Skip to content

Fix codegen assert reloading a spilled signed small cast source #130985

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tannergooding wants to merge 2 commits into
base: main
Choose a base branch
from
+287 −1
Open

Fix codegen assert reloading a spilled signed small cast source #130985

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
31fd405
Fix codegen assert reloading a spilled signed small cast source
tannergooding Jul 17, 2026
2662bd8
Convert regression test to merged format
tannergooding Jul 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion src/coreclr/jit/codegenlinear.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2555,7 +2555,11 @@ CodeGen::GenIntCastDesc::GenIntCastDesc(GenTreeCast* cast)

if (castIsLoad)
{
const var_types srcLoadType = src->TypeGet();
// A spill temp holds the full actual-type value, already extended per the source's own
// signedness, so it must be reloaded as that actual type rather than as a small memory
// operand -- otherwise a signed small source (e.g. TYP_BYTE) reloaded under a zero-extending
// cast would drop the sign bits it actually holds.
const var_types srcLoadType = src->isUsedFromSpillTemp() ? srcType : src->TypeGet();
Comment on lines +2558 to +2562

@jakobbotsch jakobbotsch Jul 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps castIsLoad should instead be false for this case? cc @SingleAccretion


switch (m_extendKind)
{
Expand Down
281 changes: 281 additions & 0 deletions src/tests/JIT/Regression/JitBlue/Runtime_124508/Runtime_124508.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,281 @@
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

// Generated by Fuzzlyn v3.3 on 2026-02-15 18:01:33
// Seed: 12192374036514626124
//
// A signed small load (sbyte[] element, materialized via movsx) that feeds a
// zero-extending cast to ushort could be spilled by LSRA under high register
// pressure (x86, FullOpts). GenIntCastDesc reloaded the spill temp as the small
// signed type, which asserted (and would have emitted a 1-byte movzx that drops
// the sign bits the temp actually holds) instead of reloading the full 4-byte
// actual type. Compiling M3 exercises the shape (in the switch's case 4).

namespace Runtime_124508;

using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;
using Xunit;

public class Runtime_124508
{
public static IRuntime s_rt;
public static sbyte[] s_1;
public static long s_3;
public static byte s_4;
public static Vector256<int> s_5;
public static ulong s_8;
public static byte s_12;
public static int s_13;
public static uint s_15;
public static uint s_16;
public static Vector256<ushort>[] s_17;
public static ulong[] s_18;
public static Vector128<uint> s_23 = Vector128.Create(0, 1U, 0, 0);

[Fact]
public static void TestEntryPoint()
{
s_rt = new Runtime();
try
{
M3();
}
catch { }
}

public static ushort M3()
{
Vector128<short>[] var1 = default(Vector128<short>[]);
uint var5 = default(uint);
Vector256<byte> var7 = default(Vector256<byte>);
Vector128<long> var9 = default(Vector128<long>);
uint var15 = default(uint);
Vector<byte> var18 = default(Vector<byte>);
sbyte[] var19 = default(sbyte[]);
byte var3 = 0;
Vector<short>[] var4 = new Vector<short>[]
{
Vector.Create<short>(0)
};
s_rt.WriteLine(var5);
try
{
throw new System.Exception();
}
catch (System.NotSupportedException)
{
var1 = new Vector128<short>[]
{
Vector128.Create<short>(0)
};
}
catch (System.NotImplementedException)
{
s_rt.WriteLine(var7);
}
catch (System.InvalidOperationException)
{
ulong var8 = s_8;
s_rt.WriteLine(var9);
long var10 = 0;
s_rt.WriteLine(var8);
s_rt.WriteLine(var10);
}
catch (System.ArgumentOutOfRangeException)
{
uint[][][] var11 = new uint[][][]
{
new uint[][]
{
new uint[] { 0 },
new uint[] { 0 },
new uint[] { 0 }
},
new uint[][]
{
new uint[] { 0 },
new uint[] { 0 }
},
new uint[][]
{
new uint[] { 0 }
},
new uint[][]
{
new uint[] { 0 },
new uint[] { 0 }
},
new uint[][]
{
new uint[] { 0 },
new uint[] { 0 },
new uint[] { 0 }
},
new uint[][]
{
new uint[] { 0 },
new uint[] { 0 },
new uint[] { 0 }
},
new uint[][]
{
new uint[] { 0 },
new uint[] { 0 },
new uint[] { 0 }
},
new uint[][]
{
new uint[] { 0 },
new uint[] { 0 },
new uint[] { 0 }
},
new uint[][]
{
new uint[] { 0 },
new uint[] { 0 }
}
};
s_rt.WriteLine(var11[0][0][0]);
}
catch (System.ArgumentNullException)
{
short var12 = 0;
Vector256<int> var13 = s_5;
s_rt.WriteLine(var12);
s_rt.WriteLine(var13);
}
catch (System.Exception)
{
s_1[0] >>= (int)Bmi1.BitFieldExtract(0, 0, var3);
Vector128.Create<long>(s_3);
}

