Bad GC info generated for structures that contain Span field and small packing

[jkotas]

Repro:

dotnet run -c Release
Actual result: Prints ERRORs or crashes during GC within seconds
Expected result: Runs forever without error

using System;
using System.Threading;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, Pack = 1)]
internal ref struct NumberBuffer
{
    public bool Sign;
    public Span<char> Digits;
}

class Program
{
    static int MoreWork(ref NumberBuffer buffer)
    {
        for (int i = 0; i < buffer.Digits.Length; i++)
            buffer.Digits[i % buffer.Digits.Length] = (char)i;
        int sum = 0;
        for (int i = 0; i < buffer.Digits.Length; i++)
            sum += buffer.Digits[i];
        return sum;
    }

    static char[][] s = new char[1000][];

    static void Work()
    {
        Random r = new Random();
        for (;;)
        {
            NumberBuffer buffer = default;
            buffer.Digits = s[r.Next(s.Length)];
            if (buffer.Digits.Length == 0) continue;
            int sum = MoreWork(ref buffer);
            if (sum != 499500)
                Console.WriteLine("ERROR: " + sum);
        }
    }

    static void Main(string[] args)
    {
        new Thread(Work).Start();
        new Thread(Work).Start();
        new Thread(Work).Start();

        Random r = new Random();
        for (;;) { s[r.Next(s.Length)] = new char[1000]; GC.KeepAlive(new char[r.Next(1000)]); }
    }
}

[jkotas]

Related to dotnet/corert#6512. I think the type loader should ignore the Pack directive and align byref fields as pointers; similar to what it does for regular objref fields.

[MichalStrehovsky]

Moving this out to Future. This requires changes in type layout that look very risky. dotnet/coreclr#25056 (comment)