Fix HWIntrinsic codegen for elided scalar/vector reinterprets

[tannergooding]

Fixes#131137.

PR #130444 started removing transparent scalar/vector reinterpret HWINTRINSIC nodes (CreateScalarUnsafe, GetLower/GetLower128, ToVector256Unsafe/ToVector512Unsafe) during lowering when the consumer is another HWINTRINSIC. That's correct in general -- the consumer reads the value from a register at its own size -- but two x64 codegen sites keyed their decision off the operand's post-lowering type, which the elision changes. Both now produce wrong code.

---

ConvertToVector128Int* / ConvertToVector256Int* (the reported crash)

These have a vector overload (Vector128<T>) and a pointer overload (T*), both lowering to pmovzx*. Codegen picked between them with varTypeIsSIMD(op1). Once an elided CreateScalarUnsafe leaves the vector overload's operand scalar-typed, that proxy misfires and codegen takes the memory-load path -- reading the scalar value as if it were an address (the reported NullReferenceException; a checked JIT asserts in emitxarch.cpp). Fixed by selecting the overload from the stable node->OperIsMemoryLoad() metadata (aux-type driven), matching the generic table path already used elsewhere in the file.

---

AVX2 gather VSIB index width

A gather selects its VSIB index width (xmm vs ymm) from the index operand's own width (indexOp->TypeIs(TYP_SIMD32)). An elided GetLower/ToVector*Unsafe on the index changes that width, so the wrong VEX.L is encoded and the hardware reads the wrong number of indices (e.g. a vpgatherqd with a GetLower()-narrowed index gathered 4 elements instead of 2 -- a silent wrong result, not visible in the JIT disasm since it always prints the index as xmm). The index width can't be recovered in codegen, so this is fixed in lowering: the reinterpret elision is skipped when the node is a gather's index operand, since that width is load-bearing.

---

I also audited the rest of hwintrinsiccodegenxarch.cpp, the store-containment paths in codegenxarch.cpp, and emitxarch.cpp: every other size/attr decision derives from node metadata (node->TypeGet(), GetSimdSize(), GetSimdBaseType()), and the operandSize >= expectedSize check in IsContainableHWIntrinsicOp prevents a narrowed operand from being contained undersized. These two sites were the only operand-width-driven exceptions.

Added Runtime_131137 covering both fixed paths (Sse41/Avx2 convert-from-scalar and the gather-with-narrowed-index case); it fails without the fix and passes with it.

Note

This PR was authored with the assistance of GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[tannergooding]

@dotnet/jit-contrib, @EgorBo, @dhartglassMSFT

A fix for #131137. I did an audit of the other code paths and found one additional failure that I also added handling for.

[Copilot]

Pull request overview

This PR fixes two x64 RyuJIT HWIntrinsic codegen bugs caused by lowering eliding “transparent” scalar/vector reinterpret nodes, where a couple of codegen decisions incorrectly depended on the post-lowering operand type instead of stable node metadata.

Changes:

• Update xarch lowering to preserve width-changing reinterprets when they are used as the AVX2 gather index operand, preventing VSIB width (xmm vs ymm) from being mis-encoded.
• Update xarch HWIntrinsic codegen to select vector vs pointer overloads for the ConvertToVector{128,256}Int* intrinsics using node->OperIsMemoryLoad() rather than varTypeIsSIMD(op1->TypeGet()).
• Add a JitBlue regression test covering both the convert-from-scalar and gather-with-narrowed-index scenarios.

Show a summary per file

File	Description
src/coreclr/jit/lowerxarch.cpp	Skips elision of GetLower/ToVector*Unsafe-style reinterprets when the user is an AVX2 gather and the node is the index operand, preserving VSIB width selection.
src/coreclr/jit/hwintrinsiccodegenxarch.cpp	Uses OperIsMemoryLoad() (aux-type-driven) to choose the correct convert overload path after reinterpret elision changes operand TypeGet().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.cs	Adds xUnit-based regression coverage for Sse41/Avx2 convert-from-scalar and gather with index.GetLower().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.csproj	Adds the test project for the new JitBlue regression scenario.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 0

[tannergooding]

Fixes#131137.

