Assertion failed 'comp->compCurBB->HasFlag(BBF_GC_SAFE_POINT) || comp->fgFirstBB->HasFlag(BBF_GC_SAFE_POINT)' during 'Lowering nodeinfo'

[kunalspathak]

// Found by Antigen
// Reduced from 11.53 KB to 1.76 KB.


using System;
using System.Collections.Generic;
using System.Runtime.CompilerServices;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.Arm;
using System.Runtime.Intrinsics.X86;
using System.Numerics;
public class TestClass
{
    public struct S1
    {
    }
    public struct S2
    {
        public struct S2_D1_F1
        {
        }
    }
    static byte s_byte_5 = 5;
    static short s_short_9 = 2;
    float float_31 = -5f;
    S1 s1_37 = new S1();
    S2.S2_D1_F1 s2_s2_d1_f1_38 = new S2.S2_D1_F1();
    static int s_loopInvariant = 6;
    private static List<string> toPrint = new List<string>();
    [MethodImpl(MethodImplOptions.NoInlining)]
    public short LeafMethod5()
    {
        unchecked
        {
            return 15%4;
        }
    }
    public short Method1(byte p_byte_40, out S2.S2_D1_F1 p_s2_s2_d1_f1_41, ref S2.S2_D1_F1 p_s2_s2_d1_f1_42, ref S1 p_s1_43, ref byte p_byte_44)
    {
        unchecked
        {
            ulong ulong_58 = 41;
            int __loopvar0 = 15-4;
            while (float_31 > float_31)
            {
                if (__loopvar0 > s_loopInvariant)
                    break;
            }
            Log("ulong_58", ulong_58);
            return LeafMethod5();
        }
    }
    public void Method0()
    {
        unchecked
        {
            s_short_9 = Method1(15-4, out s2_s2_d1_f1_38, ref s2_s2_d1_f1_38, ref s1_37, ref s_byte_5);
            return;
        }
    }
    public static int Main(string[] args)
    {
        return Antigen();
    }
    public static int Antigen()
    {
        new TestClass().Method0();
        return string.Join(Environment.NewLine, toPrint).GetHashCode();
    }
    [MethodImpl(MethodImplOptions.NoInlining)]
    public static void Log(string varName, object varValue)
{}}
/*
Environment:

set DOTNET_TieredPGO_InstrumentedTierAlwaysOptimized=1
set DOTNET_JitRandomGuardedDevirtualization=1
set DOTNET_TailcallStress=1
set DOTNET_JitRandomEdgeCounts=1
set DOTNET_JitRandomOnStackReplacement=5
set DOTNET_TieredCompilation=0
set DOTNET_PreferredVectorBitWidth=512
set DOTNET_JitStressRegs=0x1000
set DOTNET_EnableSSE42=0
set DOTNET_EnableSSE3_4=1
set DOTNET_JitThrowOnAssertionFailure=1
set DOTNET_LegacyExceptionHandling=1

Debug: 1681498316

Release: 0
JIT assert failed:
Assertion failed 'comp->compCurBB->HasFlag(BBF_GC_SAFE_POINT) || comp->fgFirstBB->HasFlag(BBF_GC_SAFE_POINT)' in 'TestClass:Method1(byte,byref,byref,byref,byref):short:this' during 'Lowering nodeinfo' (IL size 54; hash 0xe71d7156; FullOpts)

    File: D:\a\_work\1\s\src\coreclr\jit\lower.cpp Line: 3579


*/

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[kunalspathak]

Also seeing it in libraries-jitstress.

DOTNET_TailcallStress=1
DOTNET_TieredCompilation=0

[JulieLeeMSFT]

@amanasifkhalid, PTAL.

[amanasifkhalid]

Latest run of libraries-jitstress hit this assert. Upgrading this to blocking-optional

[amanasifkhalid]

If I run the reduced repro on win-x64, I hit a different assert:

Assert failure(PID 30624 [0x000077a0], Thread: 31100 [0x797c]): Assertion failed 'unreached' in 'System.Guid:FormatGuidVector128Utf8(System.Guid,bool):System.ValueTuple`3[System.Runtime.Intrinsics.Vector128`1[byte],System.Runtime.Intrinsics.Vector128`1[byte],System.Runtime.Intrinsics.Vector128`1[byte]]' during 'LSRA build intervals' (IL size 332; hash 0x10ce27ce; FullOpts)

    File: C:\wk\runtime\src\coreclr\jit\lsra.cpp:673
    Image: C:\wk\runtime\artifacts\tests\coreclr\windows.x64.Checked\Tests\Core_Root\corerun.exe

I'm going to open a separate issue for that failure, since they seem unrelated to one another.

[amanasifkhalid]

Loop inversion calls fgSplitBlockAtBeginning on the loop's exit block to keep the loop canonical after the transformation is finished. fgSplitBlockAtBeginning calls fgSplitBlockAtEnd, which gives the block an empty successor; fgSplitBlockAtBeginning then moves all of the original block's code into the successor. If the code fgSplitBlockAtBeginning moved into the new block contains a GC safe point, the corresponding flag has to be propagated to the new block, too.