JIT: Assertion failed 'cond == test->AsOp()->gtOp1' during 'Update flow graph early pass'

// Generated by Fuzzlyn v3.3 on 2025-08-23 16:26:13
// Run on Arm64 MacOS
// Seed: 17015990397549431234-vectort,vector64,vector128,armadvsimd,armadvsimdarm64,armaes,armarmbase,armarmbasearm64,armcrc32,armcrc32arm64,armdp,armrdm,armrdmarm64,armsha1,armsha256
// Reduced from 36.5 KiB to 0.5 KiB in 00:00:13
// Hits JIT assert for Release:
// Assertion failed 'cond == test->AsOp()->gtOp1' in 'Program:M0()' during 'Update flow graph early pass' (IL size 32; hash 0xaf50ff37; FullOpts)
// 
//     File: /Users/runner/work/1/s/src/coreclr/jit/fgopt.cpp Line: 4535
// 
public class Program
{
    public static uint s_3;
    public static ulong s_7;
    public static void Main()
    {
        M0();
    }

    public static void M0()
    {
        long[] var3 = default(long[]);
        sbyte var24 = default(sbyte);
        if ((ulong)M1() > (ulong)var3[0])
        {
            var24 = var24;
        }
        else
        {
            uint var25 = s_3;
        }

        ulong var39 = s_7;
    }

    public static int M1()
    {
        return default(int);
    }
}

cc @dotnet/jit-contrib

@JulieLeeMSFT

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

SPMI collection attached

F825B53E.zip

We have

               [000012] --CXG------                         *  JTRUE     void  
               [000022] ---XG------                         \--*  COMMA     int   
               [000009] ---XG------                            +--*  INDEX_ADDR byref long[]
               [000007] -----------                            |  +--*  LCL_VAR   ref    V00 loc0         
               [000008] -----------                            |  \--*  CNS_INT   int    0
               [000021] -----------                            \--*  CNS_INT   int    1

and so gtReverseCond prepends a NOT, but the caller asserts there is no new IR.

I don't think the caller's assertion is necessary.

We still have an IR invariant that the operand of a JTRUE is always a relop. It would be nice to remove, but there are more places that have assertions about that. But as it is, it seems like the issue is in whoever produced that IR without folding it away.

The simplification happens when substituting the inline return expression. Not sure how hard it will be to fix that.

INLINER: during 'fgInline' result 'success' reason 'below ALWAYS_INLINE size' for 'Program:M0()' calling 'Program:M1():int'
INLINER: during 'fgInline' result 'success' reason 'below ALWAYS_INLINE size'

Replacing the return expression placeholder [000005] with [000019]
               [000005] --C--------                         *  RET_EXPR  int   (for [000004]) -> [000019]

Inserting the inline return expression
               [000019] -----------                         *  CNS_INT   int    0


Folding long operator with constant nodes into a constant:
               [000006] --C--------                         *  CAST      long <- int
               [000019] -----------                         \--*  CNS_INT   int    0
Bashed to long constant:
               [000006] -----------                         *  CNS_INT   long   0

Folding binary operator with a constant operand:
               [000011] N-CXG----U-                         *  LE        int   
               [000006] -----------                         +--*  CNS_INT   long   0
               [000010] n--XG------                         \--*  IND       long  
               [000009] ---XG------                            \--*  INDEX_ADDR byref long[]
               [000007] -----------                               +--*  LCL_VAR   ref    V00 loc0         
               [000008] -----------                               \--*  CNS_INT   int    0
Transformed into:
               [000022] ---XG------                         *  COMMA     int   
               [000009] ---XG------                         +--*  INDEX_ADDR byref long[]
               [000007] -----------                         |  +--*  LCL_VAR   ref    V00 loc0         
               [000008] -----------                         |  \--*  CNS_INT   int    0
               [000021] -----------                         \--*  CNS_INT   int    1
**************** Inline Tree

I think we can fix this up later in the substitution walk, when we reconsider the JTRUE.

Navigation Menu

Repository navigation

JIT: Assertion failed 'cond == test->AsOp()->gtOp1' during 'Update flow graph early pass' #119058

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

JIT: Assertion failed 'cond == test->AsOp()->gtOp1' during 'Update flow graph early pass' #119058

Description

Activity

dotnet-policy-service commented on Aug 25, 2025

jakobbotsch commented on Aug 25, 2025

AndyAyersMS commented on Aug 27, 2025

jakobbotsch commented on Aug 27, 2025

AndyAyersMS commented on Aug 27, 2025

AndyAyersMS commented on Aug 27, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions