Repository navigation
JIT: preserve relocatable handles when simplifying ordered comparisons - #135484
Merged
Merged
Conversation
PR description draft: <!-- --> Reject signed relational constant folding involving relocatable handles, just as for unsigned comparisons and arithmetic. A compile-time handle placeholder does not establish the ordering of its relocated runtime address. Also prevent long-to-int VN narrowing from converting handle VNs into ordinary numeric constants and bypassing that rejection. Retain the existing identity-based equality/null folding. Add a single-file regression comparing a runtime type handle against a numeric bound for all signed relational operators, reversed operands, and unsigned controls. Fixes dotnet#134891 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ae8155d6-f240-4542-a1da-c721ba933c91
github-actions
Bot
added
the
area-CodeGen-coreclr
|
Azure Pipelines: Successfully started running 5 pipeline(s). 11 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Zero-bound comparisons can still fold through placeholder-based non-negativity inference.
1 open finding
What changed in this PR
Prevents JIT value numbering from folding relocatable handle comparisons using compile-time placeholder addresses.
Changes:
- Preserves handle VNs during narrowing.
- Rejects signed ordered folding under relocation.
- Adds NativeAOT regression coverage.
| File | Description |
|---|---|
src/coreclr/jit/valuenum.cpp |
Updates handle folding and narrowing rules. |
src/tests/JIT/Regression_ro_2/Runtime_134891.cs |
Tests ordered handle comparisons. |
🧠 Review effort: Balanced
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 58815d76-2d1f-4ad8-9153-cca0f87b58e5
Member
Author
|
PTAL @dotnet/jit-contrib |
JulieLeeMSFT
approved these changes
Oct 9, 2026
JulieLeeMSFT
left a comment
JulieLeeMSFT
left a comment
Member
There was a problem hiding this comment.
LGTM.
Tree: (long)handleVN > Bound
│
▼
VNIgnoreIntToLongCast(vn) -- narrows LONG VN to INT VN
│
[BEFORE] any integral const --> plain int VN (handle-ness lost!)
│
▼
VNEvalCanFoldBinaryFunc(GT_GT, arg0VN, arg1VN)
│
checks IsVNHandle(arg0VN) || IsVNHandle(arg1VN)
│
[BEFORE] GT_GT/GE/LT/LE not in reloc-guarded case --> folds anyway (WRONG)
[AFTER] GT_GT/GE/LT/LE added to guarded case, and handle-ness preserved
--> folding correctly rejected under compReloc
EgorBo
enabled auto-merge (squash)
October 10, 2026 16:51
Member
Author
|
/ba-g 135574 |
EgorBo
added a commit
that referenced
this pull request
Oct 12, 2026
<!-- --> Fixes #135604. #135484 stopped VN folding of relocatable handle comparisons, but ARM32 can still fold them during assertion propagation using the compile-time handle placeholder. Reject handle VNs in numeric-constant and non-negative queries, and avoid deriving numeric ranges or signs from tree constants that need relocation. Keep identity-based equality folding unchanged. A few [diffs](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1631303&view=ms.vss-build-web.run-extensions-tab) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: afd2a57d-a85b-4904-8fed-4980955c9ac0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reject signed relational constant folding involving relocatable handles, just as for unsigned comparisons and arithmetic. A compile-time handle placeholder does not establish the ordering of its relocated runtime address.
Also prevent long-to-int VN narrowing from converting handle VNs into ordinary numeric constants and bypassing that rejection. Retain the existing identity-based equality/null folding.
Fixes #134891
No diffs