Test failure: JIT/Regression/JitBlue/Runtime_34170/Runtime_34170/Runtime_34170.sh

[BruceForstall]

linux-arm random JitStress

https://dev.azure.com/dnceng/public/_build/results?buildId=1953214&view=ms.vss-test-web.build-test-results-tab&runId=50240696&resultId=109476&paneView=dotnet-dnceng.dnceng-build-release-tasks.helix-test-information-tab

+ cat /root/helix/work/workitem/u/SetStressModes_jitstress_random_1.sh
#!/usr/bin/env bash
export COMPlus_TieredCompilation=0
export COMPlus_DbgEnableMiniDump=1
export COMPlus_DbgMiniDumpName=$HELIX_DUMP_FOLDER/coredump.%d.dmp
export COMPlus_JitStress=394

...

    JIT/Regression/JitBlue/Runtime_34170/Runtime_34170/Runtime_34170.sh [FAIL]
      Unhandled exception. System.DataMisalignedException: A datatype misalignment was detected in a load or store instruction.
         at FloatNonAlignedFieldWithLargeOffset..ctor(Single a)
         at Test_Runtime_34170.Main()
      [createdump] waitpid() returned successfully (wstatus 00000000)
      /root/helix/work/workitem/e/JIT/Regression/JitBlue/Runtime_34170/Runtime_34170/Runtime_34170.sh: line 384:  2028 Aborted                 (core dumped) $LAUNCHER $ExePath "${CLRTestExecutionArguments[@]}"
      
      Return code:      1
      Raw output file:      /root/helix/work/workitem/uploads/Reports/JIT.Regression/JitBlue/Runtime_34170/Runtime_34170/Runtime_34170.output.txt
      Raw output:
      BEGIN EXECUTION
      /root/helix/work/correlation/corerun -p System.Reflection.Metadata.MetadataUpdater.IsSupported=false Runtime_34170.dll ''
      1
      [createdump] Gathering state for process 2028 corerun
      [createdump] Crashing thread 000007ec signal 00000006
      [createdump] Writing minidump with heap to file /home/helixbot/dotnetbuild/dumps/coredump.2028.dmp
      [createdump] Written 72691712 bytes (17747 pages) to core file
      [createdump] Target process is alive
      [createdump] Dump successfully written in 2692ms
      Expected: 100
      Actual: 134
      END EXECUTION - FAILED

Note this test has been failing in CG2 runs: #53560, #74185

@dotnet/jit-contrib

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

linux-arm random JitStress

https://dev.azure.com/dnceng/public/_build/results?buildId=1953214&view=ms.vss-test-web.build-test-results-tab&runId=50240696&resultId=109476&paneView=dotnet-dnceng.dnceng-build-release-tasks.helix-test-information-tab

+ cat /root/helix/work/workitem/u/SetStressModes_jitstress_random_1.sh
#!/usr/bin/env bash
export COMPlus_TieredCompilation=0
export COMPlus_DbgEnableMiniDump=1
export COMPlus_DbgMiniDumpName=$HELIX_DUMP_FOLDER/coredump.%d.dmp
export COMPlus_JitStress=394

...

    JIT/Regression/JitBlue/Runtime_34170/Runtime_34170/Runtime_34170.sh [FAIL]
      Unhandled exception. System.DataMisalignedException: A datatype misalignment was detected in a load or store instruction.
         at FloatNonAlignedFieldWithLargeOffset..ctor(Single a)
         at Test_Runtime_34170.Main()
      [createdump] waitpid() returned successfully (wstatus 00000000)
      /root/helix/work/workitem/e/JIT/Regression/JitBlue/Runtime_34170/Runtime_34170/Runtime_34170.sh: line 384:  2028 Aborted                 (core dumped) $LAUNCHER $ExePath "${CLRTestExecutionArguments[@]}"
      
      Return code:      1
      Raw output file:      /root/helix/work/workitem/uploads/Reports/JIT.Regression/JitBlue/Runtime_34170/Runtime_34170/Runtime_34170.output.txt
      Raw output:
      BEGIN EXECUTION
      /root/helix/work/correlation/corerun -p System.Reflection.Metadata.MetadataUpdater.IsSupported=false Runtime_34170.dll ''
      1
      [createdump] Gathering state for process 2028 corerun
      [createdump] Crashing thread 000007ec signal 00000006
      [createdump] Writing minidump with heap to file /home/helixbot/dotnetbuild/dumps/coredump.2028.dmp
      [createdump] Written 72691712 bytes (17747 pages) to core file
      [createdump] Target process is alive
      [createdump] Dump successfully written in 2692ms
      Expected: 100
      Actual: 134
      END EXECUTION - FAILED

Note this test has been failing in CG2 runs: #53560, #74185

@dotnet/jit-contrib

Author:	BruceForstall
Assignees:	-
Labels:	arch-arm32, os-linux, JitStress, area-CodeGen-coreclr
Milestone:	7.0.0

[JulieLeeMSFT]

Assigning to @EgorBo.

[jakobbotsch]

I'll grab this one.

[jakobbotsch]

Codegen without stress:

; Assembly listing for method FloatNonAlignedFieldWithLargeOffset:.ctor(float):this
; Emitting BLENDED_CODE for generic ARM CPU - Unix
; Tier-0 compilation
; MinOpts code
; r11 based frame
; partially interruptible
; Final local variable assignments
;
;  V00 this         [V00    ] (  1,  1   )   byref  ->  [sp+04H]   do-not-enreg[] this
;  V01 arg1         [V01    ] (  1,  1   )   float  ->  [sp+00H]   do-not-enreg[]
;# V02 OutArgs      [V02    ] (  1,  1   )  lclBlk ( 0) [sp+00H]   do-not-enreg[] "OutgoingArgSpace"
;
; Lcl frame size = 8

G_M51082_IG01:              ;; offset=0000H
000000  E92D 4C1C      push    {r2,r3,r4,r10,r11,lr}
000004  F10D 0B10      add     r11, sp, 16
000008  9001           str     r0, [sp+0x04]
00000A  ED8D 0A00      vstr    s0, [sp]
                                                ;; size=14 bbWeight=1    PerfScore 4.00
G_M51082_IG02:              ;; offset=000EH
00000E  9B01           ldr     r3, [sp+0x04]
000010  F203 33FD      addw    r3, r3, 0x3fd
000014  ED9D 4A00      vldr    s8, [sp]
000018  EE14 2A10      vmov.f2i r2, s8
00001C  601A           str     r2, [r3]
                                                ;; size=16 bbWeight=1    PerfScore 5.00
G_M51082_IG03:              ;; offset=001EH
00001E  E8BD 8C1C      pop     {r2,r3,r4,r10,r11,pc}
                                                ;; size=4 bbWeight=1    PerfScore 1.00

; Total bytes of code 34, prolog size 8, PerfScore 13.40, instruction count 10, allocated bytes for code 34 (MethodHash=1e103875) for method FloatNonAlignedFieldWithLargeOffset:.ctor(float):this
; ============================================================

Codegen with stress (that throws exception):

; Assembly listing for method FloatNonAlignedFieldWithLargeOffset:.ctor(float):this
; Emitting BLENDED_CODE for generic ARM CPU - Unix
; Tier-0 compilation
; MinOpts code
; r11 based frame
; fully interruptible
; Final local variable assignments
;
;  V00 this         [V00    ] (  1,  1   )   byref  ->  [sp+10H]   do-not-enreg[] this ptr
;  V01 arg1         [V01    ] (  1,  1   )   float  ->  [sp+0CH]   do-not-enreg[]
;  V02 tmp0         [V02    ] (  1,  1   )     int  ->  [sp+08H]   do-not-enreg[V] "GSCookie dummy"
;# V03 OutArgs      [V03    ] (  1,  1   )  lclBlk ( 0) [sp+00H]   do-not-enreg[] "OutgoingArgSpace"
;  V04 tmp2         [V04    ] (  1,  1   )   byref  ->  [sp+04H]   do-not-enreg[] must-init ptr "Address-exposed, or written this pointer"
;  V05 GsCookie     [V05    ] (  1,  1   )     int  ->  [sp+14H]   do-not-enreg[X] addr-exposed "GSSecurityCookie"
;
; Lcl frame size = 24

