JIT: Assertion failed 'tree->IsCall() || tree->OperIs(GT_COMMA)' during 'Stress gtSplitTree'

[jakobbotsch]

Seen in https://dev.azure.com/dnceng-public/public/_build/results?buildId=207037&view=ms.vss-test-web.build-test-results-tab&runId=3846126&resultId=116663&paneView=dotnet-dnceng.dnceng-build-release-tasks.helix-test-information-tab.

Assert failure(PID 2810 [0x00000afa], Thread: 2810 [0x0afa]): Assertion failed 'tree->IsCall() || tree->OperIs(GT_COMMA)' in 'JIT.HardwareIntrinsics.General._Vector256.VectorWidenTest__WidenInt16:RunReflectionScenario_UnsafeRead():this' during 'Stress gtSplitTree' (IL size 301; hash 0xf9eeacfa; MinOpts)

 File: /__w/1/s/src/coreclr/jit/fgdiagnostic.cpp Line: 3166
 Image: /datadisks/disk1/work/A86B0945/p/corerun

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch, @kunalspathak
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Seen in https://dev.azure.com/dnceng-public/public/_build/results?buildId=207037&view=ms.vss-test-web.build-test-results-tab&runId=3846126&resultId=116663&paneView=dotnet-dnceng.dnceng-build-release-tasks.helix-test-information-tab.

Author:	jakobbotsch
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[jakobbotsch]

This will only happen in CI once we merge #79283 -- it is adding a stress mode that changes the stress decisions made.
The problem is that we have a tree that looks like:

N018 ( 38, 33) [000327] -ACXGO----- arg1 setup ├──▌ COMMA simd32
N011 ( 28, 25) [000328] -ACXGO----- │ ├──▌ COMMA void 
N008 ( 24, 22) [000320] -ACXG---R-- │ │ ├──▌ ASG byref 
N007 ( 3, 2) [000319] D------N--- │ │ │ ├──▌ LCL_VAR byref V50 tmp45 
N006 ( 20, 19) [000126] --CXG------ │ │ │ └──▌ CALL help byref CORINFO_HELP_UNBOX
N004 ( 3, 2) [000124] ----------- arg1 in rsi │ │ │ ├──▌ LCL_VAR ref V02 loc1 
N005 ( 3, 10) [000125] H---------- arg0 in rdi │ │ │ └──▌ CNS_INT(h) long 0x7f6e4bb0e500 class
N010 ( 4, 3) [000322] ---X-O----- │ │ └──▌ NULLCHECK byte 
N009 ( 3, 2) [000321] ----------- │ │ └──▌ LCL_VAR byref V50 tmp45 
N017 ( 10, 8) [000331] -A-XGO--R-- │ └──▌ ASG simd32 (copy)
N016 ( 3, 2) [000330] D------N--- │ ├──▌ LCL_VAR simd32 V51 tmp46 
N015 ( 6, 5) [000329] ---XGO-N--- │ └──▌ IND simd32
N014 ( 4, 3) [000326] -----O-N--- │ └──▌ ADD byref 
N012 ( 3, 2) [000324] -----O----- │ ├──▌ LCL_VAR byref V50 tmp45 
N013 ( 1, 1) [000325] ----------- │ └──▌ CNS_INT long 32

I.e. simd32 typed comma but the "value" is a simd32 assignment. gtSplitTree ends up creating

N016 ( 14, 11) [000428] -A-XGO--R-- └──▌ ASG simd32 (copy)
N015 ( 3, 2) [000427] D------N--- ├──▌ LCL_VAR simd32 V76 tmp71 
N014 ( 10, 8) [000331] -A-XGO-NR-- └──▌ ASG simd32 (copy)
N013 ( 3, 2) [000330] D------N--- ├──▌ LCL_VAR simd32 V51 tmp46 
N012 ( 6, 5) [000329] ---XGO-N--- └──▌ IND simd32
N011 ( 4, 3) [000326] -----O-N--- └──▌ ADD byref 
N009 ( 3, 2) [000324] -----O----- ├──▌ LCL_VAR byref V50 tmp45 
N010 ( 1, 1) [000325] ----------- └──▌ CNS_INT long 32