UnsafeAccessor on ReadOnlyMemory causes fatal ExecutionEngineException

[cyndicact]

Description

Using UnsafeAccessorAttribute on ReadOnlyMemory<T>.GetObjectStartLength causes a fatal ExecutionEngineException to be thrown if T is a reference type.

Reproduction Steps

Minimal example:

string[] arr1 = ["hello", " ", "world", "!"];
ReadOnlyMemory<string> rom1 = arr1;
var obj1 = Accessor<string>.GetObjectStartLength(ref rom1, out var start, out var length); // throws

public static class Accessor<T> {
    [UnsafeAccessor(UnsafeAccessorKind.Method, Name = "GetObjectStartLength")]
    public static extern object? GetObjectStartLength(ref ReadOnlyMemory<T> rom, out int start, out int length);
}

Some more examples which produce this exception:

Details

Version[] arr3 = [null, null];
ReadOnlyMemory<Version> rom3 = arr3;
var obj3 = Accessor<Version>.GetObjectStartLength(ref rom3, out start, out length);

Version[] arr4 = [];
ReadOnlyMemory<Version> rom4 = arr4;
var obj4 = Accessor<Version>.GetObjectStartLength(ref rom4, out start, out length);

var obj5 = Accessor<Version>.ReadonlyGetObjectStartLength(in rom4, out start, out length);

public static class Accessor<T> {
    [UnsafeAccessor(UnsafeAccessorKind.Method, Name = "GetObjectStartLength")]
    public static extern object? GetObjectStartLength(ref ReadOnlyMemory<T> rom, out int start, out int length);
    [UnsafeAccessor(UnsafeAccessorKind.Method, Name = "GetObjectStartLength")]
    public static extern object? ReadonlyGetObjectStartLength(ref readonly ReadOnlyMemory<T> rom, out int start, out int length);
}

Expected behavior

The method should return the values of the fields of ReadOnlyMemory.

Actual behavior

Debugger reports System.ExecutionEngineException: Exception of type 'System.ExecutionEngineException' was thrown.

Stack printed to console:

Fatal error.
Internal CLR error. (0x80131506)
   at System.Runtime.CompilerServices.GenericsHelpers.Class(IntPtr, IntPtr)
   at Accessor`1[[System.__Canon, System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].GetObjectStartLength(System.ReadOnlyMemory`1<System.__Canon> ByRef, Int32 ByRef, Int32 ByRef)
   at Program.<Main>$(System.String[])

There are also 2 errors in the Windows event log:

Application: Repro1ReadOnlyMemory.exe CoreCLR Version: 10.0.826.23019 .NET Version: 10.0.8 Description: The process was terminated due to an internal error in the .NET Runtime at IP 0x00007FFCDB10579E (0x00007FFCDB0B0000) with exit code 0x80131506.

Regression?

No response

Known Workarounds

This issue does hasn't yet occurred with value type T (e.g., ReadOnlyMemory<char>, ReadOnlyMemory<ReadOnlyMemory<char>>).

Configuration

No response

Other information

I've used UnsafeAccessor many times but haven't seen this issue in any other circumstances.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-memory
See info in area-owners.md if you want to be subscribed.