JIT generates incorrect optimised code in .NET 8 #98748

Closed
Closed
JIT generates incorrect optimised code in .NET 8#98748
Assignees
jakobbotsch
Labels
area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
Milestone
8.0.x

Description

@chris-white-wtw
chris-white-wtw
opened on Feb 21, 2024

Description

After migrating some projects to .NET 8 we observe some behaviour differences in certain methods in release builds, which only occur once those methods have been optimised by the JIT.

Disabling tiered PGO changes the method that fails, but does not fix the problem.

Examining the disassembly suggests a parameter value is being accidentally overwritten.

Reproduction Steps

Note that running using debug configuration does not exhibit the problem.

Expected behavior

Should complete with no output.

Actual behavior

Prints exception (thrown because a range-check fails).

Regression?

The program behaves as expected in .NET 6 (6.0.27) and .NET 7 (7.0.14).

Known Workarounds

No response

Configuration

  • .NET SDK 8.0.201
  • Windows 10 Enterprise, 10.0.19045
  • x64

Originally observed via some test failures in CI, running on Windows Server 2016 v10.0 with .NET SDK 8.0.101.

Other information

I have included a README in the repo (https://github.com/chris-white-wtw/JitIssue) with the information I've found so far.

Essentially, in each of the two variants of the bug (with and without tiered PGO), the disassembly of an optimised method includes a vmovq instruction that prematurely moves r8 to a xmm register that's still holding one of the other parameter values.

Metadata

Metadata

Assignees

Labels

area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
     blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

    Skip to content
    JIT generates incorrect optimised code in .NET 8 #98748
    Closed
    Closed
    JIT generates incorrect optimised code in .NET 8#98748
    Assignees
    jakobbotsch
    Labels
    area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
    Milestone
    8.0.x
    Description
    @chris-white-wtw
    chris-white-wtw
    opened on Feb 21, 2024
    Description
    After migrating some projects to .NET 8 we observe some behaviour differences in certain methods in release builds, which only occur once those methods have been optimised by the JIT.
    Disabling tiered PGO changes the method that fails, but does not fix the problem.
    Examining the disassembly suggests a parameter value is being accidentally overwritten.
    Reproduction Steps
    Note that running using debug configuration does not exhibit the problem.
    Expected behavior
    Should complete with no output.
    Actual behavior
    Prints exception (thrown because a range-check fails).
    Regression?
    The program behaves as expected in .NET 6 (6.0.27) and .NET 7 (7.0.14).
    Known Workarounds
    No response
    Configuration
    • .NET SDK 8.0.201
    • Windows 10 Enterprise, 10.0.19045
    • x64
    Originally observed via some test failures in CI, running on Windows Server 2016 v10.0 with .NET SDK 8.0.101.
    Other information
    I have included a README in the repo (https://github.com/chris-white-wtw/JitIssue) with the information I've found so far.
    Essentially, in each of the two variants of the bug (with and without tiered PGO), the disassembly of an optimised method includes a vmovq instruction that prematurely moves r8 to a xmm register that's still holding one of the other parameter values.
    Metadata
    Metadata
    Assignees
    Labels
    area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
    Type
    No type
    Projects
    No projects
      Milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

      Skip to content
      JIT generates incorrect optimised code in .NET 8 #98748
      Closed
      Closed
      JIT generates incorrect optimised code in .NET 8#98748
      Assignees
      jakobbotsch
      Labels
      area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
      Milestone
      8.0.x
      Description
      @chris-white-wtw
      chris-white-wtw
      opened on Feb 21, 2024
      Description
      After migrating some projects to .NET 8 we observe some behaviour differences in certain methods in release builds, which only occur once those methods have been optimised by the JIT.
      Disabling tiered PGO changes the method that fails, but does not fix the problem.
      Examining the disassembly suggests a parameter value is being accidentally overwritten.
      Reproduction Steps
      Note that running using debug configuration does not exhibit the problem.
      Expected behavior
      Should complete with no output.
      Actual behavior
      Prints exception (thrown because a range-check fails).
      Regression?
      The program behaves as expected in .NET 6 (6.0.27) and .NET 7 (7.0.14).
      Known Workarounds
      No response
      Configuration
      • .NET SDK 8.0.201
      • Windows 10 Enterprise, 10.0.19045
      • x64
      Originally observed via some test failures in CI, running on Windows Server 2016 v10.0 with .NET SDK 8.0.101.
      Other information
      I have included a README in the repo (https://github.com/chris-white-wtw/JitIssue) with the information I've found so far.
      Essentially, in each of the two variants of the bug (with and without tiered PGO), the disassembly of an optimised method includes a vmovq instruction that prematurely moves r8 to a xmm register that's still holding one of the other parameter values.
      Metadata
      Metadata
      Assignees
      Labels
      area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
      Type
      No type
      Projects
      No projects
        Milestone
        Relationships
        None yet
        Development
        No branches or pull requests
        Issue actions
        
