Repository navigation
JIT: Bad codegen on x86 for a function in collectible ALC #73951
Description
// Generated by Fuzzlyn v1.5 on 2022-08-15 13:32:00
// Run on X86 Windows
// Seed: 9809551563097583633
// Reduced from 536.2 KiB to 1.8 KiB in 00:20:04
// Debug: Outputs 0
// Release: Outputs 61952
public struct S0
{
public uint F1;
public int F2;
public byte F3;
}
public class C0
{
public ushort F1;
public C0(ushort f1)
{
F1 = f1;
}
}
public class C1
{
public C1(uint f0, uint f1)
{
}
}
public class C2
{
public C2(C1 f0, uint f2, ulong f3, bool f5, int f6)
{
}
}
public struct S1
{
public C2 F0;
public S0 F1;
public S1(C2 f0): this()
{
F0 = f0;
}
public S1 M105(S0 arg0)
{
Program.s_10.F0 = new C2(new C1(521025157U, 1254134592U), 2911867824U, 0, false, 0);
return this;
}
}
public class Program
{
public static IRuntime s_rt;
public static S1 s_10;
public static S1 s_17;
public static void Main()
{
CollectibleALC alc = new CollectibleALC();
System.Reflection.Assembly asm = alc.LoadFromAssemblyPath(System.Reflection.Assembly.GetExecutingAssembly().Location);
System.Reflection.MethodInfo mi = asm.GetType(typeof(Program).FullName).GetMethod(nameof(MainInner));
System.Type runtimeTy = asm.GetType(typeof(Runtime).FullName);
mi.Invoke(null, new object[]{System.Activator.CreateInstance(runtimeTy)});
}
public static void MainInner(IRuntime rt)
{
s_rt = rt;
S0 vr21 = s_17.F1;
new S1(new C2(new C1(0, 0), 0, 0, false, 0)).M105(vr21);
var vr22 = new C0(vr21.F3);
s_rt.WriteLine("c_1839", vr22.F1);
}
}
public interface IRuntime
{
void WriteLine<T>(string site, T value);
}
public class Runtime : IRuntime
{
public void WriteLine<T>(string site, T value) => System.Console.WriteLine(value);
}
public class CollectibleALC : System.Runtime.Loader.AssemblyLoadContext
{
public CollectibleALC(): base(true)
{
}
}
Activity
jakobbotsch commentedon Aug 15, 2022
Looks like we fail to normalize
vr21.F3when we constructvr22:Full disassembly:
JulieLeeMSFT commentedon Aug 15, 2022
@jakobbotsch, putting this to .NET 8. Please change to .NET 7 if it needs to be fixed in this release.
jakobbotsch commentedon Aug 15, 2022
This seems like an an interaction between spilling/unspilling and this transformation:
runtime/src/coreclr/jit/lowerxarch.cpp
Lines 510 to 520 in 0a2b4eb
This was added in #65803 from what I can see, cc @SingleAccretion
SingleAccretion commentedon Aug 15, 2022
Looking at this already.
The assumption being made is that we're only altering the padding contents and those should not matter. Clearly, there is a logic error there somewhere.
Edit: note we had this logic in codegen even before #65803.
SingleAccretion commentedon Aug 15, 2022
I see what is going on. I suppose it should have been obvious from the start...
The implication is that this kind of retyping is not legal for candidate locals.
Will be preparing fixes tomorrow; they may take some time due to this code relying in the retyping a good deal (remember that the whole thing is intended to make
pushing thing easier).Edit: this is also an interesting case from a perspective of normalize-on-load semantics. We remove all of the normalizing casts because the def of the small field local is itself a small value. One could view the bug as the "normalize-on-load locals can only appear without the corresponding casts if typed small" rule being violated.