Assertion failed 'OperIs(GT_LCL_VAR, GT_LCL_FLD, GT_PHI_ARG, GT_STORE_LCL_VAR, GT_STORE_LCL_FLD, GT_LCL_ADDR)' during 'Assertion prop'

[AndyAyersMS]

linux arm64 libraries jitstress random

https://dev.azure.com/dnceng-public/public/_build/results?buildId=757828&view=ms.vss-test-web.build-test-results-tab

DOTNET_TieredCompilation=0
DOTNET_JitStress=2b9

  Starting:    LibraryImportGenerator.Unit.Tests (parallel test collections = on [2 threads], stop on fail = off)

Assert failure(PID 26 [0x0000001a], Thread: 39 [0x0027]): Assertion failed 'OperIs(GT_LCL_VAR, GT_LCL_FLD, GT_PHI_ARG, GT_STORE_LCL_VAR, GT_STORE_LCL_FLD, GT_LCL_ADDR)' in 'Microsoft.Interop.Analyzers.CustomMarshallerAttributeAnalyzer:get_SupportedDiagnostics():System.Collections.Immutable.ImmutableArray`1[Microsoft.CodeAnalysis.DiagnosticDescriptor]:this' during 'Assertion prop' (IL size 405; hash 0xde7ac83a; FullOpts)

    File: /__w/1/s/src/coreclr/jit/gtstructs.h:65
    Image: /root/helix/work/correlation/dotnet

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[AndyAyersMS]

Trying to repro locally but ran into #106081

[AndyAyersMS]

Coredump from the work item is not usable...

andya@AndyBR3:~/bugs/r105670$ lldb ./correlation-payload/dotnet --core ./workitems/LibraryImportGenerator.Unit.Tests/coredump.26.dmp
Current symbol store settings:
-> Cache: /home/andya/.dotnet/symbolcache
-> Server: https://msdl.microsoft.com/download/symbols/ Timeout: 4 RetryCount: 0
(lldb) target create "./correlation-payload/dotnet" --core "./workitems/LibraryImportGenerator.Unit.Tests/coredump.26.dmp"
Core file '/home/andya/bugs/r105670/workitems/LibraryImportGenerator.Unit.Tests/coredump.26.dmp' (aarch64) was loaded.
(lldb) bt
* thread #12, stop reason = signal SIGABRT
  * frame #0: 0x0000ffffabcb5c0c libc.so.6`__isoc99_vswscanf + 12
    frame #1: 0x0000ffffabcb5bf4 libc.so.6`__isoc99_vfwscanf + 36
    frame #2: 0x0000ffffab9e46ac
    frame #3: 0x0000ffffab9e57a8
    frame #4: 0x0000ffffab9e26ac
    frame #5: 0x0000ffffab9e2528
(lldb) target modules list
[  0] 49896737-BBB3-4922-D308-732C83796AAA-E9260FDE 0x0000aaaabdaf0000 /home/andya/bugs/r105670/correlation-payload/dotnet
[  1] D8ABEA69-AAB2-357B-DE99-5B2D7C0E3231-F47BEBC8 0x0000ffffac0ae000 [vdso] (0x0000ffffac0ae000)
[  2] E2DECD6F-7A5B-8707-6341-C2A470E2FEE2-FD3B4716 0x0000ffffac06a000 /lib/aarch64-linux-gnu/libdl.so.2
[  3] FBD0FFA7-1FE4-65E0-A98B-CA9809017243-2B405D5B 0x0000ffffac039000 /lib/aarch64-linux-gnu/libpthread.so.0
[  4] 8A55A067-6D2F-D182-A650-8EB29B4AF1BE-87B3B5B1 0x0000ffffabe54000 /lib/aarch64-linux-gnu/libstdc++.so.6
[  5] 64D343B3-CD92-4E04-4E65-4208DFD574DC-AC12ABA5 0x0000ffffabda9000 /lib/aarch64-linux-gnu/libm.so.6
[  6] 767C71DC-0627-5463-FF61-A8A8CB4D1D97-60A7AFCD 0x0000ffffabd85000 /lib/aarch64-linux-gnu/libgcc_s.so.1
[  7] 3119D7BC-F68A-34E2-1742-CD08095272DE-601D373F 0x0000ffffabc12000 /lib/aarch64-linux-gnu/libc.so.6
[  8] 078400E5-ACA1-792B-8D78-564A71D2C451-EF5DBF23 0x0000ffffac07e000 /lib/ld-linux-aarch64.so.1
[  9] D96B1884-7006-4D73-422D-047C041BA392-01CC3CC6 0x0000ffffab123000 /lib/aarch64-linux-gnu/librt.so.1
[ 10] 8D140CD4-4855-3A1A-CE74-43198D93CBD3-05E351DA 0x0000ffbeb81a3000 /lib/aarch64-linux-gnu/libnss_files.so.2

