JsonSerializer throws AccessViolationException for struct with field initializers

[yufeih]

Description

Deserialize a struct with field initializer causes AccessViolationException .

Reproduction Steps

JsonSerializer.Deserialize<Foo>("{}");

public struct Foo
{
    public float A = 1;
}

Expected behavior

The struct is deserialized successfully with the field initialized using the default field initializer.

Actual behavior

Throws this exception:

Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
   at System.Runtime.CompilerServices.CastHelpers.IsInstanceOfInterface(Void*, System.Object)
   at System.Text.Json.Serialization.Converters.ObjectDefaultConverter`1[[Foo, console, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]].OnTryRead(System.Text.Json.Utf8JsonReader ByRef, System.Type, System.Text.Json.JsonSerializerOptions, System.Text.Json.ReadStack ByRef, Foo ByRef)
   at System.Text.Json.Serialization.JsonConverter`1[[Foo, console, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]].TryRead(System.Text.Json.Utf8JsonReader ByRef, System.Type, System.Text.Json.JsonSerializerOptions, System.Text.Json.ReadStack ByRef, Foo ByRef)
   at System.Text.Json.Serialization.JsonConverter`1[[Foo, console, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]].ReadCore(System.Text.Json.Utf8JsonReader ByRef, System.Text.Json.JsonSerializerOptions, System.Text.Json.ReadStack ByRef)
   at System.Text.Json.JsonSerializer.ReadFromSpan[[Foo, console, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]](System.ReadOnlySpan`1<Byte>, System.Text.Json.Serialization.Metadata.JsonTypeInfo, System.Nullable`1<Int32>)
   at System.Text.Json.JsonSerializer.ReadFromSpan[[Foo, console, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]](System.ReadOnlySpan`1<Char>, System.Text.Json.Serialization.Metadata.JsonTypeInfo)
   at System.Text.Json.JsonSerializer.Deserialize[[Foo, console, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]](System.String, System.Text.Json.JsonSerializerOptions)
   at Program.<Main>$(System.String[])

Regression?

No response

Known Workarounds

No response

Configuration

.NET SDK Version: 6.0.101

Other information

No response

[ghost]

Tagging subscribers to this area: @dotnet/area-system-text-json
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

Deserialize a struct with field initializer causes AccessViolationException .

Reproduction Steps

JsonSerializer.Deserialize<Foo>("{}");

public struct Foo
{
    public float A = 1;
}

Expected behavior

The struct is deserialized successfully with the field initialized using the default field initializer.

Actual behavior

Throws this exception:

Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
   at System.Runtime.CompilerServices.CastHelpers.IsInstanceOfInterface(Void*, System.Object)
   at System.Text.Json.Serialization.Converters.ObjectDefaultConverter`1[[Foo, console, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]].OnTryRead(System.Text.Json.Utf8JsonReader ByRef, System.Type, System.Text.Json.JsonSerializerOptions, System.Text.Json.ReadStack ByRef, Foo ByRef)
   at System.Text.Json.Serialization.JsonConverter`1[[Foo, console, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]].TryRead(System.Text.Json.Utf8JsonReader ByRef, System.Type, System.Text.Json.JsonSerializerOptions, System.Text.Json.ReadStack ByRef, Foo ByRef)
   at System.Text.Json.Serialization.JsonConverter`1[[Foo, console, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]].ReadCore(System.Text.Json.Utf8JsonReader ByRef, System.Text.Json.JsonSerializerOptions, System.Text.Json.ReadStack ByRef)
   at System.Text.Json.JsonSerializer.ReadFromSpan[[Foo, console, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]](System.ReadOnlySpan`1<Byte>, System.Text.Json.Serialization.Metadata.JsonTypeInfo, System.Nullable`1<Int32>)
   at System.Text.Json.JsonSerializer.ReadFromSpan[[Foo, console, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]](System.ReadOnlySpan`1<Char>, System.Text.Json.Serialization.Metadata.JsonTypeInfo)
   at System.Text.Json.JsonSerializer.Deserialize[[Foo, console, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]](System.String, System.Text.Json.JsonSerializerOptions)
   at Program.<Main>$(System.String[])

Regression?

No response

Known Workarounds

No response

Configuration

.NET SDK Version: 6.0.101

Other information

No response

Author:	yufeih
Assignees:	-
Labels:	area-System.Text.Json, untriaged
Milestone:	-

[EgorBo]

Checked JIT fails with

Assert failure(PID 15204 [0x00003b64], Thread: 19020 [0x4a4c]): Assertion failed '(genActualType(op2->TypeGet()) == genActualType(info.compRetType)) || ((op2->TypeGet() == TYP_I_IMPL) && TypeIs(info.compRetType, TYP_BYREF)) || (op2->TypeIs(TYP_BYREF, TYP_REF) && (info.compRetType == TYP_I_IMPL)) || (varTypeIsFloating(op2->gtType) && varTypeIsFloating(info.compRetType)) || (varTypeIsStruct(op2) && varTypeIsStruct(info.compRetType)) : Possibly bad IL with CEE_ret at offset 0005h (op1=NULL op2=struct stkDepth=0)' in 'DynamicClass:.ctor():System.Object' during 'Importation' (IL size 6)

    File: C:\prj\runtime-2\src\coreclr\jit\importer.cpp Line: 17650
    Image: C:\prj\runtime-2\artifacts\bin\coreclr\windows.x64.Checked\CoreRun.exe

I guess it's slightly confused with the input IL which creates a Foo struct but is reported to have a ref-type return type 🤔

IL to import:
IL_0000  73 02 00 00 06    newobj       0x6000002
IL_0005  2a                ret

[EgorBo]

I suspect it's JSON's ReflectionEmitMemberAccessor emits an invalid dynamic code (missed boxing?)

[EgorBo]

So Foo struct has a parameterless constructor (C# 10 feature) due to field initialization, it means it goes this path https://github.com/dotnet/runtime/blob/main/src/libraries/System.Text.Json/src/System/Text/Json/Serialization/Metadata/ReflectionEmitMemberAccessor.cs#L51 where boxing is still needed if it's a value type.

Explicit parameterless ctor also reproduces the AVE:

using System.Text.Json;

JsonSerializer.Deserialize<Foo>("{}");

public struct Foo
{
    public float A;

    public Foo()
    {
        A = 42;
    }
}

[yufeih]

Thanks for the fix!