Compiler overwrites wrong memory location in .NET 8 RC1 when using Unsafe.Add and Vector256<uint>[0]

[jwdj]

Description

In a release build with .NET 8 RC1 the compiler overwrites memory it shouldn't touch.

Input is a Span<byte> of pixels with layout RGBA, where every fourth byte is an alpha byte set to 255 (index 3, 7, 11, etc).
The code only overwrites the RGB bytes (indexes 0, 1, 2, 4, 5, 6, 8, etc), but the compiler overwrites 3, 7, 11, etc too (with 0).
This overwrite happens when a ref byte (3 bytes earlier) is overwritten with the first element of a Vector256

Unsafe.Add(ref dst_ptr, 0) = (byte)blurredPixel0[0]; // blurredPixel0 is a Vector256<uint> dst_ptr is ref byte
// byte at dst_ptr + 3 is now overwritten with 0

Below is this line in more context. I have tried to shorten the example code but the bug is very specific and is Vector256 related.

Configuration

• .NET 8.0 RC1
• OS: Windows 10
• Only tested with x64

Regression?

Yes, compared to .NET 7.0

Other information

The following configurations work fine:
dotnet run StackBlur --framework net7.0 --configuration Release
dotnet run StackBlur --framework net7.0 --configuration Debug
dotnet run StackBlur --framework net8.0 --configuration Debug

To reproduce the error (from PowerShell):
$env:DOTNET_JitDisasm = 'StackblurPass'
dotnet run StackBlur --framework net8.0 --configuration Release

Here the project code StackBlur.csproj:

<Project Sdk="Microsoft.NET.Sdk">
 <PropertyGroup>
 <OutputType>Exe</OutputType>
 <TargetFrameworks>net7.0;net8.0</TargetFrameworks>
 <AllowUnsafeBlocks>true</AllowUnsafeBlocks>	
 </PropertyGroup>
</Project>

And the source code Program.cs:
The program is rather long but scroll down to where it is not indented to find the issue.

using System;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Diagnostics;

namespace Application
{
 class Program
 {
 static void Main(string[] args)
 {
 Console.WriteLine(Environment.Version);

 const int Width = 1920;
 const int Height = 1080;
 Span<byte> pixels = new byte[Width * Height * sizeof(uint)];
 for (int i = 3; i < pixels.Length; i += 4)
 {
 pixels[i] = 255; // fill alpha channel
 }
 pixels.Fill(255);

 var area = Vector128.Create(0, 0, 384, 384);
 StackBlur(pixels, Width, Height, Width * sizeof(uint), radius: 100, area);

 for (int i = 3; i < pixels.Length; i += 4)
 {
 if (pixels[i] != 255)
 {
 Console.WriteLine("FAILED");
 return;
 }
 }
 }




 static ushort[] stackblur_mul = new ushort[255]
 {
 512,512,456,512,328,456,335,512,405,328,271,456,388,335,292,512,
 454,405,364,328,298,271,496,456,420,388,360,335,312,292,273,512,
 482,454,428,405,383,364,345,328,312,298,284,271,259,496,475,456,
 437,420,404,388,374,360,347,335,323,312,302,292,282,273,265,512,
 497,482,468,454,441,428,417,405,394,383,373,364,354,345,337,328,
 320,312,305,298,291,284,278,271,265,259,507,496,485,475,465,456,
 446,437,428,420,412,404,396,388,381,374,367,360,354,347,341,335,
 329,323,318,312,307,302,297,292,287,282,278,273,269,265,261,512,
 505,497,489,482,475,468,461,454,447,441,435,428,422,417,411,405,
 399,394,389,383,378,373,368,364,359,354,350,345,341,337,332,328,
 324,320,316,312,309,305,301,298,294,291,287,284,281,278,274,271,
 268,265,262,259,257,507,501,496,491,485,480,475,470,465,460,456,
 451,446,442,437,433,428,424,420,416,412,408,404,400,396,392,388,
 385,381,377,374,370,367,363,360,357,354,350,347,344,341,338,335,
 332,329,326,323,320,318,315,312,310,307,304,302,299,297,294,292,
 289,287,285,282,280,278,275,273,271,269,267,265,263,261,259
 };

 static ushort[] stackblur_shr = new ushort[255]
 {
 9, 11, 12, 13, 13, 14, 14, 15, 15, 15, 15, 16, 16, 16, 16, 17,
 17, 17, 17, 17, 17, 17, 18, 18, 18, 18, 18, 18, 18, 18, 18, 19,
 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 20, 20, 20,
 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 21,
 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21,
 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 22, 22, 22, 22, 22, 22,
 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22,
 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 23,
 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23,
 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23,
 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23,
 23, 23, 23, 23, 23, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24,
 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24,
 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24,
 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24,
 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24
 };