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

        Skip to content
        JIT generates incorrect optimised code in .NET 8 #98748
        Closed
        Closed
        JIT generates incorrect optimised code in .NET 8#98748
        Assignees
        jakobbotsch
        Labels
        area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
        Milestone
        8.0.x
        Description
        @chris-white-wtw
        chris-white-wtw
        opened on Feb 21, 2024
        Description
        After migrating some projects to .NET 8 we observe some behaviour differences in certain methods in release builds, which only occur once those methods have been optimised by the JIT.
        Disabling tiered PGO changes the method that fails, but does not fix the problem.
        Examining the disassembly suggests a parameter value is being accidentally overwritten.
        Reproduction Steps
        Note that running using debug configuration does not exhibit the problem.
        Expected behavior
        Should complete with no output.
        Actual behavior
        Prints exception (thrown because a range-check fails).
        Regression?
        The program behaves as expected in .NET 6 (6.0.27) and .NET 7 (7.0.14).
        Known Workarounds
        No response
        Configuration
        • .NET SDK 8.0.201
        • Windows 10 Enterprise, 10.0.19045
        • x64
        Originally observed via some test failures in CI, running on Windows Server 2016 v10.0 with .NET SDK 8.0.101.
        Other information
        I have included a README in the repo (https://github.com/chris-white-wtw/JitIssue) with the information I've found so far.
        Essentially, in each of the two variants of the bug (with and without tiered PGO), the disassembly of an optimised method includes a vmovq instruction that prematurely moves r8 to a xmm register that's still holding one of the other parameter values.
        Metadata
        Metadata
        Assignees
        Labels
        area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
        Type
        No type
        Projects
        No projects
          Milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

          Skip to content
          JIT generates incorrect optimised code in .NET 8 #98748
          Closed
          Closed
          JIT generates incorrect optimised code in .NET 8#98748
          Assignees
          jakobbotsch
          Labels
          area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
          Milestone
          8.0.x
          Description
          @chris-white-wtw
          chris-white-wtw
          opened on Feb 21, 2024
          Description
          After migrating some projects to .NET 8 we observe some behaviour differences in certain methods in release builds, which only occur once those methods have been optimised by the JIT.
          Disabling tiered PGO changes the method that fails, but does not fix the problem.
          Examining the disassembly suggests a parameter value is being accidentally overwritten.
          Reproduction Steps
          Note that running using debug configuration does not exhibit the problem.
          Expected behavior
          Should complete with no output.
          Actual behavior
          Prints exception (thrown because a range-check fails).
          Regression?
          The program behaves as expected in .NET 6 (6.0.27) and .NET 7 (7.0.14).
          Known Workarounds
          No response
          Configuration
          • .NET SDK 8.0.201
          • Windows 10 Enterprise, 10.0.19045
          • x64
          Originally observed via some test failures in CI, running on Windows Server 2016 v10.0 with .NET SDK 8.0.101.
          Other information
          I have included a README in the repo (https://github.com/chris-white-wtw/JitIssue) with the information I've found so far.
          Essentially, in each of the two variants of the bug (with and without tiered PGO), the disassembly of an optimised method includes a vmovq instruction that prematurely moves r8 to a xmm register that's still holding one of the other parameter values.
          Metadata
          Metadata
          Assignees
          Labels
          area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
          Type
          No type
          Projects
          No projects
            Milestone
            Relationships
            None yet
            Development
            No branches or pull requests
            Issue actions
            
