Compilation problem in .Net 9.0

[rmn01]

Description

The problem appeared in the .Net 9.0, but it was not in the .Net 6,7,8.

It looks like this is a compile-time crash if you use a construct like this in a function:

long A = ...
long B = ...
if( (uint)A == (uint)B )
....

Then this condition will be compiled into assembler in such a way that a random other variable of the function that is currently in the RAX/EAX register may be overwritten.

The error appears only if the function has the attribute:
[MethodImpl(MethodImplOptions.AggressiveOptimization | ...)]

Compilation into release is mandatory.

If you put a breakpoint in the function, the error does not appear, the non-optimized function also works correctly, the non-release is also correct.

This is something obviously serious, I lost a couple of days until I realized what exactly was wrong, rewriting the function and changing the structure of its logic did not help, the bug remained.

The following modification of the condition helped:

if( ((uint)A).CompareTo((uint)B) == 0 )
...

I can't give you a piece of code, it's a commercial project, and the bug is deep inside. It's easier for me not to switch to 9.0, than to waste time on a test case for you.

Here is an example of assembler, where the register containing the variable that will be used later is being erased (RAX):

                                                                       Console.WriteLine("A {0} {1}", prev_point_val, prev_line_val2);
00007FFCB13DEA3D 48 8B 8C 24 00 01 00 00 mov         rcx,qword ptr [rsp+100h]  
00007FFCB13DEA45 E8 E6 93 AE 5F       call        CORINFO_HELP_NEWSFAST (07FFD10EC7E30h)  
00007FFCB13DEA4A 48 89 44 24 78       mov         qword ptr [rsp+78h],rax  
00007FFCB13DEA4F 48 8B 94 24 88 01 00 00 mov         rdx,qword ptr [rsp+188h]  
00007FFCB13DEA57 48 89 50 08          mov         qword ptr [rax+8],rdx  
00007FFCB13DEA5B 48 8B 8C 24 00 01 00 00 mov         rcx,qword ptr [rsp+100h]  
00007FFCB13DEA63 E8 C8 93 AE 5F       call        CORINFO_HELP_NEWSFAST (07FFD10EC7E30h)  
00007FFCB13DEA68 4C 8B 94 24 80 01 00 00 mov         r10,qword ptr [rsp+180h]  
00007FFCB13DEA70 4C 89 50 08          mov         qword ptr [rax+8],r10  
00007FFCB13DEA74 4C 8B C0             mov         r8,rax  
00007FFCB13DEA77 48 8B 54 24 78       mov         rdx,qword ptr [rsp+78h]  
00007FFCB13DEA7C 48 B9 C0 52 75 E4 2D 02 00 00 mov         rcx,22DE47552C0h  
00007FFCB13DEA86 FF 15 0C 6F 26 00    call        qword ptr [CLRStub[MethodDescPrestub]@00007FFCB1645998 (07FFCB1645998h)]  
                        if ((uint)(ulong)prev_point_val == (uint)(ulong)prev_line_val2)
00007FFCB13DEA8C 48 8B 84 24 88 01 00 00 mov         rax,qword ptr [rsp+188h]  
00007FFCB13DEA94 3B 84 24 80 01 00 00 cmp         eax,dword ptr [rsp+180h]  
00007FFCB13DEA9B 0F 85 4C 01 00 00    jne         ......+014ADh (07FFCB13DEBEDh)  
                            Console.WriteLine("B {0} {1}", prev_point_val, prev_line_val2);
00007FFCB13DEAA1 48 8B 8C 24 00 01 00 00 mov         rcx,qword ptr [rsp+100h]  
00007FFCB13DEAA9 E8 82 93 AE 5F       call        CORINFO_HELP_NEWSFAST (07FFD10EC7E30h)  
00007FFCB13DEAAE 48 89 44 24 60       mov         qword ptr [rsp+60h],rax  
00007FFCB13DEAB3 48 8B 94 24 80 01 00 00 mov         rdx,qword ptr [rsp+180h]  
00007FFCB13DEABB 48 89 50 08          mov         qword ptr [rax+8],rdx  
00007FFCB13DEABF 48 8B 8C 24 00 01 00 00 mov         rcx,qword ptr [rsp+100h]  
00007FFCB13DEAC7 E8 64 93 AE 5F       call        CORINFO_HELP_NEWSFAST (07FFD10EC7E30h)  
00007FFCB13DEACC 4C 8B 94 24 80 01 00 00 mov         r10,qword ptr [rsp+180h]  
00007FFCB13DEAD4 4C 89 50 08          mov         qword ptr [rax+8],r10  
00007FFCB13DEAD8 4C 8B C0             mov         r8,rax  
00007FFCB13DEADB 48 8B 54 24 60       mov         rdx,qword ptr [rsp+60h]  
00007FFCB13DEAE0 48 B9 E8 52 75 E4 2D 02 00 00 mov         rcx,22DE47552E8h  
00007FFCB13DEAEA FF 15 A8 6E 26 00    call        qword ptr [CLRStub[MethodDescPrestub]@00007FFCB1645998 (07FFCB1645998h)]  

The result of running this code:

A 5025111736369 -48344151883727
B -48344151883727 -48344151883727

I think there are only 3 lines here, you can repeat this failure.

Reproduction Steps

No data

Expected behavior

No data

Actual behavior

No data

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[AndyAyersMS]

So if I understand properly, the bug is that it should print

A 5025111736369 -48344151883727
B 5025111736369 -48344151883727

Right? If so, it seems like the issue is here in the second call sequence:

00007FFCB13DEAB3 48 8B 94 24 80 01 00 00 mov         rdx,qword ptr [rsp+180h] 

that offset should be 188h.

Can you set DOTNET_JitDisasm=methodName and send us the full listing for this method? If you need to send it privately you can find my work email on my github profile.

[rmn01]

Hi Andy,

So if I understand properly, the bug is that it should print ...

Yes, you are absolutely right, two identical lines (Console.WriteLine) should give the same result, since the variables did not change, there was only a comparison operation.

Right? If so, it seems like the issue is here in the second call sequence:

Yes, I think you're right.

Can you set DOTNET_JitDisasm=methodName

I'll try to do it today

Update: I sent you the function code by email (mailing address is different, Subject: "issues 111352")

[AndyAyersMS]

Looks like it is a bad assertion during morph:

fgMorphTree BB48, STMT00156 (before)
               [000603] -----------                         *  JTRUE     void  
               [000602] N--------U-                         \--*  NE        int   
               [000599] -----------                            +--*  CAST      int <- uint <- long
               [000598] -----------                            |  \--*  LCL_VAR   long   V35 loc28        
               [000601] -----------                            \--*  CAST      int <- uint <- long
               [000600] -----------                               \--*  LCL_VAR   long   V37 loc30        
GenTreeNode creates [if true] assertion:
               [000603] -----+-----                         *  JTRUE     void  
In BB48 New Local Copy     Assertion: V35 != V37, index = #67
GenTreeNode creates [if false] assertion:
               [000603] -----+-----                         *  JTRUE     void  
In BB48 New Local Copy     Assertion: V35 == V37, index = #68

We mistakenly think the comparison of the low parts of these two values implies something about the comparison of the values as a whole.

This repros in main.

[AndyAyersMS]

Simple repro

Problem(0x1_0000_0001L, 0x2_0000_0001L);

public static void Problem(long x, long y)
{
    if ((uint)x == (uint)y)
    {
        Console.WriteLine("(uint) x == (uint) y");
        if (x == y)
        {
            Console.WriteLine("x == y");
        }
    }
}

prints

(uint) x == (uint) y
x == y