Release/9.0 staging may by wfurt · Pull Request #127589 · dotnet/runtime

wfurt · 2026-04-29T22:44:45Z

No description provided.

@liveans

dotnet#123661) Backport of dotnet#123485 to release/9.0-staging /cc @liveans Increasing RFC compliance for WebSocket ## Customer Impact RFC compliance ## Regression No ## Testing Manual verification + automated tests ## Risk Low, the change only affects non‑compliant WebSocket clients sending unmasked frames, which is explicitly disallowed by RFC 6455. No behavior change is expected for compliant clients. --------- Co-authored-by: Ahmet İbrahim Aksoy <aaksoy@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…t#125603) This pull request updates the following dependencies [marker]: <> (Begin:077f423f-1332-4108-a2ea-08dcc66548e6) ## From https://github.com/dotnet/xharness - **Subscription**: [077f423f-1332-4108-a2ea-08dcc66548e6](https://maestro.dot.net/subscriptions?search=077f423f-1332-4108-a2ea-08dcc66548e6) - **Build**: [20260318.1](https://dev.azure.com/dnceng/internal/_build/results?buildId=2929517) ([306735](https://maestro.dot.net/channel/2/github:dotnet:xharness/build/306735)) - **Date Produced**: March 18, 2026 9:51:17 AM UTC - **Commit**: [607b3de9cf2dbfec6734e686e68d2813b40b2b51](dotnet/xharness@607b3de) - **Branch**: [main](https://github.com/dotnet/xharness/tree/main) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [11.0.0-prerelease.26117.1 to 11.0.0-prerelease.26168.1][3] - Microsoft.DotNet.XHarness.CLI - Microsoft.DotNet.XHarness.TestRunners.Common - Microsoft.DotNet.XHarness.TestRunners.Xunit [3]: dotnet/xharness@0eeaa60...607b3de [DependencyUpdate]: <> (End) [marker]: <> (End:077f423f-1332-4108-a2ea-08dcc66548e6) --------- Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com>

@akoeplinger

…25715) Backport of dotnet#125544 to release/9.0-staging /cc @akoeplinger @wfurt --------- Co-authored-by: wfurt <tweinfurt@yahoo.com> Co-authored-by: Alexander Köplinger <alex.koeplinger@outlook.com> Co-authored-by: Marie Píchová <11718369+ManickaP@users.noreply.github.com>

…9.0-staging

…et#125151) I detected changes in the release/9.0 branch which have not been merged yet to release/9.0-staging. I'm a robot and am configured to help you automatically keep release/9.0-staging up to date, so I've opened this PR. This PR merges commits made on release/9.0 by the following committers: * vseanreesermsft * Copilot * hoyosjs * rbhanda * jozkee * dotnet-maestro[bot] * wfurt * bartonjs ## Instructions for merging from UI This PR will not be auto-merged. When pull request checks pass, complete this PR by creating a merge commit, *not* a squash or rebase commit. <img alt="merge button instructions" src="https://i.imgur.com/GepcNJV.png" width="300" /> If this repo does not allow creating merge commits from the GitHub UI, use command line instructions. ## Instructions for merging via command line Run these commands to merge this pull request from the command line. ``` sh git fetch git checkout release/9.0 git pull --ff-only git checkout release/9.0-staging git pull --ff-only git merge --no-ff release/9.0 # If there are merge conflicts, resolve them and then run git merge --continue to complete the merge # Pushing the changes to the PR branch will re-trigger PR validation. git push https://github.com/dotnet/runtime HEAD:merge/release/9.0-to-release/9.0-staging ``` <details> <summary>or if you are using SSH</summary> ``` git push git@github.com:dotnet/runtime HEAD:merge/release/9.0-to-release/9.0-staging ``` </details> After PR checks are complete push the branch ``` git push ``` ## Instructions for resolving conflicts :warning: If there are merge conflicts, you will need to resolve them manually before merging. You can do this [using GitHub][resolve-github] or using the [command line][resolve-cli]. [resolve-github]: https://help.github.com/articles/resolving-a-merge-conflict-on-github/ [resolve-cli]: https://help.github.com/articles/resolving-a-merge-conflict-using-the-command-line/ ## Instructions for updating this pull request Contributors to this repo have permission update this pull request by pushing to the branch 'merge/release/9.0-to-release/9.0-staging'. This can be done to resolve conflicts or make other changes to this pull request before it is merged. The provided examples assume that the remote is named 'origin'. If you have a different remote name, please replace 'origin' with the name of your remote. ``` git fetch git checkout -b merge/release/9.0-to-release/9.0-staging origin/release/9.0-staging git pull https://github.com/dotnet/runtime merge/release/9.0-to-release/9.0-staging (make changes) git commit -m "Updated PR with my changes" git push https://github.com/dotnet/runtime HEAD:merge/release/9.0-to-release/9.0-staging ``` <details> <summary>or if you are using SSH</summary> ``` git fetch git checkout -b merge/release/9.0-to-release/9.0-staging origin/release/9.0-staging git pull git@github.com:dotnet/runtime merge/release/9.0-to-release/9.0-staging (make changes) git commit -m "Updated PR with my changes" git push git@github.com:dotnet/runtime HEAD:merge/release/9.0-to-release/9.0-staging ``` </details> Contact .NET Core Engineering (dotnet/dnceng) if you have questions or issues. Also, if this PR was generated incorrectly, help us fix it. See https://github.com/dotnet/arcade/blob/main/.github/workflows/scripts/inter-branch-merge.ps1.

