Assertion failed '(info.compCompHnd->getClassAttribs(fldCls) & CORINFO_FLG_VALUECLASS) == 0' during 'Do value numbering'

[kunalspathak]

Found by Antigen:

With COMPlus_JitOptRepeat=*, we hit an assert during value numbering.

using System;
using System.Collections.Generic;
using System.Runtime.CompilerServices;
public class TestClass
{
    public struct S1
    {
        public struct S1_D1_F1
        {
            public double double_2;
        }
        public int int_4;
    }
    public struct S2
    {
        public S1.S1_D1_F1 s1_s1_d1_f1_6;
    }
    static decimal s_decimal_11 = 1.0533333333333333333333333333m;
    static int s_int_14 = 2;
    static S1 s_s1_23 = new S1();
    static S2 s_s2_24 = new S2();
    decimal decimal_28 = -4.8787878787878787878787878788m;
    int int_31 = -5;
    sbyte sbyte_33 = 1;
    ushort ushort_36 = 15;
    S1 s1_40 = new S1();
    S2 s2_41 = new S2();
    public int LeafMethod6()
    {
        unchecked
        {
            return s_s1_23.int_4 / 15+4<< (s_int_14 |= s_int_14 / (s_s1_23.int_4 += s1_40.int_4)+ 41);
        }
    }
    public ushort Method3(decimal p_decimal_82, ref sbyte p_sbyte_83, S1 p_s1_84, out S2 p_s2_85, out S2 p_s2_86, double p_double_87, short p_short_88)
    {
        unchecked
        {
            p_s2_85 = s2_41;
            p_s2_86 = s_s2_24;
            return ushort_36 <<= int_31 += s1_40.int_4 /= 15+4;
        }
    }
    public void Method0()
    {
        unchecked
        {
            short short_131 = 0;
            S2 s2_142 = new S2();
            S2 s2_143 = s2_142;
            ushort_36 = Method3(decimal_28 += s_decimal_11 *= 15+4, ref sbyte_33, s1_40, out s2_143, out s_s2_24, s2_143.s1_s1_d1_f1_6.double_2, (short)((short_131 |= (short)(2 << LeafMethod6()))% 15+4));
            return;
        }
    }
    public static void Main(string[] args)
    {
        new TestClass().Method0();
    }
}
/*
Got output diff:

--------- Test ---------  

Environment:

set COMPlus_TieredCompilation=0
set COMPlus_JitOptRepeat=*

Assert failure(PID 26888 [0x00006908], Thread: 7044 [0x1b84]): Assertion failed '(info.compCompHnd->getClassAttribs(fldCls) & CORINFO_FLG_VALUECLASS) == 0' in 'TestClass:LeafMethod6():int:this' during 'Do value numbering' (IL size 69)
    File: D:\git\runtime\src\coreclr\jit\valuenum.cpp Line: 9016
    Image: D:\git\runtime\artifacts\tests\coreclr\windows.x64.Checked\tests\Core_Root\CoreRun.exe
*/

[ghost]

Tagging subscribers to this area: @JulieLeeMSFT
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Found by Antigen:

With COMPlus_JitOptRepeat=*, we hit an assert during value numbering.

using System;
using System.Collections.Generic;
using System.Runtime.CompilerServices;
public class TestClass
{
    public struct S1
    {
        public struct S1_D1_F1
        {
            public double double_2;
        }
        public int int_4;
    }
    public struct S2
    {
        public S1.S1_D1_F1 s1_s1_d1_f1_6;
    }
    static decimal s_decimal_11 = 1.0533333333333333333333333333m;
    static int s_int_14 = 2;
    static S1 s_s1_23 = new S1();
    static S2 s_s2_24 = new S2();
    decimal decimal_28 = -4.8787878787878787878787878788m;
    int int_31 = -5;
    sbyte sbyte_33 = 1;
    ushort ushort_36 = 15;
    S1 s1_40 = new S1();
    S2 s2_41 = new S2();
    public int LeafMethod6()
    {
        unchecked
        {
            return s_s1_23.int_4 / 15+4<< (s_int_14 |= s_int_14 / (s_s1_23.int_4 += s1_40.int_4)+ 41);
        }
    }
    public ushort Method3(decimal p_decimal_82, ref sbyte p_sbyte_83, S1 p_s1_84, out S2 p_s2_85, out S2 p_s2_86, double p_double_87, short p_short_88)
    {
        unchecked
        {
            p_s2_85 = s2_41;
            p_s2_86 = s_s2_24;
            return ushort_36 <<= int_31 += s1_40.int_4 /= 15+4;
        }
    }
    public void Method0()
    {
        unchecked
        {
            short short_131 = 0;
            S2 s2_142 = new S2();
            S2 s2_143 = s2_142;
            ushort_36 = Method3(decimal_28 += s_decimal_11 *= 15+4, ref sbyte_33, s1_40, out s2_143, out s_s2_24, s2_143.s1_s1_d1_f1_6.double_2, (short)((short_131 |= (short)(2 << LeafMethod6()))% 15+4));
            return;
        }
    }
    public static void Main(string[] args)
    {
        new TestClass().Method0();
    }
}
/*
Got output diff:

--------- Test ---------  

Environment:

set COMPlus_TieredCompilation=0
set COMPlus_JitOptRepeat=*

Assert failure(PID 26888 [0x00006908], Thread: 7044 [0x1b84]): Assertion failed '(info.compCompHnd->getClassAttribs(fldCls) & CORINFO_FLG_VALUECLASS) == 0' in 'TestClass:LeafMethod6():int:this' during 'Do value numbering' (IL size 69)
    File: D:\git\runtime\src\coreclr\jit\valuenum.cpp Line: 9016
    Image: D:\git\runtime\artifacts\tests\coreclr\windows.x64.Checked\tests\Core_Root\CoreRun.exe
*/

Author:	kunalspathak
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[kunalspathak]

@dotnet/jit-contrib

[SingleAccretion]

This is an issue with pattern matching in IsFieldAddr.

This is the tree in question:

***** BB01, STMT00001(before)
N015 ( 31, 22) [000020] -A-XG---R---              *  ASG       int
N014 (  1,  1) [000019] D------N----              +--*  LCL_VAR   int    V04 tmp2         d:2
N013 ( 31, 22) [000008] -A-XG-------              \--*  ADD       int
N011 ( 29, 20) [000006] -A-XG-------                 +--*  DIV       int
N009 (  8, 16) [000004] *A-XG-------                 |  +--*  IND       int
N008 (  6, 14) [000003] -A-----N----                 |  |  \--*  ADD       byref
N006 (  5, 13) [000064] -A----------                 |  |     +--*  COMMA     ref
N004 (  4, 12) [000062] -A------R---                 |  |     |  +--*  ASG       ref
N003 (  1,  1) [000061] D------N----                 |  |     |  |  +--*  LCL_VAR   ref    V09 cse0         d:2
N002 (  4, 12) [000001] n-----------                 |  |     |  |  \--*  IND       ref
N001 (  2, 10) [000000] I-----------                 |  |     |  |     \--*  CNS_INT(h) long   0x2ac48902e98 static Fseq[s_s1_23]
N005 (  1,  1) [000063] ------------                 |  |     |  \--*  LCL_VAR   ref    V09 cse0         u:2
N007 (  1,  1) [000002] ------------                 |  |     \--*  CNS_INT   long   8 Fseq[#FirstElem, int_4]
N010 (  1,  1) [000005] ------------                 |  \--*  CNS_INT   int    15
N012 (  1,  1) [000007] ------------                 \--*  CNS_INT   int    4

N001 [000000]   CNS_INT(h) 0x2ac48902e98 static Fseq[s_s1_23] => $100 {Hnd const: 0x000002AC48902E98}
N002 [000001]   IND       => <l:$140 {ByrefExposedLoad($42, $100, $81)}, c:$82 {MemOpaque:NotInLoop}>
N003 [000061]   LCL_VAR   V09 cse0         d:2 => <l:$140 {ByrefExposedLoad($42, $100, $81)}, c:$82 {MemOpaque:NotInLoop}>
N004 [000062]   ASG       => <l:$140 {ByrefExposedLoad($42, $100, $81)}, c:$82 {MemOpaque:NotInLoop}>
N005 [000063]   LCL_VAR   V09 cse0         u:2 => <l:$140 {ByrefExposedLoad($42, $100, $81)}, c:$82 {MemOpaque:NotInLoop}>
N006 [000064]   COMMA     => <l:$140 {ByrefExposedLoad($42, $100, $81)}, c:$82 {MemOpaque:NotInLoop}>
N007 [000002]   CNS_INT   8 Fseq[#FirstElem, int_4] => $180 {LngCns:  8}
N008 [000003]   ADD       => <l:$1c1 {ADD($140, $180)}, c:$1c0 {ADD($82, $180)}>

Assert failure(PID 18916 [0x000049e4], Thread: 7800 [0x1e78]): Assertion failed '(info.compCompHnd->getClassAttribs(fldCls) & CORINFO_FLG_VALUECLASS) == 0' in 'RyuJitReproduction.Program:Problem():int:this' during 'Do value numbering' (IL size 69)

    File: C:\Users\Accretion\source\dotnet\runtime\src\coreclr\jit\valuenum.cpp Line: 9021
    Image: C:\Users\Accretion\source\dotnet\runtime\artifacts\tests\coreclr\windows.x64.Checked\Tests\Core_Root\CoreRun.exe

For instance fields, IsFieldAddr looks for the pattern of ADD byref (ref, CNS_INT fldSeq). And it finds it here. Of course, this is not correct, since this is the special "boxed static" case. It could detect something is not quite right by noticing that #FirstElem starts the field sequence, but does not (and this is a little risky anyway, as that pseudo-field is used for arrays as well).

Ordinarily, failure on this assert means silent bad codegen is a likely outcome. Fortunately, we don't renumber maps after CSE in a normal (non-JitOptRepeat) compilation. There are ways to make "CSE"s before CSE, but none that I am aware of which could allow to "hoist" the IND that was CSEed from under the ADD, which it always comes with.

Will put this under the umbrella of #58312 for the time being. The handling of the myriad shapes (even just conceptually there are 4/6) that static field access can take in VN is not great.

[JulieLeeMSFT]

Thanks @SingleAccretion for looking into this.