PR #130444 started removing transparent scalar/vector reinterpret HWINTRINSIC nodes (CreateScalarUnsafe, GetLower/GetLower128, ToVector256Unsafe/ToVector512Unsafe) during lowering when the consumer is another HWINTRINSIC. That's correct in general -- the consumer reads the value from a register at its own size -- but two x64 codegen sites keyed their decision off the operand's post-lowering type, which the elision changes. Both now produce wrong code.

---

ConvertToVector128Int* / ConvertToVector256Int* (the reported crash)

These have a vector overload (Vector128<T>) and a pointer overload (T*), both lowering to pmovzx*. Codegen picked between them with varTypeIsSIMD(op1). Once an elided CreateScalarUnsafe leaves the vector overload's operand scalar-typed, that proxy misfires and codegen takes the memory-load path -- reading the scalar value as if it were an address (the reported NullReferenceException; a checked JIT asserts in emitxarch.cpp). Fixed by selecting the overload from the stable node->OperIsMemoryLoad() metadata (aux-type driven), matching the generic table path already used elsewhere in the file.

---

AVX2 gather VSIB index width

A gather selects its VSIB index width (xmm vs ymm) from the index operand's own width (indexOp->TypeIs(TYP_SIMD32)). An elided GetLower/ToVector*Unsafe on the index changes that width, so the wrong VEX.L is encoded and the hardware reads the wrong number of indices (e.g. a vpgatherqd with a GetLower()-narrowed index gathered 4 elements instead of 2 -- a silent wrong result, not visible in the JIT disasm since it always prints the index as xmm). The index width can't be recovered in codegen, so this is fixed in lowering: the reinterpret elision is skipped when the node is a gather's index operand, since that width is load-bearing.

---

I also audited the rest of hwintrinsiccodegenxarch.cpp, the store-containment paths in codegenxarch.cpp, and emitxarch.cpp: every other size/attr decision derives from node metadata (node->TypeGet(), GetSimdSize(), GetSimdBaseType()), and the operandSize >= expectedSize check in IsContainableHWIntrinsicOp prevents a narrowed operand from being contained undersized. These two sites were the only operand-width-driven exceptions.

Added Runtime_131137 covering both fixed paths (Sse41/Avx2 convert-from-scalar and the gather-with-narrowed-index case); it fails without the fix and passes with it.

Note

This PR was authored with the assistance of GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[tannergooding]

@dotnet/jit-contrib, @EgorBo, @dhartglassMSFT

A fix for #131137. I did an audit of the other code paths and found one additional failure that I also added handling for.

[Copilot]

Pull request overview

This PR fixes two x64 RyuJIT HWIntrinsic codegen bugs caused by lowering eliding “transparent” scalar/vector reinterpret nodes, where a couple of codegen decisions incorrectly depended on the post-lowering operand type instead of stable node metadata.

Changes:

• Update xarch lowering to preserve width-changing reinterprets when they are used as the AVX2 gather index operand, preventing VSIB width (xmm vs ymm) from being mis-encoded.
• Update xarch HWIntrinsic codegen to select vector vs pointer overloads for the ConvertToVector{128,256}Int* intrinsics using node->OperIsMemoryLoad() rather than varTypeIsSIMD(op1->TypeGet()).
• Add a JitBlue regression test covering both the convert-from-scalar and gather-with-narrowed-index scenarios.

Show a summary per file

File	Description
src/coreclr/jit/lowerxarch.cpp	Skips elision of GetLower/ToVector*Unsafe-style reinterprets when the user is an AVX2 gather and the node is the index operand, preserving VSIB width selection.
src/coreclr/jit/hwintrinsiccodegenxarch.cpp	Uses OperIsMemoryLoad() (aux-type-driven) to choose the correct convert overload path after reinterpret elision changes operand TypeGet().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.cs	Adds xUnit-based regression coverage for Sse41/Avx2 convert-from-scalar and gather with index.GetLower().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.csproj	Adds the test project for the new JitBlue regression scenario.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 0

[tannergooding]

Fixes#131137.