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

            Skip to content
            JIT generates incorrect optimised code in .NET 8 #98748
            Closed
            Closed
            JIT generates incorrect optimised code in .NET 8#98748
            Assignees
            jakobbotsch
            Labels
            area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
            Milestone
            8.0.x
            Description
            @chris-white-wtw
            chris-white-wtw
            opened on Feb 21, 2024
            Description
            After migrating some projects to .NET 8 we observe some behaviour differences in certain methods in release builds, which only occur once those methods have been optimised by the JIT.
            Disabling tiered PGO changes the method that fails, but does not fix the problem.
            Examining the disassembly suggests a parameter value is being accidentally overwritten.
            Reproduction Steps
            Note that running using debug configuration does not exhibit the problem.
            Expected behavior
            Should complete with no output.
            Actual behavior
            Prints exception (thrown because a range-check fails).
            Regression?
            The program behaves as expected in .NET 6 (6.0.27) and .NET 7 (7.0.14).
            Known Workarounds
            No response
            Configuration
            • .NET SDK 8.0.201
            • Windows 10 Enterprise, 10.0.19045
            • x64
            Originally observed via some test failures in CI, running on Windows Server 2016 v10.0 with .NET SDK 8.0.101.
            Other information
            I have included a README in the repo (https://github.com/chris-white-wtw/JitIssue) with the information I've found so far.
            Essentially, in each of the two variants of the bug (with and without tiered PGO), the disassembly of an optimised method includes a vmovq instruction that prematurely moves r8 to a xmm register that's still holding one of the other parameter values.
            Metadata
            Metadata
            Assignees
            Labels
            area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
            Type
            No type
            Projects
            No projects
              Milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              JIT generates incorrect optimised code in .NET 8 #98748
              Closed
              Closed
              JIT generates incorrect optimised code in .NET 8#98748
              Assignees
              jakobbotsch
              Labels
              area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
              Milestone
              8.0.x
              Description
              @chris-white-wtw
              chris-white-wtw
              opened on Feb 21, 2024
              Description
              After migrating some projects to .NET 8 we observe some behaviour differences in certain methods in release builds, which only occur once those methods have been optimised by the JIT.
              Disabling tiered PGO changes the method that fails, but does not fix the problem.
              Examining the disassembly suggests a parameter value is being accidentally overwritten.
              Reproduction Steps
              Note that running using debug configuration does not exhibit the problem.
              Expected behavior
              Should complete with no output.
              Actual behavior
              Prints exception (thrown because a range-check fails).
              Regression?
              The program behaves as expected in .NET 6 (6.0.27) and .NET 7 (7.0.14).
              Known Workarounds
              No response
              Configuration
              • .NET SDK 8.0.201
              • Windows 10 Enterprise, 10.0.19045
              • x64
              Originally observed via some test failures in CI, running on Windows Server 2016 v10.0 with .NET SDK 8.0.101.
              Other information
              I have included a README in the repo (https://github.com/chris-white-wtw/JitIssue) with the information I've found so far.
              Essentially, in each of the two variants of the bug (with and without tiered PGO), the disassembly of an optimised method includes a vmovq instruction that prematurely moves r8 to a xmm register that's still holding one of the other parameter values.
              Metadata
              Metadata
              Assignees
              Labels
              area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
              Type
              No type
              Projects
              No projects
                Milestone
                Relationships
                None yet
                Development
                No branches or pull requests
                Issue actions
                
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                Skip to content
                JIT generates incorrect optimised code in .NET 8 #98748
                Closed
                Closed
                JIT generates incorrect optimised code in .NET 8#98748
                Assignees
                jakobbotsch
                Labels
                area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
                Milestone
                8.0.x
                Description
                @chris-white-wtw
                chris-white-wtw
                opened on Feb 21, 2024
                Description
                After migrating some projects to .NET 8 we observe some behaviour differences in certain methods in release builds, which only occur once those methods have been optimised by the JIT.
                Disabling tiered PGO changes the method that fails, but does not fix the problem.
                Examining the disassembly suggests a parameter value is being accidentally overwritten.
                Reproduction Steps
                Note that running using debug configuration does not exhibit the problem.
                Expected behavior
                Should complete with no output.
                Actual behavior
                Prints exception (thrown because a range-check fails).
                Regression?
                The program behaves as expected in .NET 6 (6.0.27) and .NET 7 (7.0.14).
                Known Workarounds
                No response
                Configuration
                • .NET SDK 8.0.201
                • Windows 10 Enterprise, 10.0.19045
                • x64
                Originally observed via some test failures in CI, running on Windows Server 2016 v10.0 with .NET SDK 8.0.101.
                Other information
                I have included a README in the repo (https://github.com/chris-white-wtw/JitIssue) with the information I've found so far.
                Essentially, in each of the two variants of the bug (with and without tiered PGO), the disassembly of an optimised method includes a vmovq instruction that prematurely moves r8 to a xmm register that's still holding one of the other parameter values.
                Metadata
                Metadata
                Assignees
                Labels
                area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
                Type
                No type
                Projects
                No projects
                  Milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions