   ./run.sh build            Build only.
 #   ./run.sh run              Run once (assumes already built).
 #   ./run.sh gc               Run in GC-pressure mode (no synthetic signals —
 #                             let CoreCLR's own GC fire the activation signal).
 #   ./run.sh gdb              Build, then run under gdb and dump a core at crash.
 #   ./run.sh loop [N]         Run N times in a row (default 10) and report rc.
 #
 # Requirements: Go (1.25+), .NET SDK (10.0+), gcc, gdb (for `gdb` mode).
 set -euo pipefail

 cd "$(dirname "$0")"

 DOTNET_BIN="./bin/Release/net10.0/repro-dotnet"

 build() {
    echo "=== building libgolib.so (Go c-shared) ==="
    CGO_ENABLED=1 go build -buildmode=c-shared -o libgolib.so golib.go
    echo "=== building libsigstack_helper.so (C#-side fix shim) ==="
    cc -O2 -fPIC -shared -o libsigstack_helper.so sigstack_helper.c -lpthread
    echo "=== building .NET host ==="
    DOTNET_CLI_HOME=/tmp DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1 \
        dotnet build -c Release --nologo -v quiet
 }

 run_once() {
    LD_LIBRARY_PATH=. DOTNET_CLI_HOME=/tmp "$DOTNET_BIN" "$@"
 }

 run_loop() {
    local max=${1:-10}
    local attempt rc
    for attempt in $(seq 1 "$max"); do
        echo "--- attempt $attempt ---"
        set +e
        timeout 60 env LD_LIBRARY_PATH=. DOTNET_CLI_HOME=/tmp "$DOTNET_BIN"
        rc=$?
        set -e
        echo "exit=$rc"
        if [[ $rc -eq 139 ]]; then
            echo "=== SIGSEGV on attempt $attempt — reproduced ==="
            return 0
        fi
    done
    echo "=== no crash in $max attempts ==="
    return 1
 }

 run_gdb() {
    mkdir -p ./crash
    gdb -batch -nx \
        -ex 'set pagination off' \
        -ex 'handle all nostop noprint pass' \
        -ex 'handle SIGSEGV stop print' \
        -ex 'run' \
        -ex 'printf "\n===== CRASHED =====\n"' \
        -ex 'thread' \
        -ex 'info registers rip rsp rbp' \
        -ex 'x/4i $rip' \
        -ex 'bt 20' \
        -ex 'gcore ./crash/core' \
        -ex 'info proc mappings' \
        -ex 'thread apply all bt 6' \
        -ex 'quit' \
        --args env LD_LIBRARY_PATH=. DOTNET_CLI_HOME=/tmp "$DOTNET_BIN" \
        2>&1 | tee ./crash/gdb.log
    echo
    echo "core: ./crash/core  (re-analyse with: gdb $DOTNET_BIN ./crash/core)"
 }