G_M51082_IG01:              ;; offset=0000H
000000  E92D 4C10      push    {r4,r10,r11,lr}
000004  B086           sub     sp, 24
000006  F10D 0B20      add     r11, sp, 32
00000A  2300           movs    r3, 0
00000C  9301           str     r3, [sp+0x04]    // [V04 tmp2]
00000E  F245 6378      movw    r3, 0x5678
000012  F2C1 2334      movt    r3, 0x1234
000016  9305           str     r3, [sp+0x14]    // [V05 GsCookie]
000018  9004           str     r0, [sp+0x10]    // [V00 this]
00001A  ED8D 0A03      vstr    s0, [sp+0x0C]    // [V01 arg1]
                                                ;; size=30 bbWeight=1    PerfScore 10.00
G_M51082_IG02:              ;; offset=001EH
00001E  9B04           ldr     r3, [sp+0x10]
000020  9301           str     r3, [sp+0x04]    // [V04 tmp2]
000022  ED9D 4A03      vldr    s8, [sp+0x0C]    // [V01 arg1]
000026  9B01           ldr     r3, [sp+0x04]    // [V04 tmp2]
000028  F993 3000      ldrsb   r3, [r3]
00002C  9B01           ldr     r3, [sp+0x04]    // [V04 tmp2]
00002E  F203 33FD      addw    r3, r3, 0x3fd
000032  ED83 4A00      vstr    s8, [r3]                // exception here
000036  F245 6C78      movw    r12, 0x5678
00003A  F2C1 2C34      movt    r12, 0x1234
00003E  F8DD E014      ldr     lr, [sp+0x14]    // [V05 GsCookie]
000042  45F4           cmp     r12, lr
000044  D004           beq     SHORT G_M51082_IG03
000046  F64D 1C79      movw    r12, 0xd979
00004A  F2CF 7C3D      movt    r12, 0xf73d
00004E  47E0           blx     r12              // CORINFO_HELP_FAIL_FAST
                                                ;; size=50 bbWeight=1    PerfScore 16.00
G_M51082_IG03:              ;; offset=0050H
000050  B006           add     sp, 24
000052  E8BD 8C10      pop     {r4,r10,r11,pc}
                                                ;; size=6 bbWeight=1    PerfScore 2.00

; Total bytes of code 86, prolog size 30, PerfScore 36.60, instruction count 28, allocated bytes for code 86 (MethodHash=1e103875) for method FloatNonAlignedFieldWithLargeOffset:.ctor(float):this
; ============================================================

Presumably we are missing some handling for this case that ensures potentially unaligned floating point stores go through integer registers.

[jakobbotsch]

Morph relies on recognizing

IND
  ADD
    X
    CNS_INT <unaligned const>

to set GTF_UNALIGNED:

runtime/src/coreclr/jit/morph.cpp

Lines 11304 to 11321 in b90a734

	else if (op1->OperGet() == GT_ADD)
	{
	#ifdef TARGET_ARM
	// Check for a misalignment floating point indirection.
	if (varTypeIsFloating(typ))
	{
	GenTree* addOp2 = op1->AsOp()->gtGetOp2();
	if (addOp2->IsCnsIntOrI())
	{
	ssize_t offset = addOp2->AsIntCon()->gtIconVal;
	if ((offset % emitTypeSize(TYP_FLOAT)) != 0)
	{
	tree->gtFlags |= GTF_IND_UNALIGNED;
	}
	}
	}
	#endif // TARGET_ARM
	}

For large field offsets there is a comma added between the IND and ADD with an explicit null check.
Fix should be simple but it does seem pretty fragile (I suppose "correct" IL needs unaligned. prefix, so this might be mainly for compatibility concerns).