Fix OverflowException in SecurityIdentifier hash code - #9765
Merged
Martin-Molinero merged 1 commit intoAug 28, 2026
Merged
Conversation
Math.Abs throws OverflowException when its argument is int.MinValue, which the XOR feeding it can produce. Hash codes are not required to be non-negative, and nothing reads the sign of this one, so return the raw value as it did previously. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FL5xQMtSCw5bcPZ3gvkedp
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
SecurityIdentifier.GetHashCode()wraps its hash inMath.Abs:Math.AbsthrowsOverflowException: Negating the minimum value of a twos complement number is invalidwhen its argument isint.MinValue, and the XOR feeding it can land there. Any symbol whose hash happens to hit that value fails to construct:Because .NET randomizes string hashing per process, whether a given symbol trips it varies from run to run, so it surfaces as an intermittent failure on an arbitrary symbol.
This removes the
Math.Absfrom both sites, restoring the previous behaviour.Related Issue
N/A
Motivation and Context
Bug fix. Hash codes carry no requirement to be non-negative —
DictionaryandHashSetmask the sign off internally, and negative values were returned here for years beforeMath.Abswas introduced in #9088.Nothing reads the sign of this value:
_hashCodeis only ever returned fromGetHashCode(), and every consumer folds it into its own hash with* 397 ^or similar. There is no modulo or indexing use of it that lacks auintcast. Since the value already differs between processes, nothing can depend on its stability either.Requires Documentation Change
N/A
How Has This Been Tested?
Existing tests.
Types of changes