JIT: Mark GT_LCLHEAP with GTF_CALL and GTF_GLOB_REF

[EgorBo]

Fixes#132243.

GT_LCLHEAP stopped carrying any effect flags in #125362, so if-conversion started converting the conditional localloc in the interop string marshalling stubs into an unconditional one feeding a SELECT:

imuledi, dword ptr [SystemMaxDBCSCharSize] ; bufSize (~11MB for a 5.5MB string)... ; probe + rsp adjust: stack overflow herecmpedi,261 ; check happens after the damagecmovg r8, qword ptr [rbp+0x38] ; only discards the pointer

The guarding branch is what bounds the allocation size, so the localloc must not be reordered with, or made to execute under a different condition than, the surrounding code. This marks GT_LCLHEAP with GTF_CALL | GTF_GLOB_REF, the same way GT_KEEPALIVE is handled, and adds it to OperRequiresCallFlag/OperRequiresGlobRefFlag so the flags are not scrubbed by gtUpdateNodeOperSideEffects.

Repros in pure managed code too:

byte*buffer=null;if(size<=261){byte*tmp=stackallocbyte[size];buffer=tmp;}return(nint)buffer;// AllocateGuarded(int.MaxValue / 2) => stack overflow

Local diffs: benchmarks.run +11, aspnet2 +141, libraries.pmi -71, realworld -8 bytes; linux-arm64 aspnet2 +72 bytes. SPMI replay clean.

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Fixes a JIT miscompile where conditional localloc (GT_LCLHEAP) could be speculated across its guarding check due to missing effect flags, potentially causing stack overflow in guarded allocation patterns.

Changes:

• Mark GT_LCLHEAP with GTF_ORDER_SIDEEFF during import to preserve ordering below dominating bounds checks.
• Teach GenTree::OperSupportsOrderingSideEffect that GT_LCLHEAP supports ordering side effects.
• Add a regression test validating conditional stackalloc is not speculated into an unconditional allocation.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/tests/JIT/Regression/Regression_ro_2.csproj	Registers the new regression test source file in the test project.
src/tests/JIT/Regression/JitBlue/Runtime_132243/Runtime_132243.cs	Adds a repro/regression validating conditional stackalloc remains guarded.
src/coreclr/jit/importer.cpp	Applies GTF_ORDER_SIDEEFF to GT_LCLHEAP to prevent unsafe reordering/speculation.
src/coreclr/jit/gentree.cpp	Allows GT_LCLHEAP to participate in ordering-side-effect handling.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[jakobbotsch]

GTF_ORDER_SIDEEFF only interferes with other GTF_ORDER_SIDEEFF. It can be reordered with nodes or control flow that does not have any side effects.

I suspect the node should instead get GTF_CALL and GTF_GLOB_REF flags (similar to GT_KEEPALIVE)

[EgorBo]

Thanks, switched to GTF_CALL | GTF_GLOB_REF in 90a2370.

Also added GT_LCLHEAP to OperRequiresCallFlag and OperRequiresGlobRefFlag - without the former, gtUpdateNodeOperSideEffects scrubs GTF_CALL right back off, and without the latter the default: assert in OperRequiresGlobRefFlag fires.

SPMI replay is clean; diffs are small and mixed (benchmarks.run +11, aspnet2 +141, libraries.pmi -71, realworld -8 bytes; linux-arm64 aspnet2 +72).

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

[EgorBo]

/ba-g deadletter