Assertion failed 'isRegAvailable(reg, physRegRecord->registerType)' in 'testout1:Func_0_5_2_4():float' during 'LSRA build intervals'

[BruceForstall]

Linux arm Checked jitstressregs0x80

https://dev.azure.com/dnceng/public/_build/results?buildId=921372&view=ms.vss-test-web.build-test-results-tab&runId=29270552&paneView=debug

    JIT/Methodical/fp/exgen/10w5d_cs_do/10w5d_cs_do.sh [FAIL]
      
      Assert failure(PID 3108 [0x00000c24], Thread: 3108 [0x0c24]): Assertion failed 'isRegAvailable(reg, physRegRecord->registerType)' in 'testout1:Func_0_5_2_4():float' during 'LSRA build intervals' (IL size 212)
      
          File: /__w/1/s/src/coreclr/jit/lsra.cpp Line: 5473
          Image: /root/helix/work/correlation/corerun

category:correctness
theme:register-allocator
skill-level:expert
cost:small

[BruceForstall]

@kunalspathak

[BruceForstall]

Also seen for JIT/Regression/CLR-x86-JIT/V1.2-M01/b16570/b16570/b16570.sh in jitstress2-jitstressregs0x80:

https://dev.azure.com/dnceng/public/_build/results?buildId=921349&view=ms.vss-test-web.build-test-results-tab&runId=29270174&resultId=108316&paneView=debug

[BruceForstall]

Also seen in

https://dev.azure.com/dnceng/public/_build/results?buildId=921374&view=ms.vss-test-web.build-test-results-tab&runId=29267158&resultId=174407&paneView=dotnet-dnceng.dnceng-build-release-tasks.helix-test-information-tab

net6.0-Linux-Release-arm-CoreCLR_checked-jitstress2_jitstressregs0x80

Microsoft.VisualBasic.Core.Tests

[VincentBu]

Failed in job : runtime-coreclr jitstressregs 20210110.1

Failed tests:
JIT/Methodical/fp/exgen/10w5d_cs_do/10w5d_cs_do.sh
JIT/superpmi/superpmicollect/10w5d_cs_do/10w5d_cs_do.sh

CoreCLR Linux arm Checked jitstressregs0x80 @ (Ubuntu.1804.Arm32.Open)Ubuntu.1804.Armarch.Open@mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-18.04-helix-arm32v7-bfcd90a-20200121150440

Error message:

Assert failure(PID 1049 [0x00000419], Thread: 1049 [0x0419]): Assertion failed 'isRegAvailable(reg, physRegRecord->registerType)' in 'testout1:Func_0_5_2_4():float' during 'LSRA build intervals' (IL size 212)
    File: /__w/1/s/src/coreclr/jit/lsra.cpp Line: 5473
    Image: /root/helix/work/correlation/corerun
/root/helix/work/workitem/JIT/Methodical/fp/exgen/10w5d_cs_do/10w5d_cs_do.sh: line 364:  1049 Aborted                 (core dumped) $LAUNCHER $ExePath "${CLRTestExecutionArguments[@]}"
Return code:      1
Raw output file:      /root/helix/work/workitem/JIT/Methodical/Reports/JIT.Methodical/fp/exgen/10w5d_cs_do/10w5d_cs_do.output.txt
Raw output:
BEGIN EXECUTION\n/root/helix/work/correlation/corerun 10w5d_cs_do.dll ''

Func_0_6_5_6_3: != true\nFunc_0_6_5_4_6: <= true\nFunc_0_6_5_4_5: > true\nFunc_0_6_5_4_3: == false\nFunc_0_6_4_6_2: != true\nFunc_0_6_4_5_4: < true\nFunc_0_6_4_5_1: < true\nFunc_0_6_4_4: <= true\nFunc_0_6_3_6_5: == false\nFunc_0_6_3_4_4: <= true\nFunc_0_6_3_4_3: < true\nFunc_0_6_3_3: < true\nFunc_0_6_3_2_3: >= true\nFunc_0_6_3_1_5: < true\nFunc_0_6_3_1: <= false\nFunc_0_6_3: != true\nFunc_0_6_2_5: != true\nFunc_0_6_2_1: > false\nFunc_0_6_1_6_4: < false\nFunc_0_6_1_6_3: > false\nFunc_0_6_1_5_4: > true\nFunc_0_6_1_3: == false\nFunc_0_5_6_6_6: <= true\nFunc_0_5_6_6_1: > true\nFunc_0_5_6_4_6: <= false\nFunc_0_5_6_4_2: >= false\nFunc_0_5_6_3_6: < false\nFunc_0_5_6_3_1: == false\nFunc_0_5_6_3: <= true\nFunc_0_5_6_2_1: >= false\nFunc_0_5_6_1_3: > true\nFunc_0_5_6_1: <= false\nFunc_0_5_5_6: != true\nFunc_0_5_5_5_6: != true\nFunc_0_5_5_5_4: == false\nFunc_0_5_5_5_2: == false\nFunc_0_5_5_4_5: < true\nFunc_0_5_5_4: > true\nFunc_0_5_5_3_4: != true\nFunc_0_5_5_3_2: <= true\nFunc_0_5_5_3_1: > true\nFunc_0_5_5_1: < false\nFunc_0_5_4_5: >= false\nFunc_0_5_4_1_3: <= false\nFunc_0_5_4_1_2: == false\nFunc_0_5_4: != true\nFunc_0_5_3_6: != true\nFunc_0_5_3_5_3: < true\nFunc_0_5_3_4_2: == false\nFunc_0_5_3_4_1: >= true\nFunc_0_5_3_4: <= true\nFunc_0_5_3_1_2: < true\nFunc_0_5_3: >= false\nFunc_0_5_2_6_6: != true\nFunc_0_5_2_6_3: != true\nFunc_0_5_2_5_6: != true\nFunc_0_5_2_5_4: == false\nFunc_0_5_2_5_3: <= true\nFunc_0_5_2_5_2: != true
Gathering state for process 1049 corerun
Writing minidump with heap to file /home/helixbot/dotnetbuild/dumps/coredump.1049.dmp
Written 63438848 bytes (15488 pages) to core file
Dump successfully written
Expected: 100
Actual: 134
END EXECUTION - FAILED
Test Harness Exitcode is : 1
To run the test:
> set CORE_ROOT=/root/helix/work/correlation
> /root/helix/work/workitem/JIT/Methodical/fp/exgen/10w5d_cs_do/10w5d_cs_do.sh
Expected: True
Actual:   False


Stack trace
   at JIT_Methodical._fp_exgen_10w5d_cs_do_10w5d_cs_do_._fp_exgen_10w5d_cs_do_10w5d_cs_do_sh()

[JulieLeeMSFT]

@kunalspathak Please priority to look into this issue.

[kunalspathak]

Update: I was able to repro this on linux arm as well as on windows x64 using altjit. Investing...

[kunalspathak]

Update:

The assert is triggered as part of the verification that makes sure that if an interval is not assigned to a register, it should be available. However, in this case, we fail to record that fact in global table m_AvailableRegs.

From the JIT dump below, just before we hit an assert, we are allocating for ref position 343. We can see that register f9 is free. The contents in the table below are printed based on the fact that if an interval is assigned to a RegRecord or not. In this case, it is not and hence shows that it is free. However, m_AvailableRegs don't have the corresponding bit for f9 set and we hit the assert.

--------------------------------+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
Loc RP#  Name Type  Action Reg  |r0  |r1  |r2  |r3  |r4  |r5  |f0  |f1  |f2  |f6  |f7  |f8  |f9  |f10 |f11 |f12 |f13 |f14 |f15 |f16 |f17 |f18 |f19 |
--------------------------------+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
167.#342 I61  Use *  Keep  r2   |    |    |I61a|I60a|V3 a|V6 a|V0 a|    |    |    |    |V5 a|    |V4 a|V4 a|V1 a|V1 a|I59a|I59a|V7 a|V12a|V16a|V16a|

The verification code was newly added in #45135. So I went ahead and reverted the changes in #45135 and confirmed that the RegRecord for f10 is indeed not set i.e. the register is free, but earlier we never verified it. With #45135 uncovers this issue. I will work on the fix.