PR #130444 started removing transparent scalar/vector reinterpret HWINTRINSIC nodes (CreateScalarUnsafe, GetLower/GetLower128, ToVector256Unsafe/ToVector512Unsafe) during lowering when the consumer is another HWINTRINSIC. That's correct in general -- the consumer reads the value from a register at its own size -- but two x64 codegen sites keyed their decision off the operand's post-lowering type, which the elision changes. Both now produce wrong code.

---

ConvertToVector128Int* / ConvertToVector256Int* (the reported crash)

These have a vector overload (Vector128<T>) and a pointer overload (T*), both lowering to pmovzx*. Codegen picked between them with varTypeIsSIMD(op1). Once an elided CreateScalarUnsafe leaves the vector overload's operand scalar-typed, that proxy misfires and codegen takes the memory-load path -- reading the scalar value as if it were an address (the reported NullReferenceException; a checked JIT asserts in emitxarch.cpp). Fixed by selecting the overload from the stable node->OperIsMemoryLoad() metadata (aux-type driven), matching the generic table path already used elsewhere in the file.

---

AVX2 gather VSIB index width

A gather selects its VSIB index width (xmm vs ymm) from the index operand's own width (indexOp->TypeIs(TYP_SIMD32)). An elided GetLower/ToVector*Unsafe on the index changes that width, so the wrong VEX.L is encoded and the hardware reads the wrong number of indices (e.g. a vpgatherqd with a GetLower()-narrowed index gathered 4 elements instead of 2 -- a silent wrong result, not visible in the JIT disasm since it always prints the index as xmm). The index width can't be recovered in codegen, so this is fixed in lowering: the reinterpret elision is skipped when the node is a gather's index operand, since that width is load-bearing.

---

I also audited the rest of hwintrinsiccodegenxarch.cpp, the store-containment paths in codegenxarch.cpp, and emitxarch.cpp: every other size/attr decision derives from node metadata (node->TypeGet(), GetSimdSize(), GetSimdBaseType()), and the operandSize >= expectedSize check in IsContainableHWIntrinsicOp prevents a narrowed operand from being contained undersized. These two sites were the only operand-width-driven exceptions.

Added Runtime_131137 covering both fixed paths (Sse41/Avx2 convert-from-scalar and the gather-with-narrowed-index case); it fails without the fix and passes with it.

Note

This PR was authored with the assistance of GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[tannergooding]

@dotnet/jit-contrib, @EgorBo, @dhartglassMSFT

A fix for #131137. I did an audit of the other code paths and found one additional failure that I also added handling for.

[Copilot]

Pull request overview

This PR fixes two x64 RyuJIT HWIntrinsic codegen bugs caused by lowering eliding “transparent” scalar/vector reinterpret nodes, where a couple of codegen decisions incorrectly depended on the post-lowering operand type instead of stable node metadata.

Changes:

• Update xarch lowering to preserve width-changing reinterprets when they are used as the AVX2 gather index operand, preventing VSIB width (xmm vs ymm) from being mis-encoded.
• Update xarch HWIntrinsic codegen to select vector vs pointer overloads for the ConvertToVector{128,256}Int* intrinsics using node->OperIsMemoryLoad() rather than varTypeIsSIMD(op1->TypeGet()).
• Add a JitBlue regression test covering both the convert-from-scalar and gather-with-narrowed-index scenarios.

Show a summary per file

File	Description
src/coreclr/jit/lowerxarch.cpp	Skips elision of GetLower/ToVector*Unsafe-style reinterprets when the user is an AVX2 gather and the node is the index operand, preserving VSIB width selection.
src/coreclr/jit/hwintrinsiccodegenxarch.cpp	Uses OperIsMemoryLoad() (aux-type-driven) to choose the correct convert overload path after reinterpret elision changes operand TypeGet().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.cs	Adds xUnit-based regression coverage for Sse41/Avx2 convert-from-scalar and gather with index.GetLower().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.csproj	Adds the test project for the new JitBlue regression scenario.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 0

[tannergooding]

Fixes#131137.

PR #130444 started removing transparent scalar/vector reinterpret HWINTRINSIC nodes (CreateScalarUnsafe, GetLower/GetLower128, ToVector256Unsafe/ToVector512Unsafe) during lowering when the consumer is another HWINTRINSIC. That's correct in general -- the consumer reads the value from a register at its own size -- but two x64 codegen sites keyed their decision off the operand's post-lowering type, which the elision changes. Both now produce wrong code.

---

ConvertToVector128Int* / ConvertToVector256Int* (the reported crash)

These have a vector overload (Vector128<T>) and a pointer overload (T*), both lowering to pmovzx*. Codegen picked between them with varTypeIsSIMD(op1). Once an elided CreateScalarUnsafe leaves the vector overload's operand scalar-typed, that proxy misfires and codegen takes the memory-load path -- reading the scalar value as if it were an address (the reported NullReferenceException; a checked JIT asserts in emitxarch.cpp). Fixed by selecting the overload from the stable node->OperIsMemoryLoad() metadata (aux-type driven), matching the generic table path already used elsewhere in the file.

---

AVX2 gather VSIB index width

A gather selects its VSIB index width (xmm vs ymm) from the index operand's own width (indexOp->TypeIs(TYP_SIMD32)). An elided GetLower/ToVector*Unsafe on the index changes that width, so the wrong VEX.L is encoded and the hardware reads the wrong number of indices (e.g. a vpgatherqd with a GetLower()-narrowed index gathered 4 elements instead of 2 -- a silent wrong result, not visible in the JIT disasm since it always prints the index as xmm). The index width can't be recovered in codegen, so this is fixed in lowering: the reinterpret elision is skipped when the node is a gather's index operand, since that width is load-bearing.

---

I also audited the rest of hwintrinsiccodegenxarch.cpp, the store-containment paths in codegenxarch.cpp, and emitxarch.cpp: every other size/attr decision derives from node metadata (node->TypeGet(), GetSimdSize(), GetSimdBaseType()), and the operandSize >= expectedSize check in IsContainableHWIntrinsicOp prevents a narrowed operand from being contained undersized. These two sites were the only operand-width-driven exceptions.

Added Runtime_131137 covering both fixed paths (Sse41/Avx2 convert-from-scalar and the gather-with-narrowed-index case); it fails without the fix and passes with it.

Note

This PR was authored with the assistance of GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[tannergooding]

@dotnet/jit-contrib, @EgorBo, @dhartglassMSFT

A fix for #131137. I did an audit of the other code paths and found one additional failure that I also added handling for.

[Copilot]

Pull request overview

This PR fixes two x64 RyuJIT HWIntrinsic codegen bugs caused by lowering eliding “transparent” scalar/vector reinterpret nodes, where a couple of codegen decisions incorrectly depended on the post-lowering operand type instead of stable node metadata.

Changes:

• Update xarch lowering to preserve width-changing reinterprets when they are used as the AVX2 gather index operand, preventing VSIB width (xmm vs ymm) from being mis-encoded.
• Update xarch HWIntrinsic codegen to select vector vs pointer overloads for the ConvertToVector{128,256}Int* intrinsics using node->OperIsMemoryLoad() rather than varTypeIsSIMD(op1->TypeGet()).
• Add a JitBlue regression test covering both the convert-from-scalar and gather-with-narrowed-index scenarios.

Show a summary per file

File	Description
src/coreclr/jit/lowerxarch.cpp	Skips elision of GetLower/ToVector*Unsafe-style reinterprets when the user is an AVX2 gather and the node is the index operand, preserving VSIB width selection.
src/coreclr/jit/hwintrinsiccodegenxarch.cpp	Uses OperIsMemoryLoad() (aux-type-driven) to choose the correct convert overload path after reinterpret elision changes operand TypeGet().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.cs	Adds xUnit-based regression coverage for Sse41/Avx2 convert-from-scalar and gather with index.GetLower().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.csproj	Adds the test project for the new JitBlue regression scenario.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 0

[tannergooding]

Fixes#131137.

PR #130444 started removing transparent scalar/vector reinterpret HWINTRINSIC nodes (CreateScalarUnsafe, GetLower/GetLower128, ToVector256Unsafe/ToVector512Unsafe) during lowering when the consumer is another HWINTRINSIC. That's correct in general -- the consumer reads the value from a register at its own size -- but two x64 codegen sites keyed their decision off the operand's post-lowering type, which the elision changes. Both now produce wrong code.

---

ConvertToVector128Int* / ConvertToVector256Int* (the reported crash)

These have a vector overload (Vector128<T>) and a pointer overload (T*), both lowering to pmovzx*. Codegen picked between them with varTypeIsSIMD(op1). Once an elided CreateScalarUnsafe leaves the vector overload's operand scalar-typed, that proxy misfires and codegen takes the memory-load path -- reading the scalar value as if it were an address (the reported NullReferenceException; a checked JIT asserts in emitxarch.cpp). Fixed by selecting the overload from the stable node->OperIsMemoryLoad() metadata (aux-type driven), matching the generic table path already used elsewhere in the file.

---

AVX2 gather VSIB index width

A gather selects its VSIB index width (xmm vs ymm) from the index operand's own width (indexOp->TypeIs(TYP_SIMD32)). An elided GetLower/ToVector*Unsafe on the index changes that width, so the wrong VEX.L is encoded and the hardware reads the wrong number of indices (e.g. a vpgatherqd with a GetLower()-narrowed index gathered 4 elements instead of 2 -- a silent wrong result, not visible in the JIT disasm since it always prints the index as xmm). The index width can't be recovered in codegen, so this is fixed in lowering: the reinterpret elision is skipped when the node is a gather's index operand, since that width is load-bearing.

---

I also audited the rest of hwintrinsiccodegenxarch.cpp, the store-containment paths in codegenxarch.cpp, and emitxarch.cpp: every other size/attr decision derives from node metadata (node->TypeGet(), GetSimdSize(), GetSimdBaseType()), and the operandSize >= expectedSize check in IsContainableHWIntrinsicOp prevents a narrowed operand from being contained undersized. These two sites were the only operand-width-driven exceptions.

Added Runtime_131137 covering both fixed paths (Sse41/Avx2 convert-from-scalar and the gather-with-narrowed-index case); it fails without the fix and passes with it.

Note

This PR was authored with the assistance of GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[tannergooding]

@dotnet/jit-contrib, @EgorBo, @dhartglassMSFT

A fix for #131137. I did an audit of the other code paths and found one additional failure that I also added handling for.

[Copilot]

Pull request overview

This PR fixes two x64 RyuJIT HWIntrinsic codegen bugs caused by lowering eliding “transparent” scalar/vector reinterpret nodes, where a couple of codegen decisions incorrectly depended on the post-lowering operand type instead of stable node metadata.

Changes:

• Update xarch lowering to preserve width-changing reinterprets when they are used as the AVX2 gather index operand, preventing VSIB width (xmm vs ymm) from being mis-encoded.
• Update xarch HWIntrinsic codegen to select vector vs pointer overloads for the ConvertToVector{128,256}Int* intrinsics using node->OperIsMemoryLoad() rather than varTypeIsSIMD(op1->TypeGet()).
• Add a JitBlue regression test covering both the convert-from-scalar and gather-with-narrowed-index scenarios.

Show a summary per file

File	Description
src/coreclr/jit/lowerxarch.cpp	Skips elision of GetLower/ToVector*Unsafe-style reinterprets when the user is an AVX2 gather and the node is the index operand, preserving VSIB width selection.
src/coreclr/jit/hwintrinsiccodegenxarch.cpp	Uses OperIsMemoryLoad() (aux-type-driven) to choose the correct convert overload path after reinterpret elision changes operand TypeGet().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.cs	Adds xUnit-based regression coverage for Sse41/Avx2 convert-from-scalar and gather with index.GetLower().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.csproj	Adds the test project for the new JitBlue regression scenario.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 0

[tannergooding]

Fixes#131137.

