From c789ef84e071a7a93ef22779cc4f1f23c80c9a57 Mon Sep 17 00:00:00 2001
From: Jakob Botsch Nielsen <jakob.botsch.nielsen@gmail.com>
Date: Fri, 23 Sep 2022 11:55:22 +0200
Subject: [PATCH 1/3] Add a test

---
 .../JitBlue/Runtime_76051/Runtime_76051.cs    | 19 +++++++++++++++++++
 .../Runtime_76051/Runtime_76051.csproj        |  9 +++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 src/tests/JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.cs
 create mode 100644 src/tests/JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.csproj

diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.cs b/src/tests/JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.cs
new file mode 100644
index 00000000000000..c95666b0f834c4
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.cs
@@ -0,0 +1,19 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Runtime.CompilerServices;
+
+public class Runtime_76051
+{
+    public static int Main(string[] args)
+    {
+        GetIndex(1);
+        return 100;
+    }
+
+    // This tests an assertion failure (debug)/segfault (release) in
+    // fgMorphModToSubMulDiv due to the use of gtClone that fails for the
+    // complex tree seen for the address-of expression.
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    static unsafe int GetIndex(uint cellCount) => (int)((ulong)&cellCount % cellCount);
+}
diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.csproj b/src/tests/JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.csproj
new file mode 100644
index 00000000000000..f492aeac9d056b
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.csproj
@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <Optimize>True</Optimize>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="$(MSBuildProjectName).cs" />
+  </ItemGroup>
+</Project>
\ No newline at end of file

From af7c2193c02b77ae153e5682ab0de7f0515534a0 Mon Sep 17 00:00:00 2001
From: Jakob Botsch Nielsen <jakob.botsch.nielsen@gmail.com>
Date: Fri, 23 Sep 2022 11:55:33 +0200
Subject: [PATCH 2/3] JIT: Use gtCloneExpr in fgMorphModToSubMulDiv for
 potentially complex trees

We may get here for any invariant dividend/divisor but these can be
'complex' address-of trees that gtClone does not handle.

Fix #76051
---
 src/coreclr/jit/morph.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/coreclr/jit/morph.cpp b/src/coreclr/jit/morph.cpp
index dcf1fd4c619ad5..31fe8c0b4ac186 100644
--- a/src/coreclr/jit/morph.cpp
+++ b/src/coreclr/jit/morph.cpp
@@ -13494,8 +13494,8 @@ GenTree* Compiler::fgMorphModToSubMulDiv(GenTreeOp* tree)
     GenTree* dividend = div->IsReverseOp() ? opB : opA;
     GenTree* divisor  = div->IsReverseOp() ? opA : opB;
 
-    div->gtOp1 = gtClone(dividend);
-    div->gtOp2 = gtClone(divisor);
+    div->gtOp1 = gtCloneExpr(dividend);
+    div->gtOp2 = gtCloneExpr(divisor);
 
     var_types      type = div->gtType;
     GenTree* const mul  = gtNewOperNode(GT_MUL, type, div, divisor);

From f5af6d81971c7b8c4208e42489d91b3387307ef9 Mon Sep 17 00:00:00 2001
From: Jakob Botsch Nielsen <jakob.botsch.nielsen@gmail.com>
Date: Fri, 23 Sep 2022 13:21:46 +0200
Subject: [PATCH 3/3] Fix test build

---
 .../JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.csproj    | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.csproj b/src/tests/JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.csproj
index f492aeac9d056b..0f9eec3d705fb2 100644
--- a/src/tests/JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.csproj
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_76051/Runtime_76051.csproj
@@ -2,6 +2,7 @@
   <PropertyGroup>
     <OutputType>Exe</OutputType>
     <Optimize>True</Optimize>
+    <AllowUnsafeBlocks>True</AllowUnsafeBlocks>
   </PropertyGroup>
   <ItemGroup>
     <Compile Include="$(MSBuildProjectName).cs" />