@AndyAyersMS

… loops (dotnet#126913) Backport of dotnet#126770 to release/9.0-staging /cc @AndyAyersMS ## Customer Impact - [x] Customer reported - [ ] Found internally JIT optimizations can cause certain down-counting loops to bypass a bounds check. Code that normally would throw index out of bounds exceptions on an array store might instead corrupt the heap. In particular the loop must have unknown upper bound and have a shape like: ```c# for (int i = N; i > 0; i--) { a[i] = ...; } ``` and then be invoked in a context where `N` is exactly `a.Length`. The loop exiting predicate must be `>` and not `>=`. In such cases the code will write to `a[N]` which is beyond the extent of `a`. Customer impact is likely low. Correct behavior here is to throw an exception. ## Regression - [x] Yes - [ ] No Introduced in .NET 7 with dotnet#67930. ## Testing Verified fix on repro case. SPMI had 132 method contexts with diffs from the fix change. Inspected a few and most either had redundant guards beforehand or else were only reading from the arrays. ## Risk Low, changes the code that decides at runtime if execution can use a "cloned" loop that omits bounds checks; now we are correctly cautious about running the fully checked loop. Co-authored-by: Andy Ayers <andya@microsoft.com>

Analog of dotnet#126945 to release/9.0-staging. ## Customer Impact - [ ] Customer reported - [X] Found internally ## Regression - [ ] Yes - [X] No ## Testing Standard CI. ## Risk Low, there's no product code change, only minor version upgrade of MsQuic library.

dotnet#123609) This pull request updates the following dependencies [marker]: <> (Begin:85dd9958-87d4-4ed4-addf-58b6aa848692) ## From https://github.com/dotnet/roslyn-analyzers - **Subscription**: [85dd9958-87d4-4ed4-addf-58b6aa848692](https://maestro.dot.net/subscriptions?search=85dd9958-87d4-4ed4-addf-58b6aa848692) - **Build**: [20260125.3](https://dev.azure.com/dnceng/internal/_build/results?buildId=2887164) ([298761](https://maestro.dot.net/channel/3884/github:dotnet:roslyn-analyzers/build/298761)) - **Date Produced**: January 25, 2026 8:33:47 AM UTC - **Commit**: [5ef1abb57ce3df89eae65ecadeb1ddbab323ae05](dotnet/roslyn-analyzers@5ef1abb) - **Branch**: [release/9.0.1xx](https://github.com/dotnet/roslyn-analyzers/tree/release/9.0.1xx) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [3.11.0-beta1.26057.1 to 3.11.0-beta1.26075.3][1] - Microsoft.CodeAnalysis.Analyzers - From [9.0.0-preview.26057.1 to 9.0.0-preview.26075.3][1] - Microsoft.CodeAnalysis.NetAnalyzers [1]: dotnet/roslyn-analyzers@5ef1abb...5ef1abb [DependencyUpdate]: <> (End) [marker]: <> (End:85dd9958-87d4-4ed4-addf-58b6aa848692) Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> Co-authored-by: Steve Pfister <steveisok@users.noreply.github.com> Co-authored-by: Larry Ewing <lewing@microsoft.com>

