JIT: Invalid result with `Avx2.BlendVariable`

[jakobbotsch]

// Generated by Fuzzlyn v3.3 on 2026-03-09 16:27:56
// Run on X64 Linux
// Seed: 14993291497765132425-vectort,vector128,vector256,x86aes,x86avx,x86avx2,x86bmi1,x86bmi1x64,x86bmi2,x86bmi2x64,x86fma,x86lzcnt,x86lzcntx64,x86pclmulqdq,x86pclmulqdqv256,x86popcnt,x86popcntx64,x86sse,x86ssex64,x86sse2,x86sse2x64,x86sse3,x86sse41,x86sse41x64,x86sse42,x86sse42x64,x86ssse3,x86x86base
// Reduced from 393.1 KiB to 0.7 KiB in 00:07:29
// Debug: Prints 1 line(s)
// Release: Prints 0 line(s)
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;

public class Program
{
    public static Vector<ulong> s_12;
    public static byte[] s_27;
    public static Vector256<byte>[, ] s_53;
    public static void Main()
    {
        Vector256<byte> vr18 = Vector256.Create<byte>(0);
        var vr19 = Vector256.Create<byte>(0);
        var vr20 = M43(vr19, ref s_27);
        var vr21 = Vector256.CreateScalar(vr20);
        Vector256<byte> vr24 = s_53[0, 0];
        vr18 = Avx2.BlendVariable(vr21, vr24, vr18);
        M43(vr18, ref s_27);
    }

    public static byte M43(Vector256<byte> arg1, ref byte[] arg2)
    {
        System.Console.WriteLine(s_12);
        return arg2[0];
    }
}

Repros on Windows too

cc @dotnet/jit-contrib

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[JulieLeeMSFT]

@anthonycanino, can your team please take a look?

[Ruihan-Yin]

/home/ryujit/dev/runtime/artifacts/tests/coreclr/linux.x64.Debug/Tests/Core_Root/corerun ./bin/Debug/net11.0/test.dll 
<0, 0, 0, 0>
Unhandled exception. System.NullReferenceException: Object reference not set to an instance of an object.
   at Program.M43(Vector256`1 arg1, Byte[]& arg2) in /home/ryujit/dev/test/Program.cs:line 30
   at Program.Main() in /home/ryujit/dev/test/Program.cs:line 20
   at System.Environment.CallEntryPoint(IntPtr entryPoint, String[]* pArgument, Int32* pReturnValue, Boolean captureException, Exception* pException)
Aborted (core dumped)


~/dev/test$ /home/ryujit/dev/runtime/artifacts/tests/coreclr/linux.x64.Debug/Tests/Core_Root/corerun ./bin/Release/net11.0/test.dll 
<0, 0, 0, 0>
Unhandled exception. System.NullReferenceException: Object reference not set to an instance of an object.
   at Program.M43(Vector256`1 arg1, Byte[]& arg2) in /home/ryujit/dev/test/Program.cs:line 30
   at Program.Main() in /home/ryujit/dev/test/Program.cs:line 19
   at System.Environment.CallEntryPoint(IntPtr entryPoint, String[]* pArgument, Int32* pReturnValue, Boolean captureException, Exception* pException)
Aborted (core dumped)

I'm not able reproduce the expected behavior, both Release and Debug generate the print, but the error seems to be s_27 never initialized, not sure if I missed any step.

[jakobbotsch]

/home/ryujit/dev/runtime/artifacts/tests/coreclr/linux.x64.Debug/Tests/Core_Root/corerun ./bin/Debug/net11.0/test.dll 
<0, 0, 0, 0>
Unhandled exception. System.NullReferenceException: Object reference not set to an instance of an object.
   at Program.M43(Vector256`1 arg1, Byte[]& arg2) in /home/ryujit/dev/test/Program.cs:line 30
   at Program.Main() in /home/ryujit/dev/test/Program.cs:line 20
   at System.Environment.CallEntryPoint(IntPtr entryPoint, String[]* pArgument, Int32* pReturnValue, Boolean captureException, Exception* pException)
Aborted (core dumped)


~/dev/test$ /home/ryujit/dev/runtime/artifacts/tests/coreclr/linux.x64.Debug/Tests/Core_Root/corerun ./bin/Release/net11.0/test.dll 
<0, 0, 0, 0>
Unhandled exception. System.NullReferenceException: Object reference not set to an instance of an object.
   at Program.M43(Vector256`1 arg1, Byte[]& arg2) in /home/ryujit/dev/test/Program.cs:line 30
   at Program.Main() in /home/ryujit/dev/test/Program.cs:line 19
   at System.Environment.CallEntryPoint(IntPtr entryPoint, String[]* pArgument, Int32* pReturnValue, Boolean captureException, Exception* pException)
Aborted (core dumped)

I'm not able reproduce the expected behavior, both Release and Debug generate the print, but the error seems to be s_27 never initialized, not sure if I missed any step.

Did you remember to disable tiered compilation?

[tannergooding]

I can repro with DOTNET_TieredCompilation=0. The original repro shows it was run on an AVX2 machine but it also repros on an AVX512 machine.

[Ruihan-Yin]

@tannergooding Thanks for picking this up. I apologize for missing this report and not responding in a timely manner. I appreciate the investigation and the work you've done, the bug as you pointed out is coming from that blend got folded during morph and the side effect of the operands got incorrectly handled. Again thanks for the work, please feel free to reassign this issue and close this issue.