Add validation that weak interior pointers have interior pointers whi…

…ch point into the middle of the specified object

src/coreclr/gc/env/gcenv.base.h

@@ -447,6 +447,20 @@ typedef uintptr_t TADDR;
 typedef DPTR(size_t)    PTR_size_t;
 typedef DPTR(uint8_t)   PTR_uint8_t;
 
+#if defined(BUILD_AS_STANDALONE)
+// In the standalone build, we don't have the DAC headers, so we need to define a non-DAC variant of dac_cast.
+template <typename Tgt, typename Src>
+inline Tgt dac_cast(Src src)
+{
+    // In non-DAC builds, dac_cast is the same as a C-style cast because we need to support:
+    //  - casting away const
+    //  - conversions between pointers and TADDR
+    // Perhaps we should more precisely restrict it's usage, but we get the precise
+    // restrictions in DAC builds, so it wouldn't buy us much.
+    return (Tgt)(src);
+}
+#endif
+
 // -----------------------------------------------------------------------------------------------------------
 
 #define DATA_ALIGNMENT sizeof(uintptr_t)

src/coreclr/gc/handletablescan.cpp

@@ -931,6 +931,15 @@ static void VerifyObjectAndAge(_UNCHECKED_OBJECTREF from, _UNCHECKED_OBJECTREF o
     }
 }
 
+size_t my_get_size (_UNCHECKED_OBJECTREF ob)
+{
+    DPTR(MethodTable) mT = dac_cast<DPTR(MethodTable)>((TADDR)ob->GetGCSafeMethodTable());
+
+    return (mT->GetBaseSize() +
+            (mT->HasComponentSize() ?
+             ((size_t)dac_cast<DPTR(ArrayBase)>(ob)->GetNumComponents() * mT->RawGetComponentSize()) : 0));
+}
+
 /*
  * BlockVerifyAgeMapForBlocksWorker
  *
@@ -992,6 +1001,23 @@ void BlockVerifyAgeMapForBlocksWorker(uint32_t *pdwGen, uint32_t dwClumpMask, Sc
                             }
                         }
                     }
+                    if (uType == HNDTYPE_WEAK_INTERIOR_POINTER)
+                    {
+                        PTR_uintptr_t pUserData = HandleQuickFetchUserDataPointer((OBJECTHANDLE)pValue);
+
+                        // if we did then copy the value
+                        if (pUserData)
+                        {
+                            TADDR pObjectInteriorPointer = **dac_cast<DPTR(DPTR(TADDR))>(pUserData);
+                            _UNCHECKED_OBJECTREF pObjectPointerRef = *pValue;
+                            TADDR pObjectPointer = dac_cast<TADDR>(pObjectPointerRef);
+                            if (pObjectInteriorPointer < pObjectPointer || pObjectInteriorPointer >= (pObjectPointer + my_get_size(pObjectPointerRef)))
+                            {
+                                _ASSERTE(!"Weak interior pointer has interior pointer which does not point at the object of the handle.");
+                                GCToEEInterface::HandleFatalError(COR_E_EXECUTIONENGINE);
+                            }
+                        }
+                    }
                 }
             }
         }