PR #130444 started removing transparent scalar/vector reinterpret HWINTRINSIC nodes (CreateScalarUnsafe, GetLower/GetLower128, ToVector256Unsafe/ToVector512Unsafe) during lowering when the consumer is another HWINTRINSIC. That's correct in general -- the consumer reads the value from a register at its own size -- but two x64 codegen sites keyed their decision off the operand's post-lowering type, which the elision changes. Both now produce wrong code.

---

ConvertToVector128Int* / ConvertToVector256Int* (the reported crash)

These have a vector overload (Vector128<T>) and a pointer overload (T*), both lowering to pmovzx*. Codegen picked between them with varTypeIsSIMD(op1). Once an elided CreateScalarUnsafe leaves the vector overload's operand scalar-typed, that proxy misfires and codegen takes the memory-load path -- reading the scalar value as if it were an address (the reported NullReferenceException; a checked JIT asserts in emitxarch.cpp). Fixed by selecting the overload from the stable node->OperIsMemoryLoad() metadata (aux-type driven), matching the generic table path already used elsewhere in the file.

---

AVX2 gather VSIB index width

A gather selects its VSIB index width (xmm vs ymm) from the index operand's own width (indexOp->TypeIs(TYP_SIMD32)). An elided GetLower/ToVector*Unsafe on the index changes that width, so the wrong VEX.L is encoded and the hardware reads the wrong number of indices (e.g. a vpgatherqd with a GetLower()-narrowed index gathered 4 elements instead of 2 -- a silent wrong result, not visible in the JIT disasm since it always prints the index as xmm). The index width can't be recovered in codegen, so this is fixed in lowering: the reinterpret elision is skipped when the node is a gather's index operand, since that width is load-bearing.

---

I also audited the rest of hwintrinsiccodegenxarch.cpp, the store-containment paths in codegenxarch.cpp, and emitxarch.cpp: every other size/attr decision derives from node metadata (node->TypeGet(), GetSimdSize(), GetSimdBaseType()), and the operandSize >= expectedSize check in IsContainableHWIntrinsicOp prevents a narrowed operand from being contained undersized. These two sites were the only operand-width-driven exceptions.

Added Runtime_131137 covering both fixed paths (Sse41/Avx2 convert-from-scalar and the gather-with-narrowed-index case); it fails without the fix and passes with it.

Note

This PR was authored with the assistance of GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[tannergooding]

@dotnet/jit-contrib, @EgorBo, @dhartglassMSFT

A fix for #131137. I did an audit of the other code paths and found one additional failure that I also added handling for.

[Copilot]

Pull request overview

This PR fixes two x64 RyuJIT HWIntrinsic codegen bugs caused by lowering eliding “transparent” scalar/vector reinterpret nodes, where a couple of codegen decisions incorrectly depended on the post-lowering operand type instead of stable node metadata.

Changes:

• Update xarch lowering to preserve width-changing reinterprets when they are used as the AVX2 gather index operand, preventing VSIB width (xmm vs ymm) from being mis-encoded.
• Update xarch HWIntrinsic codegen to select vector vs pointer overloads for the ConvertToVector{128,256}Int* intrinsics using node->OperIsMemoryLoad() rather than varTypeIsSIMD(op1->TypeGet()).
• Add a JitBlue regression test covering both the convert-from-scalar and gather-with-narrowed-index scenarios.

Show a summary per file

File	Description
src/coreclr/jit/lowerxarch.cpp	Skips elision of GetLower/ToVector*Unsafe-style reinterprets when the user is an AVX2 gather and the node is the index operand, preserving VSIB width selection.
src/coreclr/jit/hwintrinsiccodegenxarch.cpp	Uses OperIsMemoryLoad() (aux-type-driven) to choose the correct convert overload path after reinterpret elision changes operand TypeGet().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.cs	Adds xUnit-based regression coverage for Sse41/Avx2 convert-from-scalar and gather with index.GetLower().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.csproj	Adds the test project for the new JitBlue regression scenario.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 0

[tannergooding]

Fixes#131137.

