Use indirect field access for types spanning multiple inexact compilation units

[jtschuster]

Fixes #128968.

Problem

In crossgen2-composite Large Version Bubble (LVB) R2R test legs (compiled with --verify-type-and-field-layout), the runtime hits a Verify_FieldOffset failfast, e.g.:

Assert failure: Verify_FieldOffset 'UnixConsoleStream._useReadLine' Field offset 8!=-6(actual) || baseOffset 0!=0(actual)
  File: .../src/coreclr/vm/jitinterface.cpp:14549

Root cause

This is a cross-module layout divergence between crossgen2 and the runtime:

• When a reference type's layout chain spans 2+ inexact compilation units (assemblies that version with the current compilation but whose grouping into composite images is not fixed at compile time), crossgen2 conservatively aligns the derived type's fields after the cross-compilation-unit base.
• At runtime, those framework modules can instead bind into a single composite image, where the runtime back-fills the derived type's fields into the base type's trailing alignment padding.

The two layouts disagree, so a baked relative offset (ENCODE_FIELD_BASE_OFFSET) or absolute offset with a relative field-offset verification is invalid for one of them — producing the failfast (and, with verification off, an incorrect memory access).

This reproduces for types like UnixConsoleStream._useReadLine (System.Console + corelib) and XmlJsonReader._complexTextMode (System.Private.DataContractSerialization + System.Private.Xml + corelib).

Fix

In EncodeFieldBaseOffset, when TypeLayoutCompilationUnits(pMT).HasMultipleInexactCompilationUnits is true, route field access to an indirect, runtime-resolved field offset (ENCODE_FIELD_OFFSET via SymbolNodeFactory.FieldOffset). This is correct regardless of how the modules are ultimately grouped and emits no layout-verification fixup. The new branch is placed before the IsInheritanceChainLayoutFixedInCurrentVersionBubble branch, which would otherwise bake a wrong offset for these types.

Validation

Validated end-to-end against a composite framework image (framework-r2r.dll) plus a separately-compiled test composite, the exact configuration that triggered the failure:

• binarytrees-6 (writes to Console -> UnixConsoleStream): passed, no assert.
• JsonBenchmarks Serialize/Deserialize (DataContractJsonSerializer -> XmlJsonReader): passed, no assert.
• strace confirmed both framework-r2r.dll and the patched test composite-r2r.dll are loaded in-process during the run (not a JIT fallback).

Note

This pull request was authored with the assistance of GitHub Copilot.

[Copilot]

Pull request overview

This PR updates crossgen2 ReadyToRun field-access encoding to avoid baking field offsets for reference types whose layout can differ at runtime when their layout “spans” multiple inexact compilation units, which can otherwise trigger Verify_FieldOffset failfasts (and potentially incorrect field accesses when verification is off).

Changes:

• In EncodeFieldBaseOffset, detect HasMultipleInexactCompilationUnits for the owning type and switch to an indirect, runtime-resolved field offset encoding (ENCODE_FIELD_OFFSET via SymbolNodeFactory.FieldOffset).
• Ensure this indirection path runs before the existing IsInheritanceChainLayoutFixedInCurrentVersionBubble(...) decision so a potentially unstable baked offset isn’t used.

[jtschuster]

/azp run runtime-coreclr crossgen2-composite

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).