 //[MethodImpl(MethodImplOptions.NoOptimization)] // also 'fixes' the issue
 static void StackblurPass(Span<byte> src, ///< input image data
 int width, ///< image width
 int height, ///< image height
 int rowStride,
 uint radius, ///< blur intensity (should be in 2..254 range)
 bool vertical,
 Vector128<int> area
 )
 {
 uint mul_sum = stackblur_mul[radius];
 int shr_sum = stackblur_shr[radius];

 var areaX = area[0];
 var areaY = area[1];

 var areaWidth = area[2];
 var areaHeight = area[3];

 int strideX = 4;
 int strideY = rowStride;
 int areaMinX = areaX >= 0 ? areaX : 0;
 int areaMinY = areaY >= 0 ? areaY : 0;

 int maxX = width - 1;
 int maxY = height - 1;
 int areaMaxX = areaX + areaWidth - 1;
 int areaMaxY = areaY + areaHeight - 1;
 if (areaMaxX > maxX) areaMaxX = maxX;
 if (areaMaxY > maxY) areaMaxY = maxY;

 areaMaxX -= areaMinX;
 areaMaxY -= areaMinY;

 if (vertical)
 {
 // transpose (swap X and Y)
 (maxX, maxY) = (maxY, maxX);
 (strideX, strideY) = (strideY, strideX);
 (areaMinX, areaMinY) = (areaMinY, areaMinX);
 (areaMaxX, areaMaxY) = (areaMaxY, areaMaxX);
 }

 uint initialSum = (uint)SumNumbers((int)radius + 1);

 ref var sourcePtr = ref src[areaMinX * strideX + areaMinY * strideY];

 if (Avx2.IsSupported && Vector256.IsHardwareAccelerated)
 {
 var idx0 = Vector256.Create(0, 1, 2,
 1 * strideY, 1 * strideY + 1, 1 * strideY + 2,
 2 * strideY, 2 * strideY + 1);
 var idx1 = Vector256.Create(2 * strideY + 2, 3 * strideY, 3 * strideY + 1,
 3 * strideY + 2, 4 * strideY, 4 * strideY + 1,
 4 * strideY + 2, 5 * strideY);
 var idx2 = Vector256.Create(5 * strideY + 1, 5 * strideY + 2, 6 * strideY,
 6 * strideY + 1, 6 * strideY + 2, 7 * strideY,
 7 * strideY + 1, 7 * strideY + 2);
 var lowerByte = Vector256.Create(0xFFU);

 [MethodImpl(MethodImplOptions.AggressiveInlining)]
 unsafe void FillVectorsFromPixels(ref byte src, ref Vector256<uint> data0, ref Vector256<uint> data1, ref Vector256<uint> data2)
 {
 var src_ptr = (uint*)Unsafe.AsPointer(ref src);

 data0 = Avx2.GatherVector256(src_ptr, idx0, 1);
 data1 = Avx2.GatherVector256(src_ptr, idx1, 1);
 data2 = Avx2.GatherVector256(src_ptr, idx2, 1);
 data0 = Avx2.And(data0, lowerByte);
 data1 = Avx2.And(data1, lowerByte);
 data2 = Avx2.And(data2, lowerByte);
 }

 Span<Vector256<uint>> stack0 = stackalloc Vector256<uint>[(int)radius * 2 + 1];
 Span<Vector256<uint>> stack1 = stackalloc Vector256<uint>[(int)radius * 2 + 1];
 Span<Vector256<uint>> stack2 = stackalloc Vector256<uint>[(int)radius * 2 + 1];
 for (int y = 0; y <= areaMaxY; y += 8)
 {
 var sum_in0 = Vector256<uint>.Zero;
 var sum_in1 = Vector256<uint>.Zero;
 var sum_in2 = Vector256<uint>.Zero;

 var data0 = Vector256<uint>.Zero;
 var data1 = Vector256<uint>.Zero;
 var data2 = Vector256<uint>.Zero;

 ref var src_ptr = ref Unsafe.Add(ref sourcePtr, y * strideY); // start of line (0,y)
 FillVectorsFromPixels(ref src_ptr, ref data0, ref data1, ref data2);

 var sum0 = Vector256.Multiply(data0, initialSum);
 var sum1 = Vector256.Multiply(data1, initialSum);
 var sum2 = Vector256.Multiply(data2, initialSum);
 var sum_out0 = Vector256.Multiply(data0, radius + 1);
 var sum_out1 = Vector256.Multiply(data1, radius + 1);
 var sum_out2 = Vector256.Multiply(data2, radius + 1);
 foreach (ref var stack_ptr in stack0.Slice(0, (int)radius + 1))
 {
 stack_ptr = data0;
 }
 foreach (ref var stack_ptr in stack1.Slice(0, (int)radius + 1))
 {
 stack_ptr = data1;
 }
 foreach (ref var stack_ptr in stack2.Slice(0, (int)radius + 1))
 {
 stack_ptr = data2;
 }

 for (int i = 1; i <= radius; i++)
 {
 if (i < areaMaxX)
 {
 src_ptr = ref Unsafe.Add(ref src_ptr, strideX);
 FillVectorsFromPixels(ref src_ptr, ref data0, ref data1, ref data2);
 }
 ref var stack_ptr = ref stack0[(int)(i + radius)];
 stack_ptr = data0;
 stack_ptr = ref stack1[(int)(i + radius)];
 stack_ptr = data1;
 stack_ptr = ref stack2[(int)(i + radius)];
 stack_ptr = data2;

 sum0 += data0 * (uint)(radius + 1 - i);
 sum1 += data1 * (uint)(radius + 1 - i);
 sum2 += data2 * (uint)(radius + 1 - i);
 sum_in0 += data0;
 sum_in1 += data1;
 sum_in2 += data2;
 }

 int sp = (int)radius;
 int xp = (int)radius;
 if (xp > areaMaxX) xp = areaMaxX;

 src_ptr = ref Unsafe.Add(ref sourcePtr, xp * strideX + y * strideY);
 ref var dst_ptr = ref Unsafe.Add(ref sourcePtr, y * strideY);
 for (int x = 0; x <= areaMaxX; x++)
 {
 var blurredPixel0 = Vector256.ShiftRightLogical(Vector256.Multiply(sum0, mul_sum), shr_sum);
 var blurredPixel1 = Vector256.ShiftRightLogical(Vector256.Multiply(sum1, mul_sum), shr_sum);
 var blurredPixel2 = Vector256.ShiftRightLogical(Vector256.Multiply(sum2, mul_sum), shr_sum);

#if NET8_0_OR_GREATER
Console.WriteLine(Unsafe.Add(ref dst_ptr, 3).ToString("X")); // should print FF
#endif

 Unsafe.Add(ref dst_ptr, 0) = (byte)blurredPixel0[0]; // bug, should only write a single byte

#if NET8_0_OR_GREATER
Console.WriteLine(Unsafe.Add(ref dst_ptr, 3).ToString("X")); // should print FF, not 00
#endif

 Unsafe.Add(ref dst_ptr, 1) = (byte)blurredPixel0[1];
 Unsafe.Add(ref dst_ptr, 2) = (byte)blurredPixel0[2];


 Unsafe.Add(ref dst_ptr, 0 + strideY) = (byte)blurredPixel0[3];
 Unsafe.Add(ref dst_ptr, 1 + strideY) = (byte)blurredPixel0[4];
 Unsafe.Add(ref dst_ptr, 2 + strideY) = (byte)blurredPixel0[5];

 Unsafe.Add(ref dst_ptr, 0 + strideY * 2) = (byte)blurredPixel0[6];
 Unsafe.Add(ref dst_ptr, 1 + strideY * 2) = (byte)blurredPixel0[7];
 Unsafe.Add(ref dst_ptr, 2 + strideY * 2) = (byte)blurredPixel1[0];

 Unsafe.Add(ref dst_ptr, 0 + strideY * 3) = (byte)blurredPixel1[1];
 Unsafe.Add(ref dst_ptr, 1 + strideY * 3) = (byte)blurredPixel1[2];
 Unsafe.Add(ref dst_ptr, 2 + strideY * 3) = (byte)blurredPixel1[3];

 Unsafe.Add(ref dst_ptr, 0 + strideY * 4) = (byte)blurredPixel1[4];
 Unsafe.Add(ref dst_ptr, 1 + strideY * 4) = (byte)blurredPixel1[5];
 Unsafe.Add(ref dst_ptr, 2 + strideY * 4) = (byte)blurredPixel1[6];

 Unsafe.Add(ref dst_ptr, 0 + strideY * 5) = (byte)blurredPixel1[7];
 Unsafe.Add(ref dst_ptr, 1 + strideY * 5) = (byte)blurredPixel2[0];
 Unsafe.Add(ref dst_ptr, 2 + strideY * 5) = (byte)blurredPixel2[1];

 Unsafe.Add(ref dst_ptr, 0 + strideY * 6) = (byte)blurredPixel2[2];
 Unsafe.Add(ref dst_ptr, 1 + strideY * 6) = (byte)blurredPixel2[3];
 Unsafe.Add(ref dst_ptr, 2 + strideY * 6) = (byte)blurredPixel2[4];

 Unsafe.Add(ref dst_ptr, 0 + strideY * 7) = (byte)blurredPixel2[5];
 Unsafe.Add(ref dst_ptr, 1 + strideY * 7) = (byte)blurredPixel2[6];
 Unsafe.Add(ref dst_ptr, 2 + strideY * 7) = (byte)blurredPixel2[7];

 dst_ptr = ref Unsafe.Add(ref dst_ptr, strideX);

 sum0 -= sum_out0;
 sum1 -= sum_out1;
 sum2 -= sum_out2;

 int stack_start = sp + (int)radius + 1;
 if (stack_start >= stack0.Length) stack_start -= stack0.Length;

 ref var stack_ptr0 = ref stack0[stack_start];
 sum_out0 -= stack_ptr0;

 ref var stack_ptr1 = ref stack1[stack_start];
 sum_out1 -= stack_ptr1;

 ref var stack_ptr2 = ref stack2[stack_start];
 sum_out2 -= stack_ptr2;

 if (xp < areaMaxX)
 {
 src_ptr = ref Unsafe.Add(ref src_ptr, strideX);
 FillVectorsFromPixels(ref src_ptr, ref data0, ref data1, ref data2);
 ++xp;
 }

 stack_ptr0 = data0;
 sum_in0 += data0;
 sum0 += sum_in0;

 stack_ptr1 = data1;
 sum_in1 += data1;
 sum1 += sum_in1;

 stack_ptr2 = data2;
 sum_in2 += data2;
 sum2 += sum_in2;

