Assertion failed 'lclVarType != TYP_UNDEF' during 'Lowering nodeinfo'

[kunalspathak]

// Found by Antigen
using System;
using System.Collections.Generic;
using System.Runtime.CompilerServices;
public class TestClass
{
 public struct S1
 {
 public struct S1_D1_F1
 {
 public ushort ushort_0;
 public bool bool_1;
 public ushort ushort_2;
 }
 }
 public struct S2
 {
 }
 static sbyte s_sbyte_12 = 13;
 static S1.S1_D1_F1 s_s1_s1_d1_f1_18 = new S1.S1_D1_F1();
 static S1 s_s1_19 = new S1();
 S1.S1_D1_F1 s1_s1_d1_f1_35 = new S1.S1_D1_F1();
 public S1.S1_D1_F1 Method49(ref double p_double_1405, ref int p_int_1406, ref sbyte p_sbyte_1407, ref S1.S1_D1_F1 p_s1_s1_d1_f1_1408, S1.S1_D1_F1 p_s1_s1_d1_f1_1409, S1.S1_D1_F1 p_s1_s1_d1_f1_1410, ref sbyte p_sbyte_1411, S1 p_s1_1412, S1.S1_D1_F1 p_s1_s1_d1_f1_1413, out S1.S1_D1_F1 p_s1_s1_d1_f1_1414, ref S2 p_s2_1415, S1 p_s1_1416, ref S1.S1_D1_F1 p_s1_s1_d1_f1_1417, S1.S1_D1_F1 p_s1_s1_d1_f1_1418)
 {
 unchecked
 {
 p_s1_s1_d1_f1_1414 = s1_s1_d1_f1_35;
 return p_s1_s1_d1_f1_1413;
 }
 }
 public void Method0()
 {
 unchecked
 {
 double double_2732 = 1.0714285714285714;
 int int_2734 = 1;
 S1.S1_D1_F1 s1_s1_d1_f1_2742 = new S1.S1_D1_F1();
 S1 s1_2744 = new S1();
 S2 s2_2746 = new S2();
 s1_s1_d1_f1_35 = Method49(ref double_2732, ref int_2734, ref s_sbyte_12, ref s1_s1_d1_f1_2742, s1_s1_d1_f1_35, s1_s1_d1_f1_2742, ref s_sbyte_12, s_s1_19, s1_s1_d1_f1_35, out s1_s1_d1_f1_2742, ref s2_2746, s1_2744, ref s1_s1_d1_f1_2742, s_s1_s1_d1_f1_18);
 return;
 }
 }
 public static void Main(string[] args)
 {
 new TestClass().Method0();
 }
}

/*
--------- Test --------- 

Environment:

set COMPlus_TieredCompilation=0
set COMPlus_JitNoInline=1
set COMPlus_JitDoSsa=0
set COMPlus_AltJitName=clrjit_universal_arm64_x64.dll
set COMPlus_AltJit=Method49

Assert failure(PID 73448 [0x00011ee8], Thread: 84504 [0x14a18]): Assertion failed 'lclVarType != TYP_UNDEF' in 'TestClass:Method49(byref,byref,byref,byref,S1_D1_F1,S1_D1_F1,byref,S1,S1_D1_F1,byref,byref,S1,byref,S1_D1_F1):S1_D1_F1:this' during 'Lowering nodeinfo' (IL size 16)
 File: D:\git\dotnet-runtime\src\coreclr\jit\lower.cpp Line: 3783
 Image: d:\git\dotnet-runtime\artifacts\tests\coreclr\windows.x64.Checked\tests\Core_Root\CoreRun.exe
*/

category:correctness
theme:lower
skill-level:intermediate
cost:small
impact:small

Tagging subscribers to this area: @JulieLeeMSFT
See info in area-owners.md if you want to be subscribed.

