Spilling can overwrite adjacent stack parameters on ARM64 macOS ABI

[SingleAccretion]

Reproduction:

[MethodImpl(MethodImplOptions.NoInlining)]
private static int Problem(int x0, int x1, int x2, int x3, int x4, int x5, int x6, int x7, short stk0, short stk1)
{
    [MethodImpl(MethodImplOptions.NoInlining)]
    static int Call(int k) => 0;

    stk1 = (short)(stk0 + stk1 + stk0);

    Call(stk1);

    return stk0 + stk1;
}

Compile with CG2: --targetarch:arm64 --targetos:OSX --codegenopt NgenDump=Problem --codegenopt JitNoCSE=1 --codegenopt JitStressRegs=2.

Expected result: spilling of the small stack parameters cannot overwrite anything.

Actual result: it can, due to using TYP_INT-wide stores:

IN0014: 000008  B94013A1          ldr     w1, [fp,#16]  // [V08 arg8]
IN0015: 00000C  B84123A2          ldr     w2, [fp,#18]  // [V09 arg9]

...

IN0008: 00002C  B90013A1          str     w1, [fp,#16]

Also see #67152.

[ghost]

Tagging subscribers to this area: @JulieLeeMSFT
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Reproduction:

[MethodImpl(MethodImplOptions.NoInlining)]
private static int Problem(int x0, int x1, int x2, int x3, int x4, int x5, int x6, int x7, short stk0, short stk1)
{
    [MethodImpl(MethodImplOptions.NoInlining)]
    static int Call(int k) => 0;

    stk1 = (short)(stk0 + stk1 + stk0);

    Call(stk1);

    return stk0 + stk1;
}

Compile with CG2: --targetarch:arm64 --targetos:OSX --codegenopt NgenDump=Problem --codegenopt JitNoCSE=1 --codegenopt JitStressRegs=2.

Expected result: spilling of the small stack parameters cannot overwrite anything.

Actual result: it can, due to using TYP_INT-wide stores:

IN0014: 000008  B94013A1          ldr     w1, [fp,#16]  // [V08 arg8]
IN0015: 00000C  B84123A2          ldr     w2, [fp,#18]  // [V09 arg9]

...

IN0008: 00002C  B90013A1          str     w1, [fp,#16]

Essentially this is the same issue as in #67152.

Author:	SingleAccretion
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[am11]

Similar case #66720 (comment)

[sandreenko]

@AndyAyersMS I can't comment in #52039 (comment) because it is locked but I think you are right.
The root case is that there are 2 scenarios:

1. local lives in a register and due to register pressure we need to spill it and we allocate a new stack slot for it. This stack slot always is at least TARGET_POINTER_SIZE wide;
2. local comes on a stack, gets temporary allocated to a register and then needs to be spilled. We don't need to allocate a new spill stack space because because we can reuse the stack index that it came on. However, on mac arm64 abi this stack space can be less than TARGET_POINTER_SIZE.

I would try a radical fix first in:

runtime/src/coreclr/jit/lclvars.cpp

Lines 3820 to 3824 in 6627183

	var_types LclVarDsc::GetActualRegisterType() const
	{
	return genActualType(GetRegisterType());
	}

instead do:

var_types LclVarDsc::GetActualRegisterType() const
{
#ifdef OSX_ARM64_ABI
   if (lclVar->is argument stack slot) 
   {
       return GetRegisterType();
    }
#endif

    return genActualType(GetRegisterType());
}

[AndyAyersMS]

I'll fix this since OSR is seeing a related issue.