s_rt.WriteLine(var3);
ushort[] var16 = new ushort[]
{
0
};
var vr4 = var1[0];
Sse2.CompareLessThan(vr4, Vector128.Create<short>((short)Bmi2.ParallelBitExtract(var15, var15)));
s_rt.WriteLine(var16[0]);
var1[0] = var1[0];
switch (s_13--)
{
case 0:
{
s_16 += M5();
Vector.Create<byte>(s_12);
s_rt.WriteLine(var18);
s_rt.WriteLine(var19[0]);
var vr1 = (byte)M11();
Vector128.Create<byte>(vr1);
}

break;
case 1:
{
Vector256<ushort>[] var20 = s_17;
ulong[] var21 = s_18;
s_rt.WriteLine(var20[0]);
s_rt.WriteLine(var21[0]);
}

break;
case -1:
{
sbyte var22 = s_1[0]++;
Vector128<short>[,, ] var25 = new Vector128<short>[,, ]
{
{
{
Vector128.Create(0, 0, 0, 0, 0, 0, 0, 0)
}
}
};
sbyte var26 = var22;
s_17[0] = s_17[0];
var vr3 = s_4++;
var vr0 = M5();
M9(vr0, (byte)Bmi2.ParallelBitExtract(s_15, (uint)Sse2.MoveMask(Vector128.CreateScalar((byte)0))), s_8--);
s_rt.WriteLine(var25[0, 0, 0]);
s_rt.WriteLine(var26);
s_rt.WriteLine(var22);
}

break;
case 3:
{
}

break;
case 4:
{
s_17[0] = s_17[0];
Vector128<int> var33 = Vector128.Create(0, 0, 0, 0);
bool var34 = -1 <= M11();
var1[0] = Vector128.CreateScalar((short)(s_1[0] << (0 >> (ushort)M9(0, 0, 0))));
var1 = new Vector128<short>[]
{
Vector128.Create<short>(0)
};
s_rt.WriteLine(var33);
s_rt.WriteLine(var34);
}

break;
case 5:
{
}

break;
case 6:
{
}

break;
case 7:
{
}

break;
default:
{
}

break;
}

var vr6 = Vector128.CreateScalar(0);
var vr5 = (uint)Sse41.Extract(vr6, 0);
return (ushort)Bmi2.ZeroHighBits(vr5, 0);
}

public static ushort M5()
{
return default(ushort);
}

public static long M9(ushort arg0, byte arg1, ulong arg2)
{
return s_3;
}

public static long M11()
{
var vr2 = Vector256.Create<int>(-2);
Avx512F.VL.ConvertToVector128Int16(vr2);
return 7708512004982082393L;
}
}

public interface IRuntime
{
void WriteLine<T>(T value);
}

public class Runtime : IRuntime
{
public void WriteLine<T>(T value) => System.Console.WriteLine(value);
}
1 change: 1 addition & 0 deletions src/tests/JIT/Regression/Regression_ro_1.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,7 @@
<Compile Include="JitBlue\Runtime_121711\Runtime_121711.cs" />
<Compile Include="JitBlue\Runtime_122138\Runtime_122138.cs" />
<Compile Include="JitBlue\Runtime_123399\Runtime_123399.cs" />
<Compile Include="JitBlue\Runtime_124508\Runtime_124508.cs" />
<Compile Include="JitBlue\Runtime_124510\Runtime_124510.cs" />
<Compile Include="JitBlue\Runtime_124511\Runtime_124511.cs" />
<Compile Include="JitBlue\Runtime_125124\Runtime_125124.cs" />
Expand Down
Loading