JIT: Assertion failed '((tree->gtFlags & GTF_VAR_DEF) == 0) && (tree->GetLclNum() == lclNum) && tree->gtVNPair.BothDefined()' during 'VN based copy prop

[jakobbotsch]

// Generated by Fuzzlyn v1.5 on 2023-04-09 16:37:03
// Run on X64 Windows
// Seed: 6230188300048624105
// Reduced from 155.1 KiB to 0.2 KiB in 00:01:48
// Hits JIT assert in Release:
// Assertion failed '((tree->gtFlags & GTF_VAR_DEF) == 0) && (tree->GetLclNum() == lclNum) && tree->gtVNPair.BothDefined()' in 'Program:Main(Fuzzlyn.ExecutionServer.IRuntime)' during 'VN based copy prop' (IL size 25; hash 0xade6b36b; FullOpts)
// 
//     File: D:\a\_work\1\s\src\coreclr\jit\copyprop.cpp Line: 161
// 
public class Program
{
    public static sbyte s_27;
    public static void Main()
    {
        long vr1 = 0;
        for (int vr3 = 0; vr3 < -1; vr3++)
        {
            s_27 = (sbyte)(vr1 | vr1);
        }
    }
}

Looks introduced/exposed by #83956, cc @BruceForstall

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch, @kunalspathak
See info in area-owners.md if you want to be subscribed.

Issue Details

---

// Generated by Fuzzlyn v1.5 on 2023-04-09 16:37:03
// Run on X64 Windows
// Seed: 6230188300048624105
// Reduced from 155.1 KiB to 0.2 KiB in 00:01:48
// Hits JIT assert in Release:
// Assertion failed '((tree->gtFlags & GTF_VAR_DEF) == 0) && (tree->GetLclNum() == lclNum) && tree->gtVNPair.BothDefined()' in 'Program:Main(Fuzzlyn.ExecutionServer.IRuntime)' during 'VN based copy prop' (IL size 25; hash 0xade6b36b; FullOpts)
// 
//     File: D:\a\_work\1\s\src\coreclr\jit\copyprop.cpp Line: 161
// 
public class Program
{
    public static sbyte s_27;
    public static void Main()
    {
        long vr1 = 0;
        for (int vr3 = 0; vr3 < -1; vr3++)
        {
            s_27 = (sbyte)(vr1 | vr1);
        }
    }
}

Looks introduced/exposed by #83956, cc @BruceForstall

Author:	jakobbotsch
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[BruceForstall]

More seeds: 8732651341680904527, 384296484754472945

[BruceForstall]

Copy prop assumes that a LCL_VAR that is not a def and has an SSA name also has a value number. In the test case, hoisting copies a LCL_VAR use and then morphs it. The morphing removes the value number, leading to an assert.

E.g., hoisting does the following:

Hoisting a copy of [000014] $40 from BB03 into PreHeader BB02 for loop L00 <BB03..BB03>:
N004 (  4,  5) [000014] -----------                         *  CAST      int <- long $40
N003 (  3,  3) [000013] -----------                         \--*  OR        long   $140
N001 (  1,  1) [000011] -----------                            +--*  LCL_VAR   long   V00 loc0         u:2 $140
N002 (  1,  1) [000012] -----------                            \--*  LCL_VAR   long   V00 loc0         u:2 $140

This hoisted copy placed in PreHeader (BB02):
               [000040] -----------                         *  COMMA     void
     (  3,  3) [000036] -------H---                         +--*  OR        int    $40
     (  1,  1) [000037] -------H---                         |  +--*  LCL_VAR   int    V00 loc0         u:2
     (  1,  1) [000038] -------H---                         |  \--*  LCL_VAR   int    V00 loc0         u:2
               [000039] -----------                         \--*  NOP       void

Note that [000037] and [000038] lost their value numbers.

One solution would be to simply add the asserted case as a dynamic check before calling optCopyProp.