 ++sp;
 if (sp >= stack0.Length) sp = 0;
 stack_ptr0 = ref stack0[sp];
 sum_out0 += stack_ptr0;
 sum_in0 -= stack_ptr0;

 stack_ptr1 = ref stack1[sp];
 sum_out1 += stack_ptr1;
 sum_in1 -= stack_ptr1;

 stack_ptr2 = ref stack2[sp];
 sum_out2 += stack_ptr2;
 sum_in2 -= stack_ptr2;
 }
 }
 }
 else
 {
 [MethodImpl(MethodImplOptions.AggressiveInlining)]
 static void FillVectorFromPixel(ref Vector128<uint> data, ref byte src_ptr)
 {
 data = Vector128.Create((uint)src_ptr,
 (uint)Unsafe.Add(ref src_ptr, 1),
 (uint)Unsafe.Add(ref src_ptr, 2),
 (uint)Unsafe.Add(ref src_ptr, 3));
 }

 Span<Vector128<uint>> stack = stackalloc Vector128<uint>[(int)radius * 2 + 1];
 for (int y = 0; y <= areaMaxY; y++)
 {
 var sum_in = Vector128<uint>.Zero;

 ref byte src_ptr = ref Unsafe.Add(ref sourcePtr, y * strideY); // start of line (0,y)

 Vector128<uint> data = Vector128<uint>.Zero;
 FillVectorFromPixel(ref data, ref src_ptr);
 var sum = Vector128.Multiply(data, initialSum);
 var sum_out = Vector128.Multiply(data, radius + 1);
 foreach (ref var stack_ptr in stack.Slice(0, (int)radius + 1))
 {
 stack_ptr = data;
 }

 for (int i = 1; i <= radius; i++)
 {
 if (i < areaMaxX)
 {
 src_ptr = ref Unsafe.Add(ref src_ptr, strideX);
 FillVectorFromPixel(ref data, ref src_ptr);
 }
 ref var stack_ptr = ref stack[(int)(i + radius)];
 stack_ptr = data;

 sum += data * (uint)(radius + 1 - i);
 sum_in += data;
 }

 int sp = (int)radius;
 int xp = (int)radius;
 if (xp > areaMaxX) xp = areaMaxX;
 src_ptr = ref Unsafe.Add(ref sourcePtr, xp * strideX + y * strideY); // img.pix_ptr(xp, y);
 ref byte dst_ptr = ref Unsafe.Add(ref sourcePtr, y * strideY); // img.pix_ptr(0, y);
 for (int x = 0; x <= areaMaxX; x++)
 {
 var blurredPixel = Vector128.ShiftRightLogical(Vector128.Multiply(sum, mul_sum), shr_sum);

 dst_ptr = (byte)blurredPixel[0];
 Unsafe.Add(ref dst_ptr, 1) = (byte)blurredPixel[1];
 Unsafe.Add(ref dst_ptr, 2) = (byte)blurredPixel[2];
 Unsafe.Add(ref dst_ptr, 3) = (byte)blurredPixel[3];
 dst_ptr = ref Unsafe.Add(ref dst_ptr, strideX);

 sum -= sum_out;

 int stack_start = sp + (int)radius + 1;
 if (stack_start >= stack.Length) stack_start -= stack.Length;
 ref var stack_ptr = ref stack[stack_start];

 sum_out -= stack_ptr;

 if (xp < areaMaxX)
 {
 src_ptr = ref Unsafe.Add(ref src_ptr, strideX);
 FillVectorFromPixel(ref data, ref src_ptr);
 ++xp;
 }

 stack_ptr = data;
 sum_in += data;
 sum += sum_in;

 ++sp;
 if (sp >= stack.Length) sp = 0;
 stack_ptr = ref stack[sp];

 sum_out += stack_ptr;
 sum_in -= stack_ptr;
 }
 }
 }
 }

 static int SumNumbers(int n)
 {
 return n * (n + 1) / 2; // fast way of calculating range (0..n).Sum()
 }

 /// Stackblur algorithm by Mario Klingemann
 /// Details here:
 /// http://www.quasimondo.com/StackBlurForCanvas/StackBlurDemo.html
 /// C++ implemenation base from:
 /// https://gist.github.com/benjamin9999/3809142
 /// http://www.antigrain.com/__code/include/agg_blur.h.html
 /// This version works only with RGBA color
 static void StackBlur(Span<byte> src, ///< input image data
 int w, ///< image width
 int h, ///< image height
 int rowStride,
 uint radius ///< blur intensity (should be in 2..254 range)
 )
 {
 var area = Vector128.Create(0, 0, w, h);
 StackBlur(src, w, h, rowStride, radius, area);
 }

 static void StackBlur(Span<byte> src, ///< input image data
 int w, ///< image width
 int h, ///< image height
 int rowStride,
 uint radius, ///< blur intensity (should be in 2..254 range)
 Vector128<int> area
 )
 {
 if (radius > 254) return;
 if (radius < 1) return;

 StackblurPass(src, w, h, rowStride, radius, vertical: false, area);
 StackblurPass(src, w, h, rowStride, radius, vertical: true, area);
 }

 }
}

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

In a release build with .NET 8 RC1 the compiler overwrites memory it shouldn't touch.

Input is a Span<byte> of pixels with layout RGBA, where every fourth byte is an alpha byte set to 255 (index 3, 7, 11, etc).
The code only overwrites the RGB bytes (indexes 0, 1, 2, 4, 5, 6, 8, etc), but the compiler overwrites 3, 7, 11, etc too (with 0).
This overwrite happens when a ref byte (3 bytes earlier) is overwritten with the first element of a Vector256

Unsafe.Add(ref dst_ptr, 0) = (byte)blurredPixel0[0]; // blurredPixel0 is a Vector256<uint> dst_ptr is ref byte
// byte at dst_ptr + 3 is now overwritten with 0

Below is this line in more context. I have tried to shorten the example code but the bug is very specific and is Vector256 related.

Configuration

• .NET 8.0 RC1
• OS: Windows 10
• Only tested with x64

Regression?

Yes, compared to .NET 7.0

Other information

The following configurations work fine:
dotnet run StackBlur --framework net7.0 --configuration Release
dotnet run StackBlur --framework net7.0 --configuration Debug
dotnet run StackBlur --framework net8.0 --configuration Debug

To reproduce the error (from PowerShell):
$env:DOTNET_JitDisasm = 'StackblurPass'
dotnet run StackBlur --framework net8.0 --configuration Release

Here the project code StackBlur.csproj:

<Project Sdk="Microsoft.NET.Sdk">
 <PropertyGroup>
 <OutputType>Exe</OutputType>
 <TargetFrameworks>net7.0;net8.0</TargetFrameworks>
 <AllowUnsafeBlocks>true</AllowUnsafeBlocks>	
 </PropertyGroup>
</Project>

And the source code Program.cs:
The program is rather long but scroll down to where it is not indented to find the issue.

using System;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Diagnostics;

namespace Application
{
 class Program
 {
 static void Main(string[] args)
 {
 Console.WriteLine(Environment.Version);

 const int Width = 1920;
 const int Height = 1080;
 Span<byte> pixels = new byte[Width * Height * sizeof(uint)];
 for (int i = 3; i < pixels.Length; i += 4)
 {
 pixels[i] = 255; // fill alpha channel
 }
 pixels.Fill(255);

 var area = Vector128.Create(0, 0, 384, 384);
 StackBlur(pixels, Width, Height, Width * sizeof(uint), radius: 100, area);

 for (int i = 3; i < pixels.Length; i += 4)
 {
 if (pixels[i] != 255)
 {
 Console.WriteLine("FAILED");
 return;
 }
 }
 }




 static ushort[] stackblur_mul = new ushort[255]
 {
 512,512,456,512,328,456,335,512,405,328,271,456,388,335,292,512,
 454,405,364,328,298,271,496,456,420,388,360,335,312,292,273,512,
 482,454,428,405,383,364,345,328,312,298,284,271,259,496,475,456,
 437,420,404,388,374,360,347,335,323,312,302,292,282,273,265,512,
 497,482,468,454,441,428,417,405,394,383,373,364,354,345,337,328,
 320,312,305,298,291,284,278,271,265,259,507,496,485,475,465,456,
 446,437,428,420,412,404,396,388,381,374,367,360,354,347,341,335,
 329,323,318,312,307,302,297,292,287,282,278,273,269,265,261,512,
 505,497,489,482,475,468,461,454,447,441,435,428,422,417,411,405,
 399,394,389,383,378,373,368,364,359,354,350,345,341,337,332,328,
 324,320,316,312,309,305,301,298,294,291,287,284,281,278,274,271,
 268,265,262,259,257,507,501,496,491,485,480,475,470,465,460,456,
 451,446,442,437,433,428,424,420,416,412,408,404,400,396,392,388,
 385,381,377,374,370,367,363,360,357,354,350,347,344,341,338,335,
 332,329,326,323,320,318,315,312,310,307,304,302,299,297,294,292,
 289,287,285,282,280,278,275,273,271,269,267,265,263,261,259
 };

 static ushort[] stackblur_shr = new ushort[255]
 {
 9, 11, 12, 13, 13, 14, 14, 15, 15, 15, 15, 16, 16, 16, 16, 17,
 17, 17, 17, 17, 17, 17, 18, 18, 18, 18, 18, 18, 18, 18, 18, 19,
 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 19, 20, 20, 20,
 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 20, 21,
 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21,
 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 22, 22, 22, 22, 22, 22,
 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22,
 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 22, 23,
 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23,
 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23,
 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23, 23,
 23, 23, 23, 23, 23, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24,
 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24,
 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24,
 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24,
 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24, 24
 };


 //[MethodImpl(MethodImplOptions.NoOptimization)] // also 'fixes' the issue
 static void StackblurPass(Span<byte> src, ///< input image data
 int width, ///< image width
 int height, ///< image height
 int rowStride,
 uint radius, ///< blur intensity (should be in 2..254 range)
 bool vertical,
 Vector128<int> area
 )
 {
 uint mul_sum = stackblur_mul[radius];
 int shr_sum = stackblur_shr[radius];

 var areaX = area[0];
 var areaY = area[1];

 var areaWidth = area[2];
 var areaHeight = area[3];

 int strideX = 4;
 int strideY = rowStride;
 int areaMinX = areaX >= 0 ? areaX : 0;
 int areaMinY = areaY >= 0 ? areaY : 0;

 int maxX = width - 1;
 int maxY = height - 1;
 int areaMaxX = areaX + areaWidth - 1;
 int areaMaxY = areaY + areaHeight - 1;
 if (areaMaxX > maxX) areaMaxX = maxX;
 if (areaMaxY > maxY) areaMaxY = maxY;

 areaMaxX -= areaMinX;
 areaMaxY -= areaMinY;