) This pull request updates the following dependencies [marker]: <> (Begin:5e3f9b88-faad-436c-a580-ac009d20bb33) ## From https://github.com/dotnet/icu - **Subscription**: [5e3f9b88-faad-436c-a580-ac009d20bb33](https://maestro.dot.net/subscriptions?search=5e3f9b88-faad-436c-a580-ac009d20bb33) - **Build**: [20260410.1](https://dev.azure.com/dnceng/internal/_build/results?buildId=2947989) ([309841](https://maestro.dot.net/channel/3883/github:dotnet:icu/build/309841)) - **Date Produced**: April 10, 2026 11:35:45 AM UTC - **Commit**: [852e53da554204ceeeec22f3d9653fd0745b2d71](dotnet/icu@852e53d) - **Branch**: [dotnet/release/9.0](https://github.com/dotnet/icu/tree/dotnet/release/9.0) [DependencyUpdate]: <> (Begin) - **Dependency Updates**: - From [9.0.0-rtm.25627.1 to 9.0.0-rtm.26210.1][25] - Microsoft.NETCore.Runtime.ICU.Transport [25]: dotnet/icu@cda39b5...852e53d [DependencyUpdate]: <> (End) [marker]: <> (End:5e3f9b88-faad-436c-a580-ac009d20bb33) --------- Co-authored-by: Larry Ewing <lewing@microsoft.com> Co-authored-by: dotnet-maestro[bot] <dotnet-maestro[bot]@users.noreply.github.com> Co-authored-by: Petr Onderka <petronderka@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

`source-build-reference-packages` repo was renamed to `source-build-assets`. To enable VMR/source-build scenarios this reference needs to be updated. This also updates the version as the new repo produced a new package.

dotnet-policy-service · 2026-04-29T22:46:15Z

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

…release/9.0-staging-may

Copilot

Pull request overview

This PR updates the release/9.0 staging branch with a mix of infrastructure/dependency bumps, test gating changes for Azure Linux 3 environments, and a JIT loop-cloning tweak plus a new JIT regression test.

Changes:

Add a new JIT opt/cloning regression test (DownCounted) and adjust loop cloning limit-condition derivation logic/comments.
Gate System.Net.Quic functional tests on a new IsNotAzureLinux3VM condition.
Update dependency versions (Roslyn analyzers, runtime-assets test data, ICU transport, MsQuic, XHarness) and switch pipeline Linux images to Azure Linux 3.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/tests/JIT/opt/Cloning/DownCounted.csproj	New csproj for the DownCounted JIT cloning regression test.
src/tests/JIT/opt/Cloning/DownCounted.cs	New JIT regression test covering down-counted array/span indexing behavior.
src/libraries/System.Net.Quic/tests/FunctionalTests/QuicTestBase.cs	Adds `IsNotAzureLinux3VM` condition used to gate Quic functional tests.
src/libraries/System.Net.Quic/tests/FunctionalTests/QuicStreamTests.cs	Adds Azure Linux 3 VM gating to the QuicStream test class.
src/libraries/System.Net.Quic/tests/FunctionalTests/QuicStreamConnectedStreamConformanceTests.cs	Adds Azure Linux 3 VM gating to connected-stream conformance tests.
src/libraries/System.Net.Quic/tests/FunctionalTests/QuicListenerTests.cs	Adds Azure Linux 3 VM gating to QuicListener tests.
src/libraries/System.Net.Quic/tests/FunctionalTests/QuicConnectionTests.cs	Adds Azure Linux 3 VM gating to QuicConnection tests.
src/libraries/System.Net.Quic/tests/FunctionalTests/MsQuicTests.cs	Adds Azure Linux 3 VM gating to MsQuic tests.
src/libraries/System.Net.Quic/tests/FunctionalTests/MsQuicRemoteExecutorTests.cs	Adds Azure Linux 3 VM gating to remote-executor tests.
src/libraries/System.Net.Quic/tests/FunctionalTests/MsQuicCipherSuitesPolicyTests.cs	Adds Azure Linux 3 VM gating to cipher-suites policy tests.
src/coreclr/jit/loopcloning.cpp	Adjusts how the loop cloning limit condition operator is derived; updates related comment.
eng/Versions.props	Bumps several tool/dependency versions (analyzers, test data, ICU transport, MsQuic, XHarness).
eng/Version.Details.xml	Updates dependency versions/SHAs and switches the source-build intermediate dependency naming.
eng/pipelines/common/xplat-setup.yml	Moves Linux build pool image demands to Azure Linux 3 images.
.config/dotnet-tools.json	Updates xharness CLI tool version to match the dependency bump.