 cmd=${1:-default}
 case "$cmd" in
    build)   build ;;
    run)     run_once ;;
    gc)      build; REPRO_MODE=gc run_loop "${2:-10}" ;;
    fix)     build; REPRO_FIX=1 REPRO_MODE="${2:-signal}" run_loop "${3:-10}" ;;
    loop)    run_loop "${2:-10}" ;;
    gdb)     build; run_gdb ;;
    default) build; run_loop 10 ;;
    *)       echo "usage: $0 [build|run|gc [N]|fix [signal|gc] [N]|loop [N]|gdb]" >&2; exit 2 ;;
 esac
diff --git a/sigstack_helper.c b/sigstack_helper.c
 /*
 * Per-thread "large sigaltstack" shim for the .NET + Go cgo sigaltstack
 * crash.
 *
 * The race we're avoiding:
 *   - Go's needm installs its own 32 KB sigaltstack on every non-Go
 *     thread that enters cgo.
 *   - CoreCLR's signal handler (for SIGRTMIN / INJECT_ACTIVATION_SIGNAL)
 *     needs more than 32 KB and/or Go's sigaltstack lifecycle
 *     (dropm -> SS_DISABLE -> memory recycled) races with signal
 *     delivery, producing SIGSEGV.
 *
 * The shim: install a large (default 1 MiB) sigaltstack on every thread
 * BEFORE it first calls into Go. When Go's minitSignalStack later reads
 * the current sigaltstack state, it sees an existing stack and takes
 * the "use existing" branch — it never installs its own 32 KB stack,
 * and never SS_DISABLEs on dropm. This closes both halves of the race:
 *
 *   1. Size mismatch — our stack is 1 MiB, way more than CoreCLR needs.
 *   2. Lifecycle race — we never free the memory (held until thread
 *      exit), so the kernel's sigaltstack pointer is always valid.
 *
 * Usage:
 *   cc -O2 -fPIC -shared -o libsigstack_helper.so sigstack_helper.c -lpthread
 *
 *   // In C# — call ONCE per thread, before any cgo P/Invoke on that
 *   // thread. Safe to call from any thread, cheap after the first call
 *   // (one TLS read).
 *   [DllImport("sigstack_helper")]
 *   static extern void ensure_large_sigaltstack();
 */

 #define _GNU_SOURCE
 #include <errno.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mman.h>
 #include <unistd.h>

 #ifndef LARGE_SIGSTACK_SIZE
 #define LARGE_SIGSTACK_SIZE (1 * 1024 * 1024) /* 1 MiB */
 #endif

 /* Per-thread flag — set once the current thread has a shim stack
 * installed. Using __thread avoids pthread_key ceremony; it's also
 * zero-initialised so the first access on a new thread is naturally
 * "not installed". */
 static __thread int large_sigstack_installed;
 static __thread void* large_sigstack_base;

 /*
 * Install a large sigaltstack on the current thread if it doesn't
 * already have one big enough. Idempotent per thread.
 *
 * We intentionally do NOT free the backing memory when the thread
 * exits — the stack is held for the OS thread's lifetime. Under
 * threadpool reuse this means the same memory is used across many
 * logical work items, which is fine and exactly what we want.
 */
 void ensure_large_sigaltstack(void) {
    if (large_sigstack_installed) return;

    stack_t cur;
    if (sigaltstack(NULL, &cur) != 0) {
        /* Very unlikely on Linux; leave the thread as-is. */
        fprintf(stderr, "ensure_large_sigaltstack: sigaltstack(query) failed: %s\n",
                strerror(errno));
        return;
    }

    /* If the thread already has a sufficiently large alt stack (e.g.
     * someone else installed one), leave it. This lets CoreCLR's own
     * alt stack (if it already put one on the thread) stay in place
     * too. */
    if ((cur.ss_flags & SS_DISABLE) == 0 && cur.ss_size >= LARGE_SIGSTACK_SIZE) {
        large_sigstack_installed = 1;
        return;
    }

    /* Allocate: 1 page guard + LARGE_SIGSTACK_SIZE usable.
     * mmap with PROT_NONE below the stack turns overflow into a
     * clean SEGV_ACCERR at a known boundary. */
    long pagesize = sysconf(_SC_PAGESIZE);
    size_t total = (size_t)pagesize + LARGE_SIGSTACK_SIZE;
    void* base = mmap(NULL, total, PROT_READ | PROT_WRITE,
                      MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
    if (base == MAP_FAILED) {
        fprintf(stderr, "ensure_large_sigaltstack: mmap failed: %s\n",
                strerror(errno));
        return;
    }
    /* Lower 1 page = guard. */
    if (mprotect(base, (size_t)pagesize, PROT_NONE) != 0) {
        fprintf(stderr, "ensure_large_sigaltstack: mprotect(guard) failed: %s\n",
                strerror(errno));
        /* Not fatal — keep going with the non-guarded stack. */
    }

    stack_t ss = {
        .ss_sp    = (char*)base + pagesize,
        .ss_flags = 0,
        .ss_size  = LARGE_SIGSTACK_SIZE,
    };
    if (sigaltstack(&ss, NULL) != 0) {
        fprintf(stderr, "ensure_large_sigaltstack: sigaltstack(install) failed: %s\n",
                strerror(errno));
        munmap(base, total);
        return;
    }

    large_sigstack_base = base;
    large_sigstack_installed = 1;
 }
Tool	Tested version	Required for
Go	1.25.3, 1.26.2	`go build -buildmode=c-shared`
.NET SDK	10.0.106	`dotnet build` / run
gcc / glibc dev	any recent	cgo (`CGO_ENABLED=1`) linking
gdb	15.x	only for `./run.sh gdb`
File	Purpose
`golib.go`	Trivial cgo export: `ping() int { return 42 }`.
`go.mod`	Go module declaration for `golib.go`.
`Program.cs`	.NET host — P/Invokes `ping`, fires signal 34 in loop.
`repro-dotnet.csproj`	.NET 10 console app project.
`run.sh`	Build + run helper.
`sigstack_helper.c`	C#-side mitigation shim (`REPRO_FIX=1`).
Var	Default	Effect
`REPRO_MODE`	`signal`	`signal` = synthetic tgkill, `gc` = GC pressure
`REPRO_WORKERS`	32	Parallel .NET worker tasks
`REPRO_ITERATIONS`	1 000 000	`ping()` calls per worker
`REPRO_INTERVAL_US`	50	Signal send / `GC.Collect()` interval
`REPRO_ALLOC_BYTES`	16 384	Garbage allocated per ping in `gc` mode
`REPRO_FIX`	unset	`1` = pre-install 1 MiB sigaltstack per thread
Scenario	Outcome
`signal` mode, plain run	SIGSEGV, 3/3 attempts
`signal` mode under `strace -f -e trace=signal`	PASS, 5/5 attempts
`gc` mode (forced GC.Collect every 50 µs) — Server GC	SIGSEGV, 5/5 attempts
`gc` mode (no GC.Collect — ambient allocation only) — Server GC	SIGSEGV, 3/3 attempts
`gc` mode (no GC.Collect — ambient allocation only) — Workstation GC	SIGSEGV, 3/3 attempts
Label	Kernel #	Who owns it
`SIGRT_0`	32	glibc pthread (`SIGCANCEL`)
`SIGRT_1`	33	glibc (`SIGSETXID`)
`SIGRT_2`	34	glibc's public `SIGRTMIN`
Scenario	No fix	With fix
`signal` mode (tgkill every 50 µs, 32 workers, 500 k iters)	0/20	16/20
`gc` mode, ambient allocation only (32 workers, 64 KB/call)	0/20	0/20
	package main

	import "C"

	// ping is a trivial cgo entry point. Each call from a non-Go thread
	// triggers needm (acquire M + install sigaltstack) on entry and dropm
	// (disable sigaltstack + release M) on return. Rapid calls from many
	// pthreads create the sigaltstack lifecycle churn needed to hit the race.
	//
	//export ping
	func ping() C.int { return 42 }

	func main() {}
	// Minimal .NET host that mirrors the C reproducer in
	// scripts/repro-sigaltstack/ but runs the workers on the CoreCLR
	// threadpool. Keeping a CoreCLR runtime loaded alongside the Go
	// c-shared library is a closer match to the real crash environment
	// (xunit test host with cgo P/Invokes).
	//
	// Two modes:
	//
	// REPRO_MODE=signal (default)
	// A dedicated thread fires kernel signal 34 (= glibc SIGRTMIN =
	// CoreCLR PAL's INJECT_ACTIVATION_SIGNAL) at every other thread
	// every REPRO_INTERVAL_US microseconds. strace labels this signal
	// "SIGRT_2" (kernel-SIGRTMIN-relative: glibc reserves 32/33 for
	// pthread cancel & setxid, so 34 is glibc's public SIGRTMIN).
	// This synthesises what CoreCLR's GC / tiered-JIT machinery fires
	// naturally. Most reliable way to reproduce.
	//
	// REPRO_MODE=gc
	// No synthetic signal sender. Each worker allocates a burst of
	// garbage between Ping() calls, and a dedicated thread forces
	// GC.Collect() at a high rate. The idea: let CoreCLR's own GC
	// fire INJECT_ACTIVATION_SIGNAL at the TP Workers while they're
	// inside cgo, no libc signalling from us. Answers the question
	// "does it reproduce under realistic GC pressure alone?".
	// Pair with Server GC in runtimeconfig for max pressure.
	//
	// The original investigation doc attributed the signal to Go's
	// cooperative preemption — that was wrong. Go uses SIGURG (signal 23)
	// for async preemption, not any RT signal.
	//
	// Build + run:
	// cd scripts/repro-dotnet
	// CGO_ENABLED=1 go build -buildmode=c-shared -o libgolib.so golib.go
	// dotnet build -c Release
	// LD_LIBRARY_PATH=. ./bin/Release/net10.0/repro-dotnet
	//
	// Tunables via env vars:
	// REPRO_MODE — "signal" (default) or "gc"
	// REPRO_WORKERS — concurrent worker tasks (default: 32)
	// REPRO_ITERATIONS — ping calls per worker (default: 1000000)
	// REPRO_INTERVAL_US — signal / GC.Collect interval (default: 50)
	// REPRO_ALLOC_BYTES — garbage allocated per ping in gc mode
	// (default: 16384)

	using System;
	using System.Diagnostics;
	using System.Linq;
	using System.Runtime;
	using System.Runtime.InteropServices;
	using System.Threading;
	using System.Threading.Tasks;

	internal static class Native
	{
	[DllImport("golib", EntryPoint = "ping")]
	public static extern int Ping();

	[DllImport("libc", EntryPoint = "tgkill")]
	public static extern int Tgkill(int tgid, int tid, int sig);

	[DllImport("libc", EntryPoint = "getpid")]
	public static extern int Getpid();

	[DllImport("libc", EntryPoint = "syscall")]
	public static extern long Syscall(long number);

	[DllImport("sigstack_helper", EntryPoint = "ensure_large_sigaltstack")]
	public static extern void EnsureLargeSigaltstack();
	}

	internal static class Program
	{
	private const int SYS_GETTID = 186; // x86_64

	// Kernel signal 34 = glibc SIGRTMIN = CoreCLR PAL's
	// INJECT_ACTIVATION_SIGNAL (GC thread suspension, JIT patching,
	// debugger activation). strace labels it SIGRT_2.
	private const int CoreClrActivationSignal = 34;

	private static volatile bool s_running = true;

	public static int Main()
	{
	var mode = (Environment.GetEnvironmentVariable("REPRO_MODE") ?? "signal").ToLowerInvariant();
	var workers = GetIntEnv("REPRO_WORKERS", 32);
	var iters = GetIntEnv("REPRO_ITERATIONS", 1_000_000);
	var intervalUs = GetIntEnv("REPRO_INTERVAL_US", 50);
	var allocBytes = GetIntEnv("REPRO_ALLOC_BYTES", 16 * 1024);

	var useFix = Environment.GetEnvironmentVariable("REPRO_FIX") == "1";

	Console.Error.WriteLine(
	$"[dotnet-repro] mode={mode} workers={workers} iters={iters} "
	+ $"interval={intervalUs}µs gc={GCSettings.IsServerGC} "
	+ $"fix={useFix} pid={Environment.ProcessId}");

	if (useFix) Native.EnsureLargeSigaltstack(); // main thread
	Native.Ping(); // warm cgo