 if (vertical)
 {
 // transpose (swap X and Y)
 (maxX, maxY) = (maxY, maxX);
 (strideX, strideY) = (strideY, strideX);
 (areaMinX, areaMinY) = (areaMinY, areaMinX);
 (areaMaxX, areaMaxY) = (areaMaxY, areaMaxX);
 }

 uint initialSum = (uint)SumNumbers((int)radius + 1);

 ref var sourcePtr = ref src[areaMinX * strideX + areaMinY * strideY];

 if (Avx2.IsSupported && Vector256.IsHardwareAccelerated)
 {
 var idx0 = Vector256.Create(0, 1, 2,
 1 * strideY, 1 * strideY + 1, 1 * strideY + 2,
 2 * strideY, 2 * strideY + 1);
 var idx1 = Vector256.Create(2 * strideY + 2, 3 * strideY, 3 * strideY + 1,
 3 * strideY + 2, 4 * strideY, 4 * strideY + 1,
 4 * strideY + 2, 5 * strideY);
 var idx2 = Vector256.Create(5 * strideY + 1, 5 * strideY + 2, 6 * strideY,
 6 * strideY + 1, 6 * strideY + 2, 7 * strideY,
 7 * strideY + 1, 7 * strideY + 2);
 var lowerByte = Vector256.Create(0xFFU);

 [MethodImpl(MethodImplOptions.AggressiveInlining)]
 unsafe void FillVectorsFromPixels(ref byte src, ref Vector256<uint> data0, ref Vector256<uint> data1, ref Vector256<uint> data2)
 {
 var src_ptr = (uint*)Unsafe.AsPointer(ref src);

 data0 = Avx2.GatherVector256(src_ptr, idx0, 1);
 data1 = Avx2.GatherVector256(src_ptr, idx1, 1);
 data2 = Avx2.GatherVector256(src_ptr, idx2, 1);
 data0 = Avx2.And(data0, lowerByte);
 data1 = Avx2.And(data1, lowerByte);
 data2 = Avx2.And(data2, lowerByte);
 }

 Span<Vector256<uint>> stack0 = stackalloc Vector256<uint>[(int)radius * 2 + 1];
 Span<Vector256<uint>> stack1 = stackalloc Vector256<uint>[(int)radius * 2 + 1];
 Span<Vector256<uint>> stack2 = stackalloc Vector256<uint>[(int)radius * 2 + 1];
 for (int y = 0; y <= areaMaxY; y += 8)
 {
 var sum_in0 = Vector256<uint>.Zero;
 var sum_in1 = Vector256<uint>.Zero;
 var sum_in2 = Vector256<uint>.Zero;

 var data0 = Vector256<uint>.Zero;
 var data1 = Vector256<uint>.Zero;
 var data2 = Vector256<uint>.Zero;

 ref var src_ptr = ref Unsafe.Add(ref sourcePtr, y * strideY); // start of line (0,y)
 FillVectorsFromPixels(ref src_ptr, ref data0, ref data1, ref data2);

 var sum0 = Vector256.Multiply(data0, initialSum);
 var sum1 = Vector256.Multiply(data1, initialSum);
 var sum2 = Vector256.Multiply(data2, initialSum);
 var sum_out0 = Vector256.Multiply(data0, radius + 1);
 var sum_out1 = Vector256.Multiply(data1, radius + 1);
 var sum_out2 = Vector256.Multiply(data2, radius + 1);
 foreach (ref var stack_ptr in stack0.Slice(0, (int)radius + 1))
 {
 stack_ptr = data0;
 }
 foreach (ref var stack_ptr in stack1.Slice(0, (int)radius + 1))
 {
 stack_ptr = data1;
 }
 foreach (ref var stack_ptr in stack2.Slice(0, (int)radius + 1))
 {
 stack_ptr = data2;
 }

 for (int i = 1; i <= radius; i++)
 {
 if (i < areaMaxX)
 {
 src_ptr = ref Unsafe.Add(ref src_ptr, strideX);
 FillVectorsFromPixels(ref src_ptr, ref data0, ref data1, ref data2);
 }
 ref var stack_ptr = ref stack0[(int)(i + radius)];
 stack_ptr = data0;
 stack_ptr = ref stack1[(int)(i + radius)];
 stack_ptr = data1;
 stack_ptr = ref stack2[(int)(i + radius)];
 stack_ptr = data2;

 sum0 += data0 * (uint)(radius + 1 - i);
 sum1 += data1 * (uint)(radius + 1 - i);
 sum2 += data2 * (uint)(radius + 1 - i);
 sum_in0 += data0;
 sum_in1 += data1;
 sum_in2 += data2;
 }

 int sp = (int)radius;
 int xp = (int)radius;
 if (xp > areaMaxX) xp = areaMaxX;

 src_ptr = ref Unsafe.Add(ref sourcePtr, xp * strideX + y * strideY);
 ref var dst_ptr = ref Unsafe.Add(ref sourcePtr, y * strideY);
 for (int x = 0; x <= areaMaxX; x++)
 {
 var blurredPixel0 = Vector256.ShiftRightLogical(Vector256.Multiply(sum0, mul_sum), shr_sum);
 var blurredPixel1 = Vector256.ShiftRightLogical(Vector256.Multiply(sum1, mul_sum), shr_sum);
 var blurredPixel2 = Vector256.ShiftRightLogical(Vector256.Multiply(sum2, mul_sum), shr_sum);

#if NET8_0_OR_GREATER
Console.WriteLine(Unsafe.Add(ref dst_ptr, 3).ToString("X")); // should print FF
#endif

 Unsafe.Add(ref dst_ptr, 0) = (byte)blurredPixel0[0]; // bug, should only write a single byte

#if NET8_0_OR_GREATER
Console.WriteLine(Unsafe.Add(ref dst_ptr, 3).ToString("X")); // should print FF, not 00
#endif

 Unsafe.Add(ref dst_ptr, 1) = (byte)blurredPixel0[1];
 Unsafe.Add(ref dst_ptr, 2) = (byte)blurredPixel0[2];


 Unsafe.Add(ref dst_ptr, 0 + strideY) = (byte)blurredPixel0[3];
 Unsafe.Add(ref dst_ptr, 1 + strideY) = (byte)blurredPixel0[4];
 Unsafe.Add(ref dst_ptr, 2 + strideY) = (byte)blurredPixel0[5];

 Unsafe.Add(ref dst_ptr, 0 + strideY * 2) = (byte)blurredPixel0[6];
 Unsafe.Add(ref dst_ptr, 1 + strideY * 2) = (byte)blurredPixel0[7];
 Unsafe.Add(ref dst_ptr, 2 + strideY * 2) = (byte)blurredPixel1[0];

 Unsafe.Add(ref dst_ptr, 0 + strideY * 3) = (byte)blurredPixel1[1];
 Unsafe.Add(ref dst_ptr, 1 + strideY * 3) = (byte)blurredPixel1[2];
 Unsafe.Add(ref dst_ptr, 2 + strideY * 3) = (byte)blurredPixel1[3];

 Unsafe.Add(ref dst_ptr, 0 + strideY * 4) = (byte)blurredPixel1[4];
 Unsafe.Add(ref dst_ptr, 1 + strideY * 4) = (byte)blurredPixel1[5];
 Unsafe.Add(ref dst_ptr, 2 + strideY * 4) = (byte)blurredPixel1[6];

 Unsafe.Add(ref dst_ptr, 0 + strideY * 5) = (byte)blurredPixel1[7];
 Unsafe.Add(ref dst_ptr, 1 + strideY * 5) = (byte)blurredPixel2[0];
 Unsafe.Add(ref dst_ptr, 2 + strideY * 5) = (byte)blurredPixel2[1];

 Unsafe.Add(ref dst_ptr, 0 + strideY * 6) = (byte)blurredPixel2[2];
 Unsafe.Add(ref dst_ptr, 1 + strideY * 6) = (byte)blurredPixel2[3];
 Unsafe.Add(ref dst_ptr, 2 + strideY * 6) = (byte)blurredPixel2[4];

 Unsafe.Add(ref dst_ptr, 0 + strideY * 7) = (byte)blurredPixel2[5];
 Unsafe.Add(ref dst_ptr, 1 + strideY * 7) = (byte)blurredPixel2[6];
 Unsafe.Add(ref dst_ptr, 2 + strideY * 7) = (byte)blurredPixel2[7];

 dst_ptr = ref Unsafe.Add(ref dst_ptr, strideX);

 sum0 -= sum_out0;
 sum1 -= sum_out1;
 sum2 -= sum_out2;

 int stack_start = sp + (int)radius + 1;
 if (stack_start >= stack0.Length) stack_start -= stack0.Length;

 ref var stack_ptr0 = ref stack0[stack_start];
 sum_out0 -= stack_ptr0;

 ref var stack_ptr1 = ref stack1[stack_start];
 sum_out1 -= stack_ptr1;

 ref var stack_ptr2 = ref stack2[stack_start];
 sum_out2 -= stack_ptr2;

 if (xp < areaMaxX)
 {
 src_ptr = ref Unsafe.Add(ref src_ptr, strideX);
 FillVectorsFromPixels(ref src_ptr, ref data0, ref data1, ref data2);
 ++xp;
 }

 stack_ptr0 = data0;
 sum_in0 += data0;
 sum0 += sum_in0;

 stack_ptr1 = data1;
 sum_in1 += data1;
 sum1 += sum_in1;

 stack_ptr2 = data2;
 sum_in2 += data2;
 sum2 += sum_in2;

 ++sp;
 if (sp >= stack0.Length) sp = 0;
 stack_ptr0 = ref stack0[sp];
 sum_out0 += stack_ptr0;
 sum_in0 -= stack_ptr0;

 stack_ptr1 = ref stack1[sp];
 sum_out1 += stack_ptr1;
 sum_in1 -= stack_ptr1;

 stack_ptr2 = ref stack2[sp];
 sum_out2 += stack_ptr2;
 sum_in2 -= stack_ptr2;
 }
 }
 }
 else
 {
 [MethodImpl(MethodImplOptions.AggressiveInlining)]
 static void FillVectorFromPixel(ref Vector128<uint> data, ref byte src_ptr)
 {
 data = Vector128.Create((uint)src_ptr,
 (uint)Unsafe.Add(ref src_ptr, 1),
 (uint)Unsafe.Add(ref src_ptr, 2),
 (uint)Unsafe.Add(ref src_ptr, 3));
 }