Copilot · 2026-04-29T22:52:05Z

+        catch (IndexOutOfRangeException e)
+        {
+            Console.WriteLine("passed");
+            result = 100;
+        }


The exception variable in this catch block is never used. This triggers CS0168 (unused variable) and will fail the build when warnings are treated as errors. Remove the identifier from the catch clause or rename it to '_' if you want to keep a named discard.

Copilot · 2026-04-29T22:52:05Z

+        catch (IndexOutOfRangeException e)
+        {
+            Console.WriteLine("passed");
+            result = 100;
+        }


The exception variable in this catch block is never used. This triggers CS0168 (unused variable) and will fail the build when warnings are treated as errors. Remove the identifier from the catch clause or rename it to '_' if you want to keep a named discard.

Copilot · 2026-04-29T22:52:05Z

    // Decreasing loops
-    // GT_GT loop test: (end > start) ==> (end <= arrLen)
-    // GT_GE loop test: (end >= start) ==> (end < arrLen)
+    // Always check if iter var is less than array length.


This comment is misleading: the code below derives a condition on the loop limit (e.g., end <= arrLen for i < end), not always a strict 'iter var < array length' check. Please adjust the wording to reflect the actual derived conditions (<= vs < depending on the test operator).

Suggested change

// Always check if iter var is less than array length.

// GT_GE loop test: (start >= end) ==> (end < arrLen)

// GT_GT loop test: (start > end) ==> (end < arrLen)

github-actions Bot and others added 10 commits March 12, 2026 17:30

Merge branch 'release/9.0-staging' into merge/release/9.0-to-release/…

7c4d536

…9.0-staging

Use source-build-assets repo (dotnet#126804)

7d0894f

`source-build-reference-packages` repo was renamed to `source-build-assets`. To enable VMR/source-build scenarios this reference needs to be updated. This also updates the version as the new repo produced a new package.

Copilot AI review requested due to automatic review settings April 29, 2026 22:44

Copilot started reviewing on behalf of wfurt April 29, 2026 22:44 View session

github-actions Bot added the area-System.Net.Quic label Apr 29, 2026

dotnet-policy-service Bot assigned wfurt Apr 29, 2026

Merge branch 'release/9.0' of https://github.com/dotnet/runtime into …

b98dede

…release/9.0-staging-may

Copilot AI reviewed Apr 29, 2026

View reviewed changes

wfurt added the Servicing-approved Approved for servicing release label Apr 29, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release/9.0 staging may#127589

Release/9.0 staging may#127589
wfurt wants to merge 11 commits intodotnet:release/9.0from
wfurt:release/9.0-staging-may

wfurt commented Apr 29, 2026

Uh oh!

dotnet-policy-service Bot commented Apr 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 29, 2026

Uh oh!

Copilot AI Apr 29, 2026

Uh oh!

Copilot AI Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	// Always check if iter var is less than array length.
	// GT_GE loop test: (start >= end) ==> (end < arrLen)
	// GT_GT loop test: (start > end) ==> (end < arrLen)

Conversation

wfurt commented Apr 29, 2026

Uh oh!

dotnet-policy-service Bot commented Apr 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants