Assertion failed 'store->TypeGet() == src->TypeGet()' during 'Optimize Valnum CSEs'

[kunalspathak]

// Found by Antigen

using System;
using System.Collections.Generic;
using System.Runtime.CompilerServices;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;
using System.Numerics;
public class TestClass
{
 static Vector128<ulong> s_v128_ulong_28 = Vector128.CreateScalar((ulong)0);
 static Vector3 s_v3_42 = new Vector3(-4.9651165f, -2.1474836E+09f, 1.0375f);
 int int_54 = 1;
 Vector128<ulong> v128_ulong_69 = Vector128<ulong>.AllBitsSet;
 Vector3 v3_83 = new Vector3(-0.84615386f, 1.0566038f, -4.9693875f);
 static int s_loopInvariant = 9;
 public void Method0()
 {
 unchecked
 {
 try
 {
 if (Vector128.LessThanAny(v128_ulong_69 ^ s_v128_ulong_28| (v128_ulong_69 += v128_ulong_69), v128_ulong_69 & Vector128<ulong>.AllBitsSet& v128_ulong_69))
 {
 }
 else
 {
 int __loopvar0 = s_loopInvariant;
 while (15!=4)
 {
 if (__loopvar0 >= 15+4)
 break;
 }
 switch (int_54)
 {
 case 0:
 {
 Vector3.Subtract(Vector3.Cross(s_v3_42, s_v3_42) + v3_83 - v3_83+ s_v3_42 * s_v3_42+ v3_83, s_v3_42 = v3_83 - s_v3_42- s_v3_42 - s_v3_42+ Vector3.Clamp(v3_83, v3_83, Vector3.UnitY));
 break;
 }
 default:
 {
 break;
 }
 }
 }
 }
 finally
 {
 }
 return;
 }
 }
 public static void Main(string[] args)
 {
 new TestClass().Method0();
 }
}
/*
Environment:


Assert failure(PID 43728 [0x0000aad0], Thread: 32844 [0x804c]): Assertion failed 'store->TypeGet() == src->TypeGet()' in 'TestClass:Method0():this' during 'Optimize Valnum CSEs' (IL size 250; hash 0x46e9aa75; Tier0-FullOpts)
 File: D:\git\runtime\src\coreclr\jit\importer.cpp Line: 785
 Image: D:\git\runtime\artifacts\tests\coreclr\windows.x86.checked\tests\Core_Root\CoreRun.exe
*/

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

// Found by Antigen

using System;
using System.Collections.Generic;
using System.Runtime.CompilerServices;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;
using System.Numerics;
public class TestClass
{
 static Vector128<ulong> s_v128_ulong_28 = Vector128.CreateScalar((ulong)0);
 static Vector3 s_v3_42 = new Vector3(-4.9651165f, -2.1474836E+09f, 1.0375f);
 int int_54 = 1;
 Vector128<ulong> v128_ulong_69 = Vector128<ulong>.AllBitsSet;
 Vector3 v3_83 = new Vector3(-0.84615386f, 1.0566038f, -4.9693875f);
 static int s_loopInvariant = 9;
 public void Method0()
 {
 unchecked
 {
 try
 {
 if (Vector128.LessThanAny(v128_ulong_69 ^ s_v128_ulong_28| (v128_ulong_69 += v128_ulong_69), v128_ulong_69 & Vector128<ulong>.AllBitsSet& v128_ulong_69))
 {
 }
 else
 {
 int __loopvar0 = s_loopInvariant;
 while (15!=4)
 {
 if (__loopvar0 >= 15+4)
 break;
 }
 switch (int_54)
 {
 case 0:
 {
 Vector3.Subtract(Vector3.Cross(s_v3_42, s_v3_42) + v3_83 - v3_83+ s_v3_42 * s_v3_42+ v3_83, s_v3_42 = v3_83 - s_v3_42- s_v3_42 - s_v3_42+ Vector3.Clamp(v3_83, v3_83, Vector3.UnitY));
 break;
 }
 default:
 {
 break;
 }
 }
 }
 }
 finally
 {
 }
 return;
 }
 }
 public static void Main(string[] args)
 {
 new TestClass().Method0();
 }
}
/*
Environment:


Assert failure(PID 43728 [0x0000aad0], Thread: 32844 [0x804c]): Assertion failed 'store->TypeGet() == src->TypeGet()' in 'TestClass:Method0():this' during 'Optimize Valnum CSEs' (IL size 250; hash 0x46e9aa75; Tier0-FullOpts)
 File: D:\git\runtime\src\coreclr\jit\importer.cpp Line: 785
 Image: D:\git\runtime\artifacts\tests\coreclr\windows.x86.checked\tests\Core_Root\CoreRun.exe
*/

Author:	kunalspathak
Assignees:	-
Labels:	arch-x86, os-windows, area-CodeGen-coreclr
Milestone:	-

[JulieLeeMSFT]

@jakobbotsch, PTAL.

[EgorBo]

Reduced repro:

public class TestClass
{
 static Vector3 s;

 [MethodImpl(MethodImplOptions.NoInlining)]
 public void Method0()
 {
 Vector3.Cross(s, s);
 }

 public static void Main(string[] args)
 {
 new TestClass().Method0();
 }
}

Presumably the assert happens when we optimize IND<simd> into IND<byte> (nullcheck) under COMMA

[jakobbotsch]

The real problem is that inlining (impStoreStruct more precisely) produces non-value but typed commas, e.g. it changes

 [000006] --CXG------ ▌ COMMA simd12
 [000005] H-CXG------ ├──▌ CALL help int CORINFO_HELP_GETSHARED_NONGCSTATIC_BASE
 [000003] ----------- arg0 │ ├──▌ CNS_INT int 0x8A2B390
 [000004] ----------- arg1 │ └──▌ CNS_INT int 1
 [000001] I---G------ └──▌ IND simd12
 [000000] H---------- └──▌ CNS_INT(h) int 0x8601620 static Fseq[s]

to

 [000006] -ACXG------ ▌ COMMA simd12
 [000005] H-CXG------ ├──▌ CALL help int CORINFO_HELP_GETSHARED_NONGCSTATIC_BASE
 [000003] ----------- arg0 │ ├──▌ CNS_INT int 0x8A2B390
 [000004] ----------- arg1 │ └──▌ CNS_INT int 1
 [000087] DA--G------ └──▌ STORE_LCL_VAR simd12<System.Numerics.Vector3> V02 tmp1 
 [000001] I---G------ └──▌ IND simd12
 [000000] H---------- └──▌ CNS_INT(h) int 0x8601620 static Fseq[s]

where we usually would expect [000006] to be TYP_VOID (which is e.g. what gtExtractSideEffList produces).

I've tried fixing this once but I ran into a bunch of issues (first one being that few places expect the "value" node passed to gtNewTempStore to be retyped). It's possible it is easier to fix today by not sinking stores below COMMAs anymore, which is probably not necessary anymore after #83590. But for .NET 8 I will try to see if there's something more surgical.