JIT: Assertion failed 'tree->IsCall() || tree->OperIs(GT_COMMA)' during 'Stress gtSplitTree'

[jakobbotsch]

Seen in https://dev.azure.com/dnceng-public/public/_build/results?buildId=207037&view=ms.vss-test-web.build-test-results-tab&runId=3846126&resultId=116663&paneView=dotnet-dnceng.dnceng-build-release-tasks.helix-test-information-tab.

Assert failure(PID 2810 [0x00000afa], Thread: 2810 [0x0afa]): Assertion failed 'tree->IsCall() || tree->OperIs(GT_COMMA)' in 'JIT.HardwareIntrinsics.General._Vector256.VectorWidenTest__WidenInt16:RunReflectionScenario_UnsafeRead():this' during 'Stress gtSplitTree' (IL size 301; hash 0xf9eeacfa; MinOpts)

    File: /__w/1/s/src/coreclr/jit/fgdiagnostic.cpp Line: 3166
    Image: /datadisks/disk1/work/A86B0945/p/corerun

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch, @kunalspathak
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Seen in https://dev.azure.com/dnceng-public/public/_build/results?buildId=207037&view=ms.vss-test-web.build-test-results-tab&runId=3846126&resultId=116663&paneView=dotnet-dnceng.dnceng-build-release-tasks.helix-test-information-tab.

Author:	jakobbotsch
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[jakobbotsch]

This will only happen in CI once we merge #79283 -- it is adding a stress mode that changes the stress decisions made.
The problem is that we have a tree that looks like:

N018 ( 38, 33) [000327] -ACXGO----- arg1 setup              ├──▌  COMMA     simd32
N011 ( 28, 25) [000328] -ACXGO-----                         │  ├──▌  COMMA     void  
N008 ( 24, 22) [000320] -ACXG---R--                         │  │  ├──▌  ASG       byref 
N007 (  3,  2) [000319] D------N---                         │  │  │  ├──▌  LCL_VAR   byref  V50 tmp45        
N006 ( 20, 19) [000126] --CXG------                         │  │  │  └──▌  CALL help byref  CORINFO_HELP_UNBOX
N004 (  3,  2) [000124] ----------- arg1 in rsi             │  │  │     ├──▌  LCL_VAR   ref    V02 loc1         
N005 (  3, 10) [000125] H---------- arg0 in rdi             │  │  │     └──▌  CNS_INT(h) long   0x7f6e4bb0e500 class
N010 (  4,  3) [000322] ---X-O-----                         │  │  └──▌  NULLCHECK byte  
N009 (  3,  2) [000321] -----------                         │  │     └──▌  LCL_VAR   byref  V50 tmp45        
N017 ( 10,  8) [000331] -A-XGO--R--                         │  └──▌  ASG       simd32 (copy)
N016 (  3,  2) [000330] D------N---                         │     ├──▌  LCL_VAR   simd32 V51 tmp46        
N015 (  6,  5) [000329] ---XGO-N---                         │     └──▌  IND       simd32
N014 (  4,  3) [000326] -----O-N---                         │        └──▌  ADD       byref 
N012 (  3,  2) [000324] -----O-----                         │           ├──▌  LCL_VAR   byref  V50 tmp45        
N013 (  1,  1) [000325] -----------                         │           └──▌  CNS_INT   long   32

I.e. simd32 typed comma but the "value" is a simd32 assignment. gtSplitTree ends up creating

N016 ( 14, 11) [000428] -A-XGO--R--                         └──▌  ASG       simd32 (copy)
N015 (  3,  2) [000427] D------N---                            ├──▌  LCL_VAR   simd32 V76 tmp71        
N014 ( 10,  8) [000331] -A-XGO-NR--                            └──▌  ASG       simd32 (copy)
N013 (  3,  2) [000330] D------N---                               ├──▌  LCL_VAR   simd32 V51 tmp46        
N012 (  6,  5) [000329] ---XGO-N---                               └──▌  IND       simd32
N011 (  4,  3) [000326] -----O-N---                                  └──▌  ADD       byref 
N009 (  3,  2) [000324] -----O-----                                     ├──▌  LCL_VAR   byref  V50 tmp45        
N010 (  1,  1) [000325] -----------                                     └──▌  CNS_INT   long   32