Invalid handle passed to `RuntimeTypeHandle.GetRuntimeTypeFromHandle` when calling a `synchronized` method in a collectible assembly in .NET 10

[agocke]

Description

Regression in .NET 10 (not sure which preview).

The repro is a VB DLL being loaded into a collectible ALC. If collectible is disabled, this stops reproing on my machines (Mac & Linux)

Reproduction Steps

repro 2.zip

Expected behavior

No exception

Actual behavior

Unhandled exception. System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation.
 ---> System.TypeInitializationException: The type initializer for 'vb.C1' threw an exception.
 ---> System.NullReferenceException: Object reference not set to an instance of an object.
   at System.RuntimeTypeHandle.GetRuntimeTypeFromHandle(IntPtr handle)
   at vb.C1.set_a(C1 WithEventsValue)
   at vb.C1..cctor() in /Users/andy/Downloads/repro 2/vb/Program.vb:line 2
   --- End of inner exception stack trace ---
   at vb.C1.get_a()
   at vb.C1.Main() in /Users/andy/Downloads/repro 2/vb/Program.vb:line 5
   at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
   at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)
   --- End of inner exception stack trace ---
   at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at Program.<Main>$(String[] args) in /Users/andy/Downloads/repro 2/cs/Program.cs:line 7

Regression?

Yes

Known Workarounds

No response

Configuration

No response

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-reflection
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to this area: @vitek-karas, @agocke, @VSadov
See info in area-owners.md if you want to be subscribed.

[agocke]

cc @elinor-fung @janvorli

[janvorli]

There is no collectible assembly being freed here.
Edit: What I mean is that the collectible assembly has not been freed yet.
The crash occurs because System.RuntimeTypeHandle.GetRuntimeTypeFromHandle is being passed a handle that's somehow incorrect. The handle is loaded as a constant in the caller jitted method, see the mov rcx,24CFA47C728h

vb.C1.set_a(vb.C1)
ilAddr is 0000024CFA792145 pImport is 000001B88E25C9F0
Begin 00007FFB1E3002C0, size c1
00007ffb`1e3002c0 55              push    rbp
00007ffb`1e3002c1 57              push    rdi
00007ffb`1e3002c2 4883ec48        sub     rsp,48h
00007ffb`1e3002c6 488d6c2450      lea     rbp,[rsp+50h]
00007ffb`1e3002cb c5d857e4        vxorps  xmm4,xmm4,xmm4
00007ffb`1e3002cf c5fa7f65d8      vmovdqu xmmword ptr [rbp-28h],xmm4
00007ffb`1e3002d4 33c0            xor     eax,eax
00007ffb`1e3002d6 488945e8        mov     qword ptr [rbp-18h],rax
00007ffb`1e3002da 48894d10        mov     qword ptr [rbp+10h],rcx
00007ffb`1e3002de 833d7bc0000000  cmp     dword ptr [00007ffb`1e30c360],0
00007ffb`1e3002e5 7405            je      vb!vb.C1.set_a+0x2c (00007ffb`1e3002ec)
00007ffb`1e3002e7 e89451365e      call    coreclr!JIT_DbgIsJustMyCode (00007ffb`7c665480)
00007ffb`1e3002ec 33c0            xor     eax,eax
00007ffb`1e3002ee 488945f0        mov     qword ptr [rbp-10h],rax
00007ffb`1e3002f2 48b928c747fa4c020000 mov rcx,24CFA47C728h
00007ffb`1e3002fc e8dfb30c5b      call    System_Private_CoreLib!System.RuntimeTypeHandle.GetRuntimeTypeFromHandle (00007ffb`793cb6e0)
>>> 00007ffb`1e300301 488945e8        mov     qword ptr [rbp-18h],rax
00007ffb`1e300305 488b4de8        mov     rcx,qword ptr [rbp-18h]
00007ffb`1e300309 488d55f0        lea     rdx,[rbp-10h]
00007ffb`1e30030d e8ee5b1d5b      call    System_Private_CoreLib!System.Threading.Monitor.Enter (00007ffb`794d5f00)
00007ffb`1e300312 48b9f0d7301efb7f0000 mov rcx,7FFB1E30D7F0h
00007ffb`1e30031c e8ef15725e      call    coreclr!JIT_GetDynamicGCStaticBase_SingleAppDomain (00007ffb`7ca21910)
00007ffb`1e300321 488b5510        mov     rdx,qword ptr [rbp+10h]
00007ffb`1e300325 488bc8          mov     rcx,rax
00007ffb`1e300328 e8e3fc2bff      call    CORINFO_HELP_ASSIGN_REF (00007ffb`1d5c0010)
.
.
.

The IL of this method looks as follows:

	IL_0000: ldarg.0
	IL_0001: stsfld class vb.C1 vb.C1::_a
	IL_0006: ret

[janvorli]

Also, the TestExecutionLoadContext is not marked as unloading either, so this issue is not related to unloading itself.