JIT: Bad codegen - using wrong var for field access

[TIHan]

// Generated by Fuzzlyn v1.5 on 2022-11-14 02:52:08
// Run on Arm64 Windows
// Seed: 11038715273855459808
// Reduced from 96.6 KiB to 0.9 KiB in 00:08:38
// Debug: Outputs 0
// Release: Outputs 1
public struct S0
{
 public sbyte F0;
 public long F2;
}

public struct S1
{
 public S0 F0;
 public byte F1;
 public bool F3;
 public S1(byte f1): this()
 {
 F1 = f1;
 }
}

public class Program
{
 public static IRuntime s_rt;
 public static S1 s_23;
 public static void Main()
 {
 s_rt = new Runtime();
 var vr1 = new S1(1);
 M16(s_23, ref vr1);
 }

 public static void M16(S1 argThis, ref S1 arg0)
 {
 if (s_23.F3)
 {
 arg0.F0 = argThis.F0;
 }
 else
 {
 arg0 = argThis;
 }

 s_rt.WriteLine(arg0.F1);
 }
}

public interface IRuntime
{
 void WriteLine<T>(T value);
}

public class Runtime : IRuntime
{
 public void WriteLine<T>(T value) => System.Console.WriteLine(value);
}

I was able to reproduce this on X64 as well.
Built under Release:

• DOTNET_TieredCompilation=0 prints 1
• DOTNET_TieredCompilation=1 prints 0 <- expected output

I've yet to do a deep dive into the issue, but I think this line, s_rt.WriteLine(arg0.F1); , the arg0 is always using its original value.

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

// Generated by Fuzzlyn v1.5 on 2022-11-14 02:52:08
// Run on Arm64 Windows
// Seed: 11038715273855459808
// Reduced from 96.6 KiB to 0.9 KiB in 00:08:38
// Debug: Outputs 0
// Release: Outputs 1
public struct S0
{
 public sbyte F0;
 public long F2;
}

public struct S1
{
 public S0 F0;
 public byte F1;
 public bool F3;
 public S1(byte f1): this()
 {
 F1 = f1;
 }
}

public class Program
{
 public static IRuntime s_rt;
 public static S1 s_23;
 public static void Main()
 {
 s_rt = new Runtime();
 var vr1 = new S1(1);
 M16(s_23, ref vr1);
 }

 public static void M16(S1 argThis, ref S1 arg0)
 {
 if (s_23.F3)
 {
 arg0.F0 = argThis.F0;
 }
 else
 {
 arg0 = argThis;
 }

 s_rt.WriteLine(arg0.F1);
 }
}

public interface IRuntime
{
 void WriteLine<T>(T value);
}

public class Runtime : IRuntime
{
 public void WriteLine<T>(T value) => System.Console.WriteLine(value);
}

I was able to reproduce this on X64 as well.
Built under Release:

• DOTNET_TieredCompilation=0 prints 1
• DOTNET_TieredCompilation=1 prints 0 <- expected output

I've yet to do a deep dive into the issue, but I think this line, s_rt.WriteLine(arg0.F1); , the arg0 is always using its original value.

Author:	TIHan
Assignees:	-
Labels:	area-CodeGen-coreclr
Milestone:	-

[jakobbotsch]

Bisected to #77103

[jakobbotsch]

*************** Starting PHASE Post-morph tail merge
All preds of BB04 end with the same tree, moving
STMT00006 ( 0x00C[E-] ... 0x013 )
 [000034] -A-XG+----- ▌ ASG struct (copy)
 [000033] ---XG+-N--- ├──▌ BLK struct<S0, 16>
 [000027] -----+----- │ └──▌ LCL_VAR byref V01 arg1 
 [000038] n---G+----- └──▌ OBJ struct<S0, 16>
 [000030] -----+----- └──▌ LCL_VAR byref V00 arg0 

unlinking STMT00006 ( 0x00C[E-] ... 0x013 )
 [000034] -A-XG+----- ▌ ASG struct (copy)
 [000033] ---XG+-N--- ├──▌ BLK struct<S0, 16>
 [000027] -----+----- │ └──▌ LCL_VAR byref V01 arg1 
 [000038] n---G+----- └──▌ OBJ struct<S0, 16>
 [000030] -----+----- └──▌ LCL_VAR byref V00 arg0 
 from BB02

BB02 becomes empty

unlinking STMT00001 ( 0x01A[E-] ... 0x01C )
 [000011] -A-XG+----- ▌ ASG struct (copy)
 [000010] ---XG+-N--- ├──▌ BLK struct<S1, 24>
 [000008] -----+----- │ └──▌ LCL_VAR byref V01 arg1 
 [000039] n---G+----- └──▌ OBJ struct<S1, 24>
 [000009] -----+----- └──▌ LCL_VAR byref V00 arg0 
 from BB03

BB03 becomes empty
Did 1 tail merges in BB04

Looks like we are not checking equality between GT_BLK/GT_OBJ nodes properly.

[jakobbotsch]

I'll submit a fix since Andy is out.