[browser][Mono] Open-instance delegate to an interface method crashes in mono_class_interface_offset_with_variance

[lewing]

Description

On browser-wasm Mono (AOT), invoking an open-instance delegate bound to an interface method crashes the runtime with memory access out of bounds in mono_class_interface_offset_with_variance.

Reproduction

interface IOpenVirtual { int M(); }
class C : IOpenVirtual { public int M() => 1; }
struct S : IOpenVirtual { public int M() => 2; }

Func<IOpenVirtual, int> f = typeof(IOpenVirtual).GetMethod(nameof(IOpenVirtual.M)).CreateDelegate<Func<IOpenVirtual, int>>();
f(new C());
f(new S());

This was found by System.Tests.DelegateTests.OpenVirtualDelegates_InvokeResolvesOverride, added in #134699, in the browser-wasm linux Release LibraryTests_Smoke_AOT lane (Helix job 7c43f003-5980-4c1a-a512-25338d48e89c, work item WasmTestOnChrome-MONO-ST-System.Runtime.Tests).

Actual behavior

MONO_WASM: memory access out of bounds
RuntimeError: memory access out of bounds
    at mono_class_interface_offset_with_variance
    at mono_class_get_virtual_method
    at mono_interp_exec_method
    at interp_entry
    ...
    at aot_instances_aot_wrapper_gsharedvt_in_sig_i4_this_obj
    at System_Runtime_Tests_System_Tests_DelegateTests_OpenVirtualDelegates_InvokeResolvesOverride

Expected behavior

The delegate dispatches to the receiver's implementation (C.M returns 1, S.M returns 2), as it does on CoreCLR.

Other information

It is not yet known whether the class receiver, the boxed-struct receiver, or both trigger the crash. The interface cases are disabled on browser Mono AOT via ActiveIssue in #134699; the non-AOT Mono browser lane passed.

Note

This issue was generated with GitHub Copilot.

[dotnet-policy-service]

Tagging subscribers to 'arch-wasm': @lewing, @pavelsavara
See info in area-owners.md if you want to be subscribed.