Assertion failed 'type == flagVal->TypeGet()'

[marklio]

See IL repro at the bottom. Please let me know if you need more info, or a repro of a different form. This assert is seen on 183 real assemblies from NuGet.org. I tried to turn this into a repro that would hit this on JIT, but the repro I reduced seemed only to repro on crossgen.

Save the IL below as test.il
ilasm test.il /dll
run amd64 CHK crossgen on test.dll:
crossgen.exe /in test.dll /out test.ni /nologo /verbose /platform_assemblies_paths "paths_to_il"
Expected: successful compilation
Actual:

Opening input file
Preloading input file D:\scratch\crossgenrepros\type == flagVal - TypeGet()\test.dll
Compiling input file D:\scratch\crossgenrepros\type == flagVal - TypeGet()\test.dll
Compiling method MainClass.get_FailingProperty

Assert failure(PID 4072 [0x00000fe8], Thread: 3336 [0x0d08]): Assertion failed 'type == flagVal->TypeGet()' in 'MainClass:get_FailingProperty():bool:this' (IL size 31)

    File: c:\users\markmil\source\repos\coreclr\src\jit\gentree.cpp Line: 12914
    Image: C:\Users\markmil\Source\Repos\PMIExperiment\CrossGenner\bin\Debug\coreclr\crossgen.exe

IL Repro:

.assembly extern mscorlib
{
  .publickeytoken = (B7 7A 5C 56 19 34 E0 89 )                         // .z\V.4..
  .ver 4:0:0:0
}
.assembly Test
{
  .custom instance void [mscorlib]System.Runtime.CompilerServices.CompilationRelaxationsAttribute::.ctor(int32) = ( 01 00 08 00 00 00 00 00 ) 
  .custom instance void [mscorlib]System.Runtime.CompilerServices.RuntimeCompatibilityAttribute::.ctor() = ( 01 00 01 00 54 02 16 57 72 61 70 4E 6F 6E 45 78   // ....T..WrapNonEx
                                                                                                             63 65 70 74 69 6F 6E 54 68 72 6F 77 73 01 )       // ceptionThrows.
  .hash algorithm 0x00008004
  .ver 1:0:0:0
}
.module Test.dll
.imagebase 0x00400000
.file alignment 0x00000200
.stackreserve 0x00100000
.subsystem 0x0003       // WINDOWS_CUI
.corflags 0x00020003    //  ILONLY 32BITPREFERRED

.class public auto ansi abstract beforefieldinit MainClass
	extends [mscorlib]System.Object
{
	.method public hidebysig specialname 
		instance bool get_FailingProperty () cil managed noinlining
	{
		.maxstack 8

		newobj void SpecialFlagHolder::.ctor()
		IL_0006: callvirt instance valuetype Flags SpecialFlagHolder::get_SpecialFlags()
		IL_000b: box Flags
		IL_0010: ldc.i4 256
		IL_0015: box Flags
		IL_001a: call instance bool [mscorlib]System.Enum::HasFlag(class [mscorlib]System.Enum)
		IL_001f: ret
	}

	.method assembly hidebysig specialname rtspecialname 
		instance void .ctor () cil managed 
	{
		.maxstack 8

		ldarg.0
		call instance void [mscorlib]System.Object::.ctor()
		ret
	}
}

.class private auto ansi beforefieldinit SpecialFlagHolder
	extends FlagHolder
{
	.method assembly hidebysig specialname 
		instance valuetype Flags get_SpecialFlags () cil managed 
	{
		.maxstack 8

		IL_0000: ldarg.0
		IL_0001: call instance int16 FlagHolder::get_Flags()
		IL_0006: ret
	}

	.method public hidebysig specialname rtspecialname 
		instance void .ctor () cil managed 
	{
		.maxstack 8

		IL_0000: ldarg.0
		IL_0001: call instance void FlagHolder::.ctor()
		IL_0006: ret
	}
}

.class private auto ansi sealed Flags
	extends [mscorlib]System.Enum
{
	.field public specialname rtspecialname int32 value__
}

.class private auto ansi beforefieldinit FlagHolder
	extends [mscorlib]System.Object
{
	// Fields
	.field private int16 'flags'

	.method family hidebysig specialname 
		instance int16 get_Flags () cil managed 
	{
		.maxstack 8

		ldarg.0
		ldfld int16 FlagHolder::'flags'
		ret
	}

	.method public hidebysig specialname rtspecialname 
		instance void .ctor () cil managed 
	{
		.maxstack 8

		ldarg.0
		call instance void [mscorlib]System.Object::.ctor()
		ret
	}
}

[AndyAyersMS]

Probably an overly broad assert. Will investigate.

[AndyAyersMS]

This is an assert in the Enum.HasFlags optimization. We roll back the boxes and try and operate on the values that were about to be boxed. But those values don't have to have the same types (here: short and int).

So one fix here is to adjust the types when they don't match. Not sure yet if we should use the smaller of the types, the larger of the types, or extend both (if short) to TYP_INT.

Or perhaps downstream code already tolerates mismatched sizes in the AND, and we don't have to do anything here except relax the assert.

[mikedn]

Or perhaps downstream code already tolerates mismatched sizes in the AND

There's really no such thing as mismatched types unless the types in question are int/long. But short/int is really int/int because small int typed nodes are assumed to produce "actual type" values, that is, int values.

The problem is that only certain nodes are expected to have small int types - indirs, lclvars, calls and maybe a few others. If this short node is something else or if the AND node itself is short then there may unexpected surprises.

[AndyAyersMS]

Seems like somewhat dodgy IL here. Before boxing one would expect values to converted to the enum's storage type. So simplest fix is probably just to bail entirely on mismatched pre-box types.

[AndyAyersMS]

Though implicit short->int should be ok (as box is operating on the stack type). So will just check for int/long cases.