Implicit byref arguments are never on the GC heap

[EgorBo]

Implicit byref arguments (structs passed by reference under the hood: not 1/2/4/8 bytes on win-x64, larger than 16 bytes on arm64) are now guaranteed to never live on the GC heap, so callees can store into them without write barriers.

struct S16 { public object A; public object B; }

[MethodImpl(MethodImplOptions.NoInlining)]
static void Store(S16 s, object o) { s.A = o; Sink(ref s); }

 ; P:Store(S16,System.Object)   win-x64
-       push     rbx
-       sub      rsp, 32
-       mov      rbx, rcx
-       mov      rcx, rbx
-       call     CORINFO_HELP_CHECKED_ASSIGN_REF
-       mov      rcx, rbx
+       sub      rsp, 40
+       mov      gword ptr [rcx], rdx
        call     [P:Sink(byref)]
        nop
-       add      rsp, 32
-       pop      rbx
+       add      rsp, 40
        ret
-; Total bytes of code 32
+; Total bytes of code 19

Bumps READYTORUN_MAJOR_VERSION to 30: crossgen2 now emits barrier-free stores, so older runtimes must reject these images. MINIMUM_READYTORUN_MAJOR_VERSION stays at 26 - existing images can only forward an incoming implicit byref, never originate heap-backed storage for one.

Fixes #133961

[azure-pipelines]

Azure Pipelines:
Successfully started running 6 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[Copilot]

🟡 Changes recommended

The behavioral code-generation change lacks targeted regression coverage for write-barrier omission and GC reporting.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the implicit-byref ABI contract so argument storage is guaranteed outside the GC heap, allowing the JIT to omit write barriers safely.

Changes:

• Marks implicit-byref stores as non-heap and updates promotion costing.
• Copies debugger func-eval arguments into GC-protected native memory.
• Documents the contract and advances ReadyToRun to version 29.

File summaries

File	Description
src/coreclr/vm/callhelpers.h	Documents caller ownership and GC-reporting requirements.
src/coreclr/vm/callhelpers.cpp	Asserts implicit-byref arguments are not heap-backed.
src/coreclr/tools/Common/Internal/Runtime/ModuleHeaders.cs	Advances managed R2R version.
src/coreclr/nativeaot/Runtime/inc/ModuleHeaders.h	Advances NativeAOT R2R version.
src/coreclr/jit/promotion.cpp	Removes obsolete write-barrier costing.
src/coreclr/jit/morph.cpp	Marks implicit-byref stores as non-heap.
src/coreclr/jit/lclvars.cpp	Documents the new storage invariant.
src/coreclr/inc/readytorun.h	Advances and documents R2R version 29.
src/coreclr/debug/ee/funceval.cpp	Creates protected native copies for func-eval arguments.
docs/design/coreclr/botr/clr-abi.md	Documents the revised ABI contract.

Review details

• Files reviewed: 10/10 changed files
• Comments generated: 1
• Review effort level: Balanced

[EgorBo]

Diffs aren't too motivating. Perhaps, a bit more can be improved with proper alias analysis (implicit byref never aliases with gc heap), but closing for now.

[azure-pipelines]

Azure Pipelines:
Successfully started running 6 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot review overview

🟡 Changes recommended

The ABI documentation misstates ARM64 exceptions, and the PR description names the wrong ReadyToRun major version.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 3

Open (3)

• Document ARM64 byref exceptions for HFAs and scalable vectors · New
• Update PR description to consistently reference ReadyToRun version 30 · New
• Complete architecture summary with RISC-V and ARM64 exceptions · New

Resolved since last review (1)

• This behavioral codegen change has no regression coverage in the PR. Please add a targeted JIT test…

[Copilot]

Copilot review overview

🟡 Changes recommended

The ABI-wide code-generation change lacks targeted regression coverage, and its architecture table omits WebAssembly.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1

Open (1)

• Document WebAssembly implicit-byref structs and ABI rules · New

Resolved since last review (3)

• Complete architecture summary with RISC-V and ARM64 exceptions
• Update PR description to consistently reference ReadyToRun version 30
• Document ARM64 byref exceptions for HFAs and scalable vectors

[Copilot]

Copilot review overview

🔵 Needs a closer look

The GC-safety and barrier-elision behavior lacks targeted automated regression coverage.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Document WebAssembly implicit-byref structs and ABI rules

[EgorBo]

@jkotas @jakobbotsch anything else here?

I assume it fixes a potential gc hole we theoretically had (see thread ^), closes #133961 and removes a couple of write barriers.

Follow up: stop representing it via BYREF (#82166) - this actually had some improvements and we can benefit from alias analysis: implicit byrefs never alias with GC heap objects and return buffer