[interpreter] Resolve open virtual delegates invoked through the shuffle thunk (wasm, Apple mobile)

[lewing]

Invoking an open virtual delegate from compiled code crashes CoreCLR on platforms that use the interpreter with cached interface dispatch:

• browser-wasm (ReadyToRun): memory access out of bounds in PrepareInterpreterCode ([browser][CoreCLR][R2R] System.Linq.Expressions tests trap in PrepareInterpreterCode #134261).
• maccatalyst / iOS / tvOS: a crash in CID_VirtualOpenDelegateDispatchWorker. In CI this showed up as a 75-minute System.Runtime.Tests hang on maccatalyst-arm64 CoreCLR_Smoke, because a second fault while logging the crash spins in PAL_DispatchException ([maccatalyst][CoreCLR] Fault while logging the fatal-error call stack spins in PAL_DispatchException instead of terminating #134720).

Cause

For an open virtual delegate, _methodPtr is the delegate shuffle thunk and _methodPtrAux is CID_VirtualOpenDelegateDispatch. The shuffle thunk is an IL stub that does calli _methodPtrAux, and on these platforms it runs in the interpreter.

CID_VirtualOpenDelegateDispatch can't be invoked through a plain calli, because it expects the address of _methodPtrAux in a hidden argument that calli cannot express:

• On arm64 it expects the address of _methodPtrAux in x11, which the interpreter's calli doesn't set.
• On wasm it is only a PORTABILITY_ASSERT stub, not a portable entry point, so PortableEntryPoint::GetMethodDesc returns garbage.

Interpreted callers don't hit this, because INTOP_CALLDELEGATE already recognizes the value and skips the shuffle thunk. Compiled (R2R) callers invoke _methodPtr directly and reach the calli.

Change

This is an interpreter-side workaround for #134733. The IL shuffle thunk's calli can't pass the hidden argument that open virtual delegate dispatch stubs expect, under both cached interface dispatch and virtual stub dispatch. The general fix belongs in the shuffle thunk and is tracked by that issue.

• In INTOP_CALLI, under FEATURE_CACHED_INTERFACE_DISPATCH, recognize CID_VirtualOpenDelegateDispatch. Resolve the virtual target from the delegate (the shuffle thunk's this) and the target's this argument, then continue through CALL_INTERP_METHOD. That path falls back to InvokeManagedMethod when the target has compiled code.
• Link CreateILDelegateShuffleThunk's calli cannot pass the hidden argument that open virtual delegate dispatch stubs expect #134733 from this workaround and from the EmitCALLI in CreateILDelegateShuffleThunk.
• Share the resolution between INTOP_CALLDELEGATE and INTOP_CALLI via ResolveOpenVirtualDelegateTarget.
• Add DelegateTests coverage for invoking open virtual delegates: class override, boxed struct, enum and interface dispatch. The interface cases are disabled on browser Mono AOT, which has a separate crash tracked in [browser][Mono] Open-instance delegate to an interface method crashes in mono_class_interface_offset_with_variance #134707.
• Re-enable System.Linq.Expressions.Tests on the browser CoreCLR ReadyToRun lane.

Validation (local)

Configuration	Test	Without fix	With fix
browser-wasm CoreCLR ReadyToRun + trimming (Chrome)	System.Linq.Expressions.Tests	Trap in PrepareInterpreterCode	35,116 run, 0 failed
browser-wasm CoreCLR ReadyToRun + trimming (Chrome)	System.Runtime.Tests DelegateTests	Trap in the new test	58 run, 0 failed
maccatalyst-arm64 CoreCLR Release	System.Runtime.Tests (full)	Hang (crash in CID_VirtualOpenDelegateDispatchWorker)	79,181 run, 0 failed

The browser Debug build compiles the new asserts.

Resolves #134261

Note

This PR description was generated with GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @BrzVlad, @janvorli
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to 'arch-wasm': @lewing, @pavelsavara
See info in area-owners.md if you want to be subscribed.

[Copilot]

Copilot review overview

🟢 Approval recommended

No blocking issues remain; only a documentation nit was noted.

Review effort: Lite
Findings: 1

Open (1)

• Correct comments for the portable entrypoint preprocessor branch · New

What changed in this PR

Fixes browser-Wasm CoreCLR ReadyToRun crashes when invoking open virtual delegates.

Changes:

• Resolves open virtual delegate targets in interpreter calli handling.
• Shares delegate resolution logic and adds regression coverage.
• Re-enables LINQ Expressions tests for the affected lane.

File	Summary
src/​libraries/​tests.proj	Re-enables the affected ReadyToRun test project.
src/​libraries/​System.Runtime/​tests/​System.Runtime.Tests/​System/​DelegateTests.cs	Adds open virtual delegate dispatch tests.
src/​coreclr/​vm/​interpexec.cpp	Resolves portable open virtual delegate targets; update the related preprocessor guard comments.

[dotnet-policy-service]

Tagging subscribers to 'os-maccatalyst': @vitek-karas, @kotlarmilos, @steveisok, @akoeplinger
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to 'arch-wasm': @lewing, @pavelsavara
See info in area-owners.md if you want to be subscribed.

[lewing]

The tests that were added showed that the problem was general to CID platforms so the PR has been updated to fix the apple mobile platforms as well. That means this is probably a candidate for a backport as well.

[jkotas]

LGTM otherwise