JIT: Assertion failed '!node->IsUnusedValue() || !node->OperIs(GT_FIELD_LIST, GT_INIT_VAL)' during 'Global local var liveness'

[jakobbotsch]

// Generated by Fuzzlyn v3.2 on 2025-06-15 17:16:07
// Run on X86 Windows
// Seed: 11396928574809418613-vectort,vector128,vector256,x86aes,x86avx,x86avx2,x86avx512bw,x86avx512bwvl,x86avx512cd,x86avx512cdvl,x86avx512dq,x86avx512dqvl,x86avx512f,x86avx512fvl,x86bmi1,x86bmi2,x86fma,x86lzcnt,x86pclmulqdq,x86popcnt,x86sse,x86sse2,x86sse3,x86sse41,x86sse42,x86ssse3,x86x86base
// Reduced from 316.8 KiB to 0.6 KiB in 00:08:07
// Hits JIT assert for Release:
// Assertion failed '!node->IsUnusedValue() || !node->OperIs(GT_FIELD_LIST, GT_INIT_VAL)' in 'C1:M1(byref):byte:this' during 'Global local var liveness' (IL size 51; hash 0x17217cb6; FullOpts)
// 
//     File: D:\a\_work\1\s\src\coreclr\jit\lir.cpp Line: 1636
// 
using System;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;

public class C0
{
    public short F3;
    public long F4;
}

public class C1
{
    public byte F0;
    public C0 F3;
    public byte M1(ref byte arg0)
    {
        sbyte var0 = (sbyte)((this.F3.F4 * Program.s_3.F3) << -1);
        System.Console.WriteLine(var0);
        return this.F0;
    }
}

public class Program
{
    public static C0 s_3;
    public static byte s_11;
    public static void Main()
    {
        (new C1()).M1(ref s_11);
    }
}

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[jakobbotsch]

This looks exposed by #116144. Likely lowering is missing marking a node unused that previously liveness was removing, thus hiding the issue.

[jakobbotsch]

We have a call with a PUTARG_STK operand with a contained FIELD_LIST that itself has a contained GT_IND. We remove the call and also PUTARG_STK, and as part of removing that we mark its FIELD_LIST as unused, which clears the containment on it.
Previously we would then remove the FIELD_LIST node as well, but after #116144 we don't because of its contained GT_IND.

The fix in the spirit of #116144 is to consider the PUTARG_STK operands (that are not contained) as sort-of contained in calls; we cannot remove the call if we cannot remove the PUTARG_STK, and we cannot remove the PUTARG_STK because the codegen of the indirection that may throw is contained in it.

(In reality we can remove those things because we can uncontain the indirection, which is what we used to do before #116144. I will return that behavior as part of the fix.)

[jakobbotsch]

@a74nh The way contained indirections are handled is that we simply clear their containment status when marked as unused. This is fine since they support standalone codegen.

What happens if we similarly clear GTF_HW_EM_OP when a node is marked unused? Would it work fine for the case you were looking at in #116144? It seems that yes given that the code that marks it embedded already checks IsInvariantInRange first.

[a74nh]

s are handled is that we simply clear their containment status when marked as unused. This is fine since they support standalone codegen.

What happens if we similarly clear GTF_HW_EM_OP when a node is marked unused? Would it work fine for the case you were looking at in #116144? It seems that yes given that the code that marks it embedded already checks IsInvariantInRange first.

That should be fine. GTF_HW_EM_OP should only be set on contained nodes.

In an earlier version of the PR I had ClearContained() calling ClearEmbMaskOp().

(Alternatively, clear before calling ClearContained(), and then ClearContained() would assert(IsEmbMaskOp()).

MakeEmbMaskOp() should probably also call assert(IsContained()) too.

[jakobbotsch]

@a74nh I tried it as an alternative to #116144. However, I hit this assert:

Using jit(C:\dev\dotnet\runtime2\artifacts\tests\coreclr\windows.x64.Checked\Tests\Core_Root\clrjit_universal_arm64_x64.dll) with input (C:\dev\dotnet\spmi\mch\2004006b-bdff-4357-8e60-3ae950a4f165.windows.arm64\coreclr_tests.run.windows.arm64.checked.mch)
 indexCount=1 (349191)
Jit startup took 4.432800ms
ISSUE: <ASSERT> #349191 C:\dev\dotnet\runtime2\src\coreclr\jit\emitarm64sve.cpp (4804) - Assertion failed 'isLowPredicateRegister(reg2)' in 'EmbeddedLoads:CndSelectEmbeddedOp3LoadAllBits(int[],System.Numerics.Vector`1[int])' during 'Generate code' (IL size 49; hash 0xde1176d4; FullOpts)

when trying to generate code for the uncontained unused LoadVectorNonFaulting node. It is still not clear to me whether this node supports being uncontained.

[a74nh]

@a74nh I tried it as an alternative to #116144. However, I hit this assert:

Using jit(C:\dev\dotnet\runtime2\artifacts\tests\coreclr\windows.x64.Checked\Tests\Core_Root\clrjit_universal_arm64_x64.dll) with input (C:\dev\dotnet\spmi\mch\2004006b-bdff-4357-8e60-3ae950a4f165.windows.arm64\coreclr_tests.run.windows.arm64.checked.mch)
 indexCount=1 (349191)
Jit startup took 4.432800ms
ISSUE: <ASSERT> #349191 C:\dev\dotnet\runtime2\src\coreclr\jit\emitarm64sve.cpp (4804) - Assertion failed 'isLowPredicateRegister(reg2)' in 'EmbeddedLoads:CndSelectEmbeddedOp3LoadAllBits(int[],System.Numerics.Vector`1[int])' during 'Generate code' (IL size 49; hash 0xde1176d4; FullOpts)

when trying to generate code for the uncontained unused LoadVectorNonFaulting node. It is still not clear to me whether this node supports being uncontained.

A LoadVectorNonFaulting it will fail to codegen if it is not contained within a conditionalselect (as it requires the mask from the conditionalselect).

[a74nh]

So you're now hitting the issue where the conditionalselect gets optimised away, but the LoadVectorNonFaulting still exists

[jakobbotsch]

I think the best fix would be for all nodes to always support standalone codegen. It is how we have handled contained indirections (that also have side effects) since forever, so we should align on this behavior for these nodes too.

I am not doing that in #116819 but I think it would be the best long term fix with the least amount of surprises.