	Thread? driver = mode switch
	{
	"signal" => StartSignalSender(intervalUs),
	"gc" => StartGcDriver(intervalUs),
	_ => throw new ArgumentException($"unknown REPRO_MODE={mode}"),
	};

	var tasks = new Task[workers];
	for (int i = 0; i < workers; i++)
	{
	tasks[i] = Task.Run(() =>
	{
	// Install the large sigaltstack BEFORE the first Ping() on
	// this threadpool thread. Go's minitSignalStack will see it
	// on needm and not install its own 32 KB stack.
	if (useFix) Native.EnsureLargeSigaltstack();
	for (int k = 0; k < iters; k++)
	{
	if (Native.Ping() != 42)
	throw new Exception("ping returned unexpected value");
	if (mode == "gc")
	GenerateGarbage(allocBytes);
	}
	});
	}

	Task.WaitAll(tasks);
	s_running = false;
	driver?.Join();
	Console.Error.WriteLine("[dotnet-repro] PASS");
	return 0;
	}

	// Signal-sender thread: fires the CoreCLR activation signal at
	// every other thread in the process. In a real .NET process this
	// would be CoreCLR's own GC / tiered JIT machinery; we fire it
	// explicitly so the race happens under a light synthetic load.
	private static Thread StartSignalSender(int intervalUs)
	{
	var t = new Thread(() =>
	{
	int myTid = (int)Native.Syscall(SYS_GETTID);
	int pid = Native.Getpid();
	while (s_running)
	{
	try
	{
	foreach (var proc in Process.GetCurrentProcess().Threads.Cast<ProcessThread>())
	{
	if (proc.Id == myTid) continue;
	Native.Tgkill(pid, proc.Id, CoreClrActivationSignal);
	}
	}
	catch { /* thread list churns under contention */ }
	Thread.Sleep(TimeSpan.FromMicroseconds(intervalUs));
	}
	}) { IsBackground = true, Name = "activation-sender" };
	t.Start();
	return t;
	}

	// GC driver: forces CoreCLR to do full-blocking GCs at a high rate
	// so its INJECT_ACTIVATION_SIGNAL path fires "naturally" at the TP
	// Workers. No libc-level tgkill from us.
	private static Thread StartGcDriver(int intervalUs)
	{
	var t = new Thread(() =>
	{
	while (s_running)
	{
	// Mode=Forced guarantees a blocking, thread-suspending
	// collection rather than a background/concurrent one —
	// this is the path that needs to park every thread
	// (including ones currently in cgo), which is the
	// INJECT_ACTIVATION_SIGNAL code path we want exercised.
	GC.Collect(2, GCCollectionMode.Forced, blocking: true);
	Thread.Sleep(TimeSpan.FromMicroseconds(intervalUs));
	}
	}) { IsBackground = true, Name = "gc-driver" };
	t.Start();
	return t;
	}

	// Burn `bytes` worth of short-lived allocations to keep GC busy
	// between cgo calls.
	private static void GenerateGarbage(int bytes)
	{
	// A mix of arrays of different element types so the allocator
	// touches multiple heap regions and promotion patterns.
	var a = new byte[bytes];
	var b = new int[bytes / 4];
	var c = new object[bytes / 64];
	for (int i = 0; i < c.Length; i++) c[i] = new string('x', 8);
	GC.KeepAlive(a);
	GC.KeepAlive(b);
	GC.KeepAlive(c);
	}

	private static int GetIntEnv(string name, int def)
	{
	var s = Environment.GetEnvironmentVariable(name);
	return int.TryParse(s, out var v) && v > 0 ? v : def;
	}
	}
	<Project Sdk="Microsoft.NET.Sdk">
	<PropertyGroup>
	<OutputType>Exe</OutputType>
	<TargetFramework>net10.0</TargetFramework>
	<Nullable>enable</Nullable>
	<LangVersion>latest</LangVersion>
	<RootNamespace>repro_dotnet</RootNamespace>
	<AssemblyName>repro-dotnet</AssemblyName>
	<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
	<!-- Server GC so GC suspension uses more threads and fires
	INJECT_ACTIVATION_SIGNAL more aggressively; relevant for
	REPRO_MODE=gc. -->
	<ServerGarbageCollection>true</ServerGarbageCollection>
	<ConcurrentGarbageCollection>false</ConcurrentGarbageCollection>
	</PropertyGroup>
	</Project>
	#!/usr/bin/env bash
	# Build and run the .NET + Go cgo sigaltstack-race reproducer.
	#
	# Usage:
	# ./run.sh Build once, run until it crashes (max 10 attempts).
	# ./run.sh build Build only.
	# ./run.sh run Run once (assumes already built).
	# ./run.sh gc Run in GC-pressure mode (no synthetic signals —
	# let CoreCLR's own GC fire the activation signal).
	# ./run.sh gdb Build, then run under gdb and dump a core at crash.
	# ./run.sh loop [N] Run N times in a row (default 10) and report rc.
	#
	# Requirements: Go (1.25+), .NET SDK (10.0+), gcc, gdb (for `gdb` mode).
	set -euo pipefail

	cd "$(dirname "$0")"

	DOTNET_BIN="./bin/Release/net10.0/repro-dotnet"

	build() {
	echo "=== building libgolib.so (Go c-shared) ==="
	CGO_ENABLED=1 go build -buildmode=c-shared -o libgolib.so golib.go
	echo "=== building libsigstack_helper.so (C#-side fix shim) ==="
	cc -O2 -fPIC -shared -o libsigstack_helper.so sigstack_helper.c -lpthread
	echo "=== building .NET host ==="
	DOTNET_CLI_HOME=/tmp DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1 \
	dotnet build -c Release --nologo -v quiet
	}

	run_once() {
	LD_LIBRARY_PATH=. DOTNET_CLI_HOME=/tmp "$DOTNET_BIN" "$@"
	}

	run_loop() {
	local max=${1:-10}
	local attempt rc
	for attempt in $(seq 1 "$max"); do
	echo "--- attempt $attempt ---"
	set +e
	timeout 60 env LD_LIBRARY_PATH=. DOTNET_CLI_HOME=/tmp "$DOTNET_BIN"
	rc=$?
	set -e
	echo "exit=$rc"
	if [[ $rc -eq 139 ]]; then
	echo "=== SIGSEGV on attempt $attempt — reproduced ==="
	return 0
	fi
	done
	echo "=== no crash in $max attempts ==="
	return 1
	}

	run_gdb() {
	mkdir -p ./crash
	gdb -batch -nx \
	-ex 'set pagination off' \
	-ex 'handle all nostop noprint pass' \
	-ex 'handle SIGSEGV stop print' \
	-ex 'run' \
	-ex 'printf "\n===== CRASHED =====\n"' \
	-ex 'thread' \
	-ex 'info registers rip rsp rbp' \
	-ex 'x/4i $rip' \
	-ex 'bt 20' \
	-ex 'gcore ./crash/core' \
	-ex 'info proc mappings' \
	-ex 'thread apply all bt 6' \
	-ex 'quit' \
	--args env LD_LIBRARY_PATH=. DOTNET_CLI_HOME=/tmp "$DOTNET_BIN" \
	2>&1 \| tee ./crash/gdb.log
	echo
	echo "core: ./crash/core (re-analyse with: gdb $DOTNET_BIN ./crash/core)"
	}

	cmd=${1:-default}
	case "$cmd" in
	build) build ;;
	run) run_once ;;
	gc) build; REPRO_MODE=gc run_loop "${2:-10}" ;;
	fix) build; REPRO_FIX=1 REPRO_MODE="${2:-signal}" run_loop "${3:-10}" ;;
	loop) run_loop "${2:-10}" ;;
	gdb) build; run_gdb ;;
	default) build; run_loop 10 ;;
	*) echo "usage: $0 [build\|run\|gc [N]\|fix [signal\|gc] [N]\|loop [N]\|gdb]" >&2; exit 2 ;;
	esac