PR #130444 started removing transparent scalar/vector reinterpret HWINTRINSIC nodes (CreateScalarUnsafe, GetLower/GetLower128, ToVector256Unsafe/ToVector512Unsafe) during lowering when the consumer is another HWINTRINSIC. That's correct in general -- the consumer reads the value from a register at its own size -- but two x64 codegen sites keyed their decision off the operand's post-lowering type, which the elision changes. Both now produce wrong code.

---

ConvertToVector128Int* / ConvertToVector256Int* (the reported crash)

These have a vector overload (Vector128<T>) and a pointer overload (T*), both lowering to pmovzx*. Codegen picked between them with varTypeIsSIMD(op1). Once an elided CreateScalarUnsafe leaves the vector overload's operand scalar-typed, that proxy misfires and codegen takes the memory-load path -- reading the scalar value as if it were an address (the reported NullReferenceException; a checked JIT asserts in emitxarch.cpp). Fixed by selecting the overload from the stable node->OperIsMemoryLoad() metadata (aux-type driven), matching the generic table path already used elsewhere in the file.

---

AVX2 gather VSIB index width

A gather selects its VSIB index width (xmm vs ymm) from the index operand's own width (indexOp->TypeIs(TYP_SIMD32)). An elided GetLower/ToVector*Unsafe on the index changes that width, so the wrong VEX.L is encoded and the hardware reads the wrong number of indices (e.g. a vpgatherqd with a GetLower()-narrowed index gathered 4 elements instead of 2 -- a silent wrong result, not visible in the JIT disasm since it always prints the index as xmm). The index width can't be recovered in codegen, so this is fixed in lowering: the reinterpret elision is skipped when the node is a gather's index operand, since that width is load-bearing.

---

I also audited the rest of hwintrinsiccodegenxarch.cpp, the store-containment paths in codegenxarch.cpp, and emitxarch.cpp: every other size/attr decision derives from node metadata (node->TypeGet(), GetSimdSize(), GetSimdBaseType()), and the operandSize >= expectedSize check in IsContainableHWIntrinsicOp prevents a narrowed operand from being contained undersized. These two sites were the only operand-width-driven exceptions.

Added Runtime_131137 covering both fixed paths (Sse41/Avx2 convert-from-scalar and the gather-with-narrowed-index case); it fails without the fix and passes with it.

Note

This PR was authored with the assistance of GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[tannergooding]

@dotnet/jit-contrib, @EgorBo, @dhartglassMSFT

A fix for #131137. I did an audit of the other code paths and found one additional failure that I also added handling for.

[Copilot]

Pull request overview

This PR fixes two x64 RyuJIT HWIntrinsic codegen bugs caused by lowering eliding “transparent” scalar/vector reinterpret nodes, where a couple of codegen decisions incorrectly depended on the post-lowering operand type instead of stable node metadata.

Changes:

• Update xarch lowering to preserve width-changing reinterprets when they are used as the AVX2 gather index operand, preventing VSIB width (xmm vs ymm) from being mis-encoded.
• Update xarch HWIntrinsic codegen to select vector vs pointer overloads for the ConvertToVector{128,256}Int* intrinsics using node->OperIsMemoryLoad() rather than varTypeIsSIMD(op1->TypeGet()).
• Add a JitBlue regression test covering both the convert-from-scalar and gather-with-narrowed-index scenarios.

Show a summary per file

File	Description
src/coreclr/jit/lowerxarch.cpp	Skips elision of GetLower/ToVector*Unsafe-style reinterprets when the user is an AVX2 gather and the node is the index operand, preserving VSIB width selection.
src/coreclr/jit/hwintrinsiccodegenxarch.cpp	Uses OperIsMemoryLoad() (aux-type-driven) to choose the correct convert overload path after reinterpret elision changes operand TypeGet().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.cs	Adds xUnit-based regression coverage for Sse41/Avx2 convert-from-scalar and gather with index.GetLower().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.csproj	Adds the test project for the new JitBlue regression scenario.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 0

[tannergooding]

Fixes#131137.

