Fix foreign exception handling on Windows (#113323)

* Fix foreign exception handling on Windows

There is a problem in a special case with the new
exception handling:

* A managed code calls a 3rd party native C++ code
* then a C++ exception is thrown in that code
* then it is propagated through managed code
* then it is caught in a 3rd party native C++ code
* then a managed callback is called from the catch handler
* then the exception is rethrown using C++ "throw"
* then it propagates back to the initial managed caller

The problem is as follows:
* When a native exception passes through managed frames and it is
  rethrown once a native frame is encountered, the RaiseException
  doesn't use the original exception's `EXCEPTION_RECORD`, but creates a
  new CLR exception instead.
* When a managed callback called from the native C++ catch handler throws
  and catches another exception, the LastThrownObject is cleared.
* When the C++ code in the catch handler rethrows the exception and it
  is propagated to managed code, the ProcessCLRException personality
  routine is invoked for the first managed frame. It can see that the
  exception is a CLR exception, but the LastThrownObject is NULL. It
  asserts in debug builds and crashes a bit later in release builds
  attempting to dereference the NULL.

The fix is to pass the original `EXCEPTION_RECORD` to the `RaiseException`
in case an external exception is propagated. And use just
`RaiseException` instead of the machinery for regular managed exceptions.

The issue was discovered in Autodesk Revit 2025 that does this kind of
exception propagation.

Close #113158

* Disable the test on Mono

* Fix the problem with C++ exception object in reclaimed stack

* Fix jongjmp accidentally handled as foreign

Author: janvorli

src/coreclr/vm/exceptionhandling.cpp

@@ -5662,11 +5662,18 @@ VOID DECLSPEC_NORETURN DispatchManagedException(OBJECTREF throwable, CONTEXT* pE
     ULONG_PTR hr = GetHRFromThrowable(throwable);
 
     EXCEPTION_RECORD newExceptionRecord;
-    newExceptionRecord.ExceptionCode = EXCEPTION_COMPLUS;
-    newExceptionRecord.ExceptionFlags = EXCEPTION_NONCONTINUABLE | EXCEPTION_SOFTWARE_ORIGINATE;
-    newExceptionRecord.ExceptionAddress = (void *)(void (*)(OBJECTREF))&DispatchManagedException;
-    newExceptionRecord.NumberParameters = MarkAsThrownByUs(newExceptionRecord.ExceptionInformation, hr);
-    newExceptionRecord.ExceptionRecord = NULL;
+    if (pExceptionRecord != NULL)
+    {
+        newExceptionRecord = *pExceptionRecord;
+    }
+    else
+    {
+        newExceptionRecord.ExceptionCode = EXCEPTION_COMPLUS;
+        newExceptionRecord.ExceptionFlags = EXCEPTION_NONCONTINUABLE | EXCEPTION_SOFTWARE_ORIGINATE;
+        newExceptionRecord.ExceptionAddress = (void *)(void (*)(OBJECTREF))&DispatchManagedException;
+        newExceptionRecord.NumberParameters = MarkAsThrownByUs(newExceptionRecord.ExceptionInformation, hr);
+        newExceptionRecord.ExceptionRecord = NULL;
+    }
 
     ExInfo exInfo(pThread, &newExceptionRecord, pExceptionContext, ExKind::Throw);
 
@@ -7716,6 +7723,32 @@ VOID DECLSPEC_NORETURN PropagateLongJmpThroughNativeFrames(jmp_buf *pJmpBuf, int
     WRAPPER_NO_CONTRACT;
     longjmp(*pJmpBuf, retVal);
 }
+
+// This is a personality routine that the RtlRestoreContext calls when it is called with
+// pExceptionRecord->ExceptionCode == STATUS_UNWIND_CONSOLIDATE.
+// Before calling this function, it creates a machine frame that hides all the frames
+// upto the frame described by the pContextRecord. This allows us to raise the exception
+// from the target context without removing the frames from the stack. Those frames
+// can contain e.g. a C++ exception object that needs to be preserved during the exception
+// propagation.
+EXTERN_C EXCEPTION_DISPOSITION
+PropagateForeignExceptionThroughNativeFrames(IN     PEXCEPTION_RECORD   pExceptionRecord,
+                    IN     PVOID               pEstablisherFrame,
+                    IN OUT PCONTEXT            pContextRecord,
+                    IN OUT PDISPATCHER_CONTEXT pDispatcherContext
+                    )
+{
+    STATIC_CONTRACT_MODE_COOPERATIVE;
+    STATIC_CONTRACT_GC_TRIGGERS;
+    STATIC_CONTRACT_THROWS;
+
+    _ASSERTE(pExceptionRecord->NumberParameters == 2);
+    EXCEPTION_RECORD *pExceptionToPropagateRecord = (EXCEPTION_RECORD*)pExceptionRecord->ExceptionInformation[1];
+    GCX_PREEMP_NO_DTOR();
+    RaiseException(pExceptionToPropagateRecord->ExceptionCode, pExceptionToPropagateRecord->ExceptionFlags, pExceptionToPropagateRecord->NumberParameters, pExceptionToPropagateRecord->ExceptionInformation);
+    UNREACHABLE();
+}
+
 #endif // HOST_WINDOWS
 