Issue Details

---

// Found by Antigen
using System;
using System.Collections.Generic;
using System.Runtime.CompilerServices;
public class TestClass
{
 public struct S1
 {
 public struct S1_D1_F1
 {
 public ushort ushort_0;
 public bool bool_1;
 public ushort ushort_2;
 }
 }
 public struct S2
 {
 }
 static sbyte s_sbyte_12 = 13;
 static S1.S1_D1_F1 s_s1_s1_d1_f1_18 = new S1.S1_D1_F1();
 static S1 s_s1_19 = new S1();
 S1.S1_D1_F1 s1_s1_d1_f1_35 = new S1.S1_D1_F1();
 public S1.S1_D1_F1 Method49(ref double p_double_1405, ref int p_int_1406, ref sbyte p_sbyte_1407, ref S1.S1_D1_F1 p_s1_s1_d1_f1_1408, S1.S1_D1_F1 p_s1_s1_d1_f1_1409, S1.S1_D1_F1 p_s1_s1_d1_f1_1410, ref sbyte p_sbyte_1411, S1 p_s1_1412, S1.S1_D1_F1 p_s1_s1_d1_f1_1413, out S1.S1_D1_F1 p_s1_s1_d1_f1_1414, ref S2 p_s2_1415, S1 p_s1_1416, ref S1.S1_D1_F1 p_s1_s1_d1_f1_1417, S1.S1_D1_F1 p_s1_s1_d1_f1_1418)
 {
 unchecked
 {
 p_s1_s1_d1_f1_1414 = s1_s1_d1_f1_35;
 return p_s1_s1_d1_f1_1413;
 }
 }
 public void Method0()
 {
 unchecked
 {
 double double_2732 = 1.0714285714285714;
 int int_2734 = 1;
 S1.S1_D1_F1 s1_s1_d1_f1_2742 = new S1.S1_D1_F1();
 S1 s1_2744 = new S1();
 S2 s2_2746 = new S2();
 s1_s1_d1_f1_35 = Method49(ref double_2732, ref int_2734, ref s_sbyte_12, ref s1_s1_d1_f1_2742, s1_s1_d1_f1_35, s1_s1_d1_f1_2742, ref s_sbyte_12, s_s1_19, s1_s1_d1_f1_35, out s1_s1_d1_f1_2742, ref s2_2746, s1_2744, ref s1_s1_d1_f1_2742, s_s1_s1_d1_f1_18);
 return;
 }
 }
 public static void Main(string[] args)
 {
 new TestClass().Method0();
 }
}

/*
--------- Test --------- 

Environment:

set COMPlus_TieredCompilation=0
set COMPlus_JitNoInline=1
set COMPlus_JitDoSsa=0
set COMPlus_AltJitName=clrjit_universal_arm64_x64.dll
set COMPlus_AltJit=Method49

Assert failure(PID 73448 [0x00011ee8], Thread: 84504 [0x14a18]): Assertion failed 'lclVarType != TYP_UNDEF' in 'TestClass:Method49(byref,byref,byref,byref,S1_D1_F1,S1_D1_F1,byref,S1,S1_D1_F1,byref,byref,S1,byref,S1_D1_F1):S1_D1_F1:this' during 'Lowering nodeinfo' (IL size 16)
 File: D:\git\dotnet-runtime\src\coreclr\jit\lower.cpp Line: 3783
 Image: d:\git\dotnet-runtime\artifacts\tests\coreclr\windows.x64.Checked\tests\Core_Root\CoreRun.exe
*/

Author:	kunalspathak
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[kunalspathak]

@dotnet/jit-contrib

[jakobbotsch]

lvaSortByRefCount is responsible for marking certain locals as do-not-enregister when we are optimizing, but it runs as part of liveness which does not run when COMPlus_JitDoSsa=0. Because of this we end up in lowering with a 6-byte type that we think we can enregister. Not sure what the best fix is yet, will push it to future for now as this is only in a non-standard JIT configuration.

[AndyAyersMS]

Re-verified this repro against current main (windows.x64.Checked, runtime tree from 2026-06-14). The assert no longer fires; the program returns 0 cleanly.

Tested configurations (all use the clrjit_universal_arm64_x64.dll AltJit on Method49, as in the issue body):

Configuration	Result
as-issue (TieredCompilation=0, JitNoInline=1, JitDoSsa=0)	exit 0
as-issue + JitDoSsa=1	exit 0
as-issue + JitNoInline=0	exit 0
tiered + QuickJitForLoops	exit 0
as-issue + JitStress=2	exit 0
as-issue + JitStressRegs=8	exit 0

The assert text lclVarType != TYP_UNDEF still exists in lower.cpp (now at line 5949, in LowerRetStructLclVar). The original root cause @jakobbotsch identified ("lvaSortByRefCount skipped when JitDoSsa=0 leaves a 6-byte struct local wrongly enregisterable") may have been incidentally fixed by changes to liveness or local-marking. Likely safe to close.

Note

This comment was filed by GitHub Copilot CLI on @AndyAyersMS's machine while sweeping a batch of open Antigen-found issues.

[AndyAyersMS]

Closing per the verification above — no longer reproduces under the configurations tested.

[jakobbotsch]

This was probably fixed by #127932 since now this DNER marking no longer happens in liveness.