From d06501087d0694d199484a3eb6ceb6610b405fd6 Mon Sep 17 00:00:00 2001
From: Jan Vorlicek <janvorli@microsoft.com>
Date: Thu, 15 Dec 2022 15:06:03 +0100
Subject: [PATCH] Fix WXORX issue in EEClass::Destruct (#79696)

While investigating failures of some coreclr tests when running in an
unloadable context, I've hit AV in EEClass::Destruct in one of the
tests. The reason is that we are missing ExecutableWriterHolder when
updating refCount on pDelegateEEClass->m_pInstRetBuffCallStub.

This change fixes it.
---
 src/coreclr/vm/class.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/coreclr/vm/class.cpp b/src/coreclr/vm/class.cpp
index bc0af4953c6bd..b179bffe9be09 100644
--- a/src/coreclr/vm/class.cpp
+++ b/src/coreclr/vm/class.cpp
@@ -162,7 +162,8 @@ void EEClass::Destruct(MethodTable * pOwningMT)
         }
         if (pDelegateEEClass->m_pInstRetBuffCallStub)
         {
-            pDelegateEEClass->m_pInstRetBuffCallStub->DecRef();
+            ExecutableWriterHolder<Stub> stubWriterHolder(pDelegateEEClass->m_pInstRetBuffCallStub, sizeof(Stub));
+            stubWriterHolder.GetRW()->DecRef();
         }
         // While m_pMultiCastInvokeStub is also a member,
         // it is owned by the m_pMulticastStubCache, not by the class