However dotnet-symbols sees all the modules... (looking for libclrjit.so) not sure what that means.

andya@AndyBR3:~/bugs/r105670$ dotnet symbol --verifycore workitems/LibraryImportGenerator.Unit.Tests/coredump.26.dmp | grep jit
0000FFBEBD7E5000 /root/helix/work/correlation/shared/Microsoft.NETCore.App/9.0.0/libclrjit.so

andya@AndyBR3:~/bugs/r105670$ dotnet symbol --verifycore workitems/LibraryImportGenerator.Unit.Tests/coredump.26.dmp | grep coreclr
0000FFFFAB13B000 /root/helix/work/correlation/shared/Microsoft.NETCore.App/9.0.0/libcoreclr.so

and those next addresses in the backtrace look like runtime frames.

[AndyAyersMS]

dotnet-dump is able to get a bit further, we can see

OS Thread Id: 0x27
        Child SP               IP Call Site
0000FFBEAB7FA1C8 0000ffffabcb5c0c [PrestubMethodFrame: 0000ffbeab7fa1c8] Microsoft.Interop.Analyzers.CustomMarshallerAttributeAnalyzer.get_SupportedDiagnostics()
0000FFBEAB7FA3F0 0000FFFF740B336C Microsoft.CodeAnalysis.Testing.AnalyzerTest`1[[System.__Canon, System.Private.CoreLib]].GetDefaultDiagnostic(Microsoft.CodeAnalysis.Diagnostics.DiagnosticAnalyzer[]) [/_/src/Microsoft.CodeAnalysis.Testing/Microsoft.CodeAnalysis.Analyzer.Testing/AnalyzerTest`1.cs @ 249]

> dumpmd  0000ffff6df98fb8
Method Name:          Microsoft.Interop.Analyzers.CustomMarshallerAttributeAnalyzer.get_SupportedDiagnostics()
Class:                0000ffff6df99120
MethodTable:          0000ffff6df99120
mdToken:              00000000060001ED
Module:               0000ffff6de63630
IsJitted:             no
Current CodeAddr:     ffffffffffffffff
Version History:
  ILCodeVersion:      0000000000000000
  ReJIT ID:           0
  IL Addr:            0000ffbebb2763b8
     CodeAddr:           0000000000000000  (Optimized)
     NativeCodeVersion:  0000000000000000

Given this is jitting with TC disabled, maybe we can repro this with PMI?

[AndyAyersMS]

David fixed the TLS issue, so I can now repro locally

Launching dotnet exec --runtimeconfig LibraryImportGenerator.Unit.Tests.runtimeconfig.json --depsfile LibraryImportGenerator.Unit.Tests.deps.json xunit.console.dll LibraryImportGenerator.Unit.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing  -maxthreads 2 in /home/andya/repos/runtime0/artifacts/bin/LibraryImportGenerator.Unit.Tests/Release/net9.0
  Discovering: LibraryImportGenerator.Unit.Tests (method display = ClassAndMethod, method display options = None)
  Discovered:  LibraryImportGenerator.Unit.Tests (found 185 of 189 test cases)
  Starting:    LibraryImportGenerator.Unit.Tests (parallel test collections = on [2 threads], stop on fail = off)

Assert failure(PID 108905 [0x0001a969], Thread: 108923 [0x1a97b]): Assertion failed 'OperIs(GT_LCL_VAR, GT_LCL_FLD, GT_PHI_ARG, GT_STORE_LCL_VAR, GT_STORE_LCL_FLD, GT_LCL_ADDR)' in 'Microsoft.Interop.Analyzers.CustomMarshallerAttributeAnalyzer:get_SupportedDiagnostics():System.Collections.Immutable.ImmutableArray`1[Microsoft.CodeAnalysis.DiagnosticDescriptor]:this' during 'Assertion prop' (IL size 405; hash 0xde7ac83a; FullOpts)

    File: /home/andya/repos/runtime0/src/coreclr/jit/gtstructs.h:65
    Image: /home/andya/repos/runtime0/artifacts/bin/testhost/net9.0-linux-Release-arm64/dotnet

[AndyAyersMS]

We have this tree:

STMT00070 ( INL01 @ 0x070[E-] ... ??? ) <- INLRT @ ???
N005 ( 10, 18) [001047] ----G------                         *  JTRUE     void   $VN.Void
N004 (  8, 16) [001048] N---G--N-U-                         \--*  NE        int    $387
N002 (  6, 14) [001050] #---G------                            +--*  IND       ref    $95
N001 (  3, 12) [001051] H----------                            |  \--*  CNS_INT(h) long   0xf778c000f6c8 const ptr Fseq[<unknown field>] $1a2
N003 (  1,  1) [001049] -----------                            \--*  LCL_VAR   ref    V14 tmp13        u:2 $8a

and a relop assertion matching V14.2. But the code in assertion prop is assuming op1 is a lcl var, but it can also be an indir, like it is here.

runtime/src/coreclr/jit/assertionprop.cpp

Lines 4411 to 4444 in 019d758

	// If the assertion involves "op2" and "op1" is also a local var, then just morph the tree.
	else if (op2->gtOper == GT_LCL_VAR)
	{
	#ifdef DEBUG
	if (verbose)
	{
	printf("\nVN relop based copy assertion prop in " FMT_BB ":\n", compCurBB->bbNum);
	printf("Assertion index=#%02u: V%02d.%02d %s V%02d.%02d\n", index, op1->AsLclVar()->GetLclNum(),
	op1->AsLclVar()->GetSsaNum(),
	(curAssertion->assertionKind == OAK_EQUAL) ? "==" : "!=", op2->AsLclVar()->GetLclNum(),
	op2->AsLclVar()->GetSsaNum());
	gtDispTree(tree, nullptr, nullptr, true);
	}
	#endif
	// If floating point, don't just substitute op1 with op2, this won't work if
	// op2 is NaN. Just turn it into a "true" or "false" yielding expression.
	if (op1->TypeIs(TYP_FLOAT, TYP_DOUBLE))
	{
	// Note we can't trust the OAK_EQUAL as the value could end up being a NaN
	// violating the assertion. However, we create OAK_EQUAL assertions for floating
	// point only on JTrue nodes, so if the condition held earlier, it will hold
	// now. We don't create OAK_EQUAL assertion on floating point from stores
	// because we depend on value num which would constant prop the NaN.
	op1->BashToConst(0.0, op1->TypeGet());
	op2->BashToConst(0.0, op2->TypeGet());
	}
	// Change the op1 LclVar to the op2 LclVar
	else
	{
	noway_assert(varTypeIsIntegralOrI(op1->TypeGet()));
	op1->AsLclVarCommon()->SetLclNum(op2->AsLclVarCommon()->GetLclNum());
	op1->AsLclVarCommon()->SetSsaNum(op2->AsLclVarCommon()->GetSsaNum());
	}
	}