PR #130444 started removing transparent scalar/vector reinterpret HWINTRINSIC nodes (CreateScalarUnsafe, GetLower/GetLower128, ToVector256Unsafe/ToVector512Unsafe) during lowering when the consumer is another HWINTRINSIC. That's correct in general -- the consumer reads the value from a register at its own size -- but two x64 codegen sites keyed their decision off the operand's post-lowering type, which the elision changes. Both now produce wrong code.

---

ConvertToVector128Int* / ConvertToVector256Int* (the reported crash)

These have a vector overload (Vector128<T>) and a pointer overload (T*), both lowering to pmovzx*. Codegen picked between them with varTypeIsSIMD(op1). Once an elided CreateScalarUnsafe leaves the vector overload's operand scalar-typed, that proxy misfires and codegen takes the memory-load path -- reading the scalar value as if it were an address (the reported NullReferenceException; a checked JIT asserts in emitxarch.cpp). Fixed by selecting the overload from the stable node->OperIsMemoryLoad() metadata (aux-type driven), matching the generic table path already used elsewhere in the file.

---

AVX2 gather VSIB index width

A gather selects its VSIB index width (xmm vs ymm) from the index operand's own width (indexOp->TypeIs(TYP_SIMD32)). An elided GetLower/ToVector*Unsafe on the index changes that width, so the wrong VEX.L is encoded and the hardware reads the wrong number of indices (e.g. a vpgatherqd with a GetLower()-narrowed index gathered 4 elements instead of 2 -- a silent wrong result, not visible in the JIT disasm since it always prints the index as xmm). The index width can't be recovered in codegen, so this is fixed in lowering: the reinterpret elision is skipped when the node is a gather's index operand, since that width is load-bearing.

---

I also audited the rest of hwintrinsiccodegenxarch.cpp, the store-containment paths in codegenxarch.cpp, and emitxarch.cpp: every other size/attr decision derives from node metadata (node->TypeGet(), GetSimdSize(), GetSimdBaseType()), and the operandSize >= expectedSize check in IsContainableHWIntrinsicOp prevents a narrowed operand from being contained undersized. These two sites were the only operand-width-driven exceptions.

Added Runtime_131137 covering both fixed paths (Sse41/Avx2 convert-from-scalar and the gather-with-narrowed-index case); it fails without the fix and passes with it.

Note

This PR was authored with the assistance of GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[tannergooding]

@dotnet/jit-contrib, @EgorBo, @dhartglassMSFT

A fix for #131137. I did an audit of the other code paths and found one additional failure that I also added handling for.

[Copilot]

Pull request overview

This PR fixes two x64 RyuJIT HWIntrinsic codegen bugs caused by lowering eliding “transparent” scalar/vector reinterpret nodes, where a couple of codegen decisions incorrectly depended on the post-lowering operand type instead of stable node metadata.

Changes:

• Update xarch lowering to preserve width-changing reinterprets when they are used as the AVX2 gather index operand, preventing VSIB width (xmm vs ymm) from being mis-encoded.
• Update xarch HWIntrinsic codegen to select vector vs pointer overloads for the ConvertToVector{128,256}Int* intrinsics using node->OperIsMemoryLoad() rather than varTypeIsSIMD(op1->TypeGet()).
• Add a JitBlue regression test covering both the convert-from-scalar and gather-with-narrowed-index scenarios.

Show a summary per file

File	Description
src/coreclr/jit/lowerxarch.cpp	Skips elision of GetLower/ToVector*Unsafe-style reinterprets when the user is an AVX2 gather and the node is the index operand, preserving VSIB width selection.
src/coreclr/jit/hwintrinsiccodegenxarch.cpp	Uses OperIsMemoryLoad() (aux-type-driven) to choose the correct convert overload path after reinterpret elision changes operand TypeGet().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.cs	Adds xUnit-based regression coverage for Sse41/Avx2 convert-from-scalar and gather with index.GetLower().
src/tests/JIT/Regression/JitBlue/Runtime_131137/Runtime_131137.csproj	Adds the test project for the new JitBlue regression scenario.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 0