 Span<Vector128<uint>> stack = stackalloc Vector128<uint>[(int)radius * 2 + 1];
 for (int y = 0; y <= areaMaxY; y++)
 {
 var sum_in = Vector128<uint>.Zero;

 ref byte src_ptr = ref Unsafe.Add(ref sourcePtr, y * strideY); // start of line (0,y)

 Vector128<uint> data = Vector128<uint>.Zero;
 FillVectorFromPixel(ref data, ref src_ptr);
 var sum = Vector128.Multiply(data, initialSum);
 var sum_out = Vector128.Multiply(data, radius + 1);
 foreach (ref var stack_ptr in stack.Slice(0, (int)radius + 1))
 {
 stack_ptr = data;
 }

 for (int i = 1; i <= radius; i++)
 {
 if (i < areaMaxX)
 {
 src_ptr = ref Unsafe.Add(ref src_ptr, strideX);
 FillVectorFromPixel(ref data, ref src_ptr);
 }
 ref var stack_ptr = ref stack[(int)(i + radius)];
 stack_ptr = data;

 sum += data * (uint)(radius + 1 - i);
 sum_in += data;
 }

 int sp = (int)radius;
 int xp = (int)radius;
 if (xp > areaMaxX) xp = areaMaxX;
 src_ptr = ref Unsafe.Add(ref sourcePtr, xp * strideX + y * strideY); // img.pix_ptr(xp, y);
 ref byte dst_ptr = ref Unsafe.Add(ref sourcePtr, y * strideY); // img.pix_ptr(0, y);
 for (int x = 0; x <= areaMaxX; x++)
 {
 var blurredPixel = Vector128.ShiftRightLogical(Vector128.Multiply(sum, mul_sum), shr_sum);

 dst_ptr = (byte)blurredPixel[0];
 Unsafe.Add(ref dst_ptr, 1) = (byte)blurredPixel[1];
 Unsafe.Add(ref dst_ptr, 2) = (byte)blurredPixel[2];
 Unsafe.Add(ref dst_ptr, 3) = (byte)blurredPixel[3];
 dst_ptr = ref Unsafe.Add(ref dst_ptr, strideX);

 sum -= sum_out;

 int stack_start = sp + (int)radius + 1;
 if (stack_start >= stack.Length) stack_start -= stack.Length;
 ref var stack_ptr = ref stack[stack_start];

 sum_out -= stack_ptr;

 if (xp < areaMaxX)
 {
 src_ptr = ref Unsafe.Add(ref src_ptr, strideX);
 FillVectorFromPixel(ref data, ref src_ptr);
 ++xp;
 }

 stack_ptr = data;
 sum_in += data;
 sum += sum_in;

 ++sp;
 if (sp >= stack.Length) sp = 0;
 stack_ptr = ref stack[sp];

 sum_out += stack_ptr;
 sum_in -= stack_ptr;
 }
 }
 }
 }

 static int SumNumbers(int n)
 {
 return n * (n + 1) / 2; // fast way of calculating range (0..n).Sum()
 }

 /// Stackblur algorithm by Mario Klingemann
 /// Details here:
 /// http://www.quasimondo.com/StackBlurForCanvas/StackBlurDemo.html
 /// C++ implemenation base from:
 /// https://gist.github.com/benjamin9999/3809142
 /// http://www.antigrain.com/__code/include/agg_blur.h.html
 /// This version works only with RGBA color
 static void StackBlur(Span<byte> src, ///< input image data
 int w, ///< image width
 int h, ///< image height
 int rowStride,
 uint radius ///< blur intensity (should be in 2..254 range)
 )
 {
 var area = Vector128.Create(0, 0, w, h);
 StackBlur(src, w, h, rowStride, radius, area);
 }

 static void StackBlur(Span<byte> src, ///< input image data
 int w, ///< image width
 int h, ///< image height
 int rowStride,
 uint radius, ///< blur intensity (should be in 2..254 range)
 Vector128<int> area
 )
 {
 if (radius > 254) return;
 if (radius < 1) return;

 StackblurPass(src, w, h, rowStride, radius, vertical: false, area);
 StackblurPass(src, w, h, rowStride, radius, vertical: true, area);
 }

 }
}

Author:	jwdj
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[jakobbotsch]

Reduced repro:

[MethodImpl(MethodImplOptions.NoInlining)]
private static void Foo(ref byte b, int x, Vector256<uint> sum0, Vector256<uint> mul_sum, int shr_sum)
{
 var v = Vector256.ShiftRightLogical(Vector256.Multiply(sum0, mul_sum), shr_sum);
 Unsafe.Add(ref b, x) = (byte)v[3];
}

codegen:

 vmovups ymm0, ymmword ptr [r8]
 vpmulld ymm0, ymm0, ymmword ptr [r9]
 mov eax, dword ptr [rsp+0x28]
 and eax, 31
 vmovd xmm1, rax
 vpsrld ymm0, ymm0, ymm1
 movsxd rax, edx
 vpextrd dword ptr [rcx+rax], xmm0, 3

Looks like another issue related to buggy containment, cc @tannergooding @dotnet/jit-contrib

@TIHan maybe you want to take this one? Looks like the same issue as #92396 but for Extract.

[JulieLeeMSFT]

@jakobbotsch, I assigned this to you. Pinged you offline.