Fix ILVerify false positive: ReturnPtrToStack on by-value return of a ref struct

[Copilot]

ILVerify incorrectly reports ReturnPtrToStack when a method returns an IsByRefLike (ref struct) type by value. The check at ImportReturn applied the IsPermanentHome requirement for any IsByRefLike return type, but IsPermanentHome is only meaningful when the stack holds a ByRef—not when it holds a value-type.

Root cause

The ImportReturn check treated IsByRefLike and IsByRef identically, requiring IsPermanentHome on the stack value. For by-value ref struct returns, the stack holds a ValueType-kind entry (from ldloc/ldarg), not a ByRef, so IsPermanentHome was always false — incorrectly triggering the error.

Additionally, ImportLoadVar never called SetIsPermanentHome() on the stack value it pushed, even though locals and arguments are permanent homes for the lifetime of the method.

Fix

ILImporter.StackValue.cs: Removed the Debug.Assert(Kind == StackValueKind.ByRef) guard from SetIsPermanentHome, allowing it to be called on value-type stack entries.

ILImporter.Verify.cs / ImportLoadVar: Added stackValue.SetIsPermanentHome() — stack values loaded from locals and arguments are always permanent homes.

With this in place, the ImportReturn check remains in its original simple form:

Check((!expectedReturnType.IsByRef && !expectedReturnType.IsByRefLike) || actualReturnType.IsPermanentHome,
      VerifierError.ReturnPtrToStack);

A ldloc/ldarg of a ref struct now carries IsPermanentHome = true, so the check correctly passes for by-value returns. Returning a byref to a local/arg (e.g. ldarga.s; ret) still correctly fails, as ImportAddressOfVar does not set IsPermanentHome.

Tests

Added to ReturnTests.il:

• Return.RefStructByValue_Valid — ldarg; stloc; ldloc; ret of a ref struct passes verification
• Return.LocalRefStructFieldByRef_Invalid_ReturnPtrToStack — returning a byref to a field of a local ref struct argument is correctly rejected

[dotnet-policy-service]

Tagging subscribers to this area: @agocke
See info in area-owners.md if you want to be subscribed.

[jkotas]

Suggested change

// This was a false positive: ILVerify incorrectly reported ReturnPtrToStack.

[jkotas]

@copilot address my feedback

Also, address the "The other side of the bug is in" part of the original bug report

[Copilot]

@copilot address my feedback

Also, address the "The other side of the bug is in" part of the original bug report

Addressed in the latest commit. The "other side of the bug" fix (ImportLoadVar) is what enables simplifying the check:

1. ILImporter.StackValue.cs: Removed the Debug.Assert(Kind == StackValueKind.ByRef) from SetIsPermanentHome so it can be called on value-type stack entries.
2. ILImporter.Verify.cs / ImportLoadVar: Added stackValue.SetIsPermanentHome() — locals and arguments are always permanent homes.
3. ILImporter.Verify.cs / ImportReturn: The check is now back to its original simple form (|| actualReturnType.IsPermanentHome) — the ldloc/ldarg of a ref struct now carries IsPermanentHome = true, so the check correctly passes.
4. ReturnTests.il: Removed the two comment lines and changed "still invalid" → "invalid".

[Copilot]

Pull request overview

This PR updates the ILVerification importer’s tracking of PermanentHome to address a ReturnPtrToStack false positive when returning a ref struct (IsByRefLike) by value, and adds IL tests covering the scenario.

Changes:

• Mark stack values produced by ldloc/ldarg as PermanentHome (via ImportLoadVar), intended to allow by-value ref struct returns to pass verification.
• Relax StackValue.SetIsPermanentHome() to be callable on non-ByRef stack kinds.
• Add new IL test cases for returning a ref struct by value (valid) and returning a byref to a ref struct field (invalid).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/coreclr/tools/ILVerification/ILImporter.Verify.cs	Changes ImportLoadVar to set PermanentHome on loaded variables.
src/coreclr/tools/ILVerification/ILImporter.StackValue.cs	Removes Debug.Assert(Kind == StackValueKind.ByRef) from SetIsPermanentHome().
src/coreclr/tools/ILVerification.Tests/ILTests/ReturnTests.il	Adds a ref struct IL type and two return-related test methods.