 extern "C" void * QCALLTYPE CallCatchFunclet(QCall::ObjectHandleOnStack exceptionObj, BYTE* pHandlerIP, REGDISPLAY* pvRegDisplay, ExInfo* exInfo)
@@ -7784,6 +7817,7 @@ extern "C" void * QCALLTYPE CallCatchFunclet(QCall::ObjectHandleOnStack exceptio
 #ifdef HOST_WINDOWS
     jmp_buf* pLongJmpBuf = pExInfo->m_pLongJmpBuf;
     int longJmpReturnValue = pExInfo->m_longJmpReturnValue;
+    EXCEPTION_RECORD lastExceptionRecord = *pExInfo->m_ptrs.ExceptionRecord;
 #endif // HOST_WINDOWS
 
 #ifdef HOST_UNIX
@@ -7885,6 +7919,23 @@ extern "C" void * QCALLTYPE CallCatchFunclet(QCall::ObjectHandleOnStack exceptio
         }
 #endif // HOST_UNIX
         // Throw exception from the caller context
+
+#ifdef HOST_WINDOWS
+        if ((pLongJmpBuf == NULL) && !IsComPlusException(&lastExceptionRecord) && MapWin32FaultToCOMPlusException(&lastExceptionRecord) == kSEHException)
+        {
+            // Propagate an external exception to the caller context. This is done in a special way, since the native stack
+            // frames below the caller context may contain e.g. C++ exception object that the external exception references.
+            // So we rely on a special mode of the RtlRestoreContext with EXCEPTION_RECORD passed in with STATUS_UNWIND_CONSOLIDATE
+            // exception code to create a machine frame that hides all the frames upto the caller context before rasing the exception.
+            EXCEPTION_RECORD exceptionRecord;
+            exceptionRecord.ExceptionCode = STATUS_UNWIND_CONSOLIDATE;
+            exceptionRecord.NumberParameters = 2;
+            exceptionRecord.ExceptionInformation[0] = (ULONG_PTR)PropagateForeignExceptionThroughNativeFrames;
+            exceptionRecord.ExceptionInformation[1] = (ULONG_PTR)&lastExceptionRecord;
+            RtlRestoreContext(pvRegDisplay->pCurrentContext, &exceptionRecord);
+        }
+#endif // HOST_WINDOWS
+
 #if defined(HOST_AMD64)
         ULONG64* returnAddress = (ULONG64*)targetSp;
         *returnAddress = pvRegDisplay->pCurrentContext->Rip;

src/tests/baseservices/exceptions/exceptioninterop/ExceptionInterop.cs

@@ -156,4 +156,41 @@ static void ThrowInFrameWithFinally()
             }
         }
     }
+
+    [DllImport(nameof(ExceptionInteropNative))]
+    public static extern void InvokeCallbackCatchCallbackAndRethrow(delegate*unmanaged<void> callBack1, delegate*unmanaged<void> callBack2);
+
+    [UnmanagedCallersOnly]
+    static void CallPInvoke()
+    {
+        ThrowException();
+    }
+
+    [UnmanagedCallersOnly]
+    static void ThrowAndCatchException()
+    {
+        try
+        {
+            throw new Exception("This one is handled");
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine($"Caught {ex}");
+        }
+    }
+
+    [Fact]
+    [PlatformSpecific(TestPlatforms.Windows)]
+    [SkipOnMono("Exception interop not supported on Mono.")]
+    public static void PropagateAndRethrowCppException()
+    {
+        try
+        {
+            InvokeCallbackCatchCallbackAndRethrow(&CallPInvoke, &ThrowAndCatchException);
+        }
+        catch (Exception ex)
+        {
+            Console.WriteLine($"Caught {ex}");
+        }
+    }
 }

src/tests/baseservices/exceptions/exceptioninterop/ExceptionInteropNative.cpp

@@ -16,4 +16,20 @@ extern "C" DLL_EXPORT void STDMETHODCALLTYPE NativeFunction()
 extern "C" DLL_EXPORT void STDMETHODCALLTYPE CallCallback(void (*cb)())
 {
     cb();
-}
+}
+
+typedef void (*PFNACTION1)();
+extern "C" DLL_EXPORT void InvokeCallbackCatchCallbackAndRethrow(PFNACTION1 callback1, PFNACTION1 callback2)
+{
+    try
+    {
+        callback1();
+    }
+    catch (std::exception& ex)
+    {
+        callback2();
+        printf("Caught exception %s in native code, rethrowing\n", ex.what());
+        throw;
+    }
+}
+