Skip to content

JIT: Incorrect results for programs in win-x86 release #64904

@jakobbotsch

Description

@jakobbotsch

Description

The following programs compute wrong results when optimizing:

Reproduction Steps

// Generated by Fuzzlyn v1.5 on 2022-02-06 17:06:01
// Run on X86 Windows
// Seed: 7854701479455767355
// Reduced from 192.2 KiB to 0.6 KiB in 00:03:51
// Debug: Outputs 0
// Release: Outputs 1
public struct S0
{
    public uint F0;
    public ulong F2;
    public int F3;
    public ushort F6;
    public int F8;
    public int[] M35(int arg0, int[] arg1)
    {
        this.F3 = arg1[0];
        Program.s_rt.WriteLine(arg0);
        return arg1;
    }
}

public class Program
{
    public static IRT s_rt;
    public static int[][] s_28 = new int[][]{new int[]{1}};
    public static void Main()
    {
        s_rt = new C();
        var vr3 = new S0();
        var vr6 = vr3.F3;
        var vr13 = s_28[0];
        var vr12 = vr3.M35(0, vr13);
        vr3.M35(vr6, vr12);
    }
}

public interface IRT
{
    void WriteLine<T>(T value);
}

public class C : IRT
{
    public void WriteLine<T>(T value)
    {
        System.Console.WriteLine(value);
    }
}
// Generated by Fuzzlyn v1.5 on 2022-02-06 18:06:07
// Run on X86 Windows
// Seed: 525178552114891112
// Reduced from 142.0 KiB to 0.9 KiB in 00:06:35
// Debug: Throws 'System.NullReferenceException'
// Release: Runs successfully
public interface I0
{
}

public class C0
{
    public ushort F0;
}

public struct S0 : I0
{
    public byte F0;
    public bool F1;
    public long F3;
    public byte F4;
    public C0 F5;
    public S0(long f3, C0 f5): this()
    {
        F5 = f5;
    }

    public C1 M24(ref bool arg0)
    {
        this = new S0(0, new C0());
        return Program.s_18;
    }
}

public class C1
{
}

public class Program
{
    public static IRT s_rt;
    public static C1 s_18;
    public static void Main()
    {
        s_rt = new C();
        var vr4 = new S0(0, new C0());
        I0 vr7 = vr4;
        bool vr8 = default(bool);
        S0 vr9 = default(S0);
        var vr10 = vr9.F5;
        var vr11 = vr9.M24(ref vr8);
        M8(vr10, ref vr7, vr11);
    }

    public static void M8(C0 argThis, ref I0 arg0, C1 arg1)
    {
        s_rt.WriteLine(argThis.F0);
    }
}

public interface IRT
{
    void WriteLine<T>(T value);
}

public class C : IRT
{
    public void WriteLine<T>(T value)
    {
        System.Console.WriteLine(value);
    }
}
// Generated by Fuzzlyn v1.5 on 2022-02-06 16:34:36
// Run on X86 Windows
// Seed: 15345211054104247945
// Reduced from 56.7 KiB to 1.1 KiB in 00:00:55
// Debug: Outputs 0
// Release: Outputs -1
public struct S0
{
    public ulong F1;
    public int F2;
    public byte F3;
    public short F5;
    public long F6;
    public void M4(int arg0, sbyte[] arg1)
    {
        Program.s_rt.WriteLine(arg0);
    }

    public sbyte[] M6(ref int arg0, bool arg1, ref S0 arg2, ref byte arg3)
    {
        var vr0 = Program.s_5;
        Program.M7(arg2, vr0, ref Program.s_6, ref Program.s_10, arg0);
        var vr1 = arg2.F6;
        Program.M8(arg2, vr1);
        arg0 = this.F2--;
        return new sbyte[]{1};
    }
}

public class Program
{
    public static IRT s_rt;
    public static bool s_2;
    public static S0 s_4;
    public static uint[] s_5;
    public static byte s_6;
    public static S0[] s_10;
    public static S0[, ] s_20 = new S0[, ]{{new S0()}};
    public static void Main()
    {
        s_rt = new C();
        S0 vr2 = default(S0);
        new S0().M4(vr2.F2, vr2.M6(ref s_4.F2, s_2, ref s_20[0, 0], ref s_4.F3));
    }

    public static void M8(S0 arg0, long arg1)
    {
    }

    public static void M7(S0 argThis, uint[] arg0, ref byte arg1, ref S0[] arg2, int arg3)
    {
    }
}

public interface IRT
{
    void WriteLine<T>(T value);
}

public class C : IRT
{
    public void WriteLine<T>(T value)
    {
        System.Console.WriteLine(value);
    }
}

Expected behavior

They should compute the same result in debug and release.

Actual behavior

The results differ.

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

I would guess these are forward-sub related, but I have not checked in detail.

cc @dotnet/jit-contrib

Metadata

Metadata

Assignees

Labels

arch-x86area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions