JIT: Assertion failed '!arg->OperIsPutArg()' during 'Lowering nodeinfo'

[jakobbotsch]

// Generated by Fuzzlyn v1.5 on 2023-02-24 23:07:44
// Run on Arm64 MacOS
// Seed: 7217345272271671129
// Reduced from 8.8 KiB to 1.2 KiB in 00:00:06
// Hits JIT assert in Release:
// Assertion failed '!arg->OperIsPutArg()' in 'Program:Main(Fuzzlyn.ExecutionServer.IRuntime)' during 'Lowering nodeinfo' (IL size 45; hash 0xade6b36b; FullOpts)
// 
//     File: /Users/runner/work/1/s/src/coreclr/jit/lower.cpp Line: 1566
// 
public class Program
{
    public static IRuntime s_rt;
    public static long[] s_2;
    public static void Main()
    {
        CollectibleALC alc = new CollectibleALC();
        System.Reflection.Assembly asm = alc.LoadFromAssemblyPath(System.Reflection.Assembly.GetExecutingAssembly().Location);
        System.Reflection.MethodInfo mi = asm.GetType(typeof(Program).FullName).GetMethod(nameof(MainInner));
        System.Type runtimeTy = asm.GetType(typeof(Runtime).FullName);
        mi.Invoke(null, new object[]{System.Activator.CreateInstance(runtimeTy)});
    }

    public static void MainInner(IRuntime rt)
    {
        var vr1 = new ulong[]{0};
        byte vr2 = (byte)(M4(vr1) & ~(sbyte)(0 & s_2[0]));
        s_rt.WriteLine("c_40", vr2);
    }

    public static uint M4(ulong[] arg0)
    {
        s_rt.WriteLine("c_26", arg0[0]);
        return 0;
    }
}

public interface IRuntime
{
    void WriteLine<T>(string site, T value);
}

public class Runtime : IRuntime
{
    public void WriteLine<T>(string site, T value) => System.Console.WriteLine(value);
}

public class CollectibleALC : System.Runtime.Loader.AssemblyLoadContext
{
    public CollectibleALC(): base(true)
    {
    }
}

cc @TIHan, this looks caused by #82276. It looks like we are lowering the same node multiple times because TryLowerAndNegativeOne returns a previous node.

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch, @kunalspathak
See info in area-owners.md if you want to be subscribed.

Issue Details

---

// Generated by Fuzzlyn v1.5 on 2023-02-24 23:07:44
// Run on Arm64 MacOS
// Seed: 7217345272271671129
// Reduced from 8.8 KiB to 1.2 KiB in 00:00:06
// Hits JIT assert in Release:
// Assertion failed '!arg->OperIsPutArg()' in 'Program:Main(Fuzzlyn.ExecutionServer.IRuntime)' during 'Lowering nodeinfo' (IL size 45; hash 0xade6b36b; FullOpts)
// 
//     File: /Users/runner/work/1/s/src/coreclr/jit/lower.cpp Line: 1566
// 
public class Program
{
    public static IRuntime s_rt;
    public static long[] s_2;
    public static void Main()
    {
        CollectibleALC alc = new CollectibleALC();
        System.Reflection.Assembly asm = alc.LoadFromAssemblyPath(System.Reflection.Assembly.GetExecutingAssembly().Location);
        System.Reflection.MethodInfo mi = asm.GetType(typeof(Program).FullName).GetMethod(nameof(MainInner));
        System.Type runtimeTy = asm.GetType(typeof(Runtime).FullName);
        mi.Invoke(null, new object[]{System.Activator.CreateInstance(runtimeTy)});
    }

    public static void MainInner(IRuntime rt)
    {
        var vr1 = new ulong[]{0};
        byte vr2 = (byte)(M4(vr1) & ~(sbyte)(0 & s_2[0]));
        s_rt.WriteLine("c_40", vr2);
    }

    public static uint M4(ulong[] arg0)
    {
        s_rt.WriteLine("c_26", arg0[0]);
        return 0;
    }
}

public interface IRuntime
{
    void WriteLine<T>(string site, T value);
}

public class Runtime : IRuntime
{
    public void WriteLine<T>(string site, T value) => System.Console.WriteLine(value);
}

public class CollectibleALC : System.Runtime.Loader.AssemblyLoadContext
{
    public CollectibleALC(): base(true)
    {
    }
}

cc @TIHan, this looks caused by #82276. It looks like we are lowering the same node multiple times because TryLowerAndNegativeOne returns a previous node.

Author:	jakobbotsch
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[TIHan]

Thanks for reporting, I'll look into it.

[jakobbotsch]

Also this one:

// Generated by Fuzzlyn v1.5 on 2023-02-24 23:07:39
// Run on X86 Windows
// Seed: 10843127860637099968
// Reduced from 209.2 KiB to 0.3 KiB in 00:04:55
// Hits JIT assert in Release:
// Assertion failed '!op1->IsRegOptional() && !op2->IsRegOptional()' in 'Program:Main(Fuzzlyn.ExecutionServer.IRuntime)' during 'Lowering nodeinfo' (IL size 45; hash 0xade6b36b; FullOpts)
// 
//     File: D:\a\_work\1\s\src\coreclr\jit\lowerxarch.cpp Line: 5118
// 
public class Program
{
    public static bool s_26;
    public static void Main()
    {
        var vr2 = new uint[, ]{{0}};
        int vr7 = default(int);
        uint vr5 = (uint)vr7;
        if (s_26)
        {
            vr5 = 1;
        }

        vr2[0, 0] = (uint)(vr5 & (sbyte)~(vr2[0, 0] % 1));
    }
}

However, it's likely the same underlying issue.