JIT: Assertion failed 'FitsIn(tree->TypeGet(), value)' during 'Assertion prop'

[jakobbotsch]

// Generated by Fuzzlyn v2.5 on 2025-03-26 17:56:02
// Run on Arm64 MacOS
// Seed: 14738797710062565441-vectort,vector64,vector128,armadvsimd,armadvsimdarm64,armaes,armarmbase,armarmbasearm64,armcrc32,armcrc32arm64,armdp,armrdm,armrdmarm64,armsha1,armsha256
// Reduced from 190.7 KiB to 1.5 KiB in 00:02:14
// Hits JIT assert in Release:
// Assertion failed 'FitsIn(tree->TypeGet(), value)' in 'Program:M26(S0)' during 'Assertion prop' (IL size 210; hash 0xb2cb8560; FullOpts)
// 
//     File: /Users/runner/work/1/s/src/coreclr/jit/assertionprop.cpp Line: 2953
// 
using System;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.Arm;

public struct S0
{
    public int F0;
    public bool F1;
    public ushort F3;
    public sbyte F6;
    public long F7;
    public S0(int f8)
    {
    }
}

public struct S1
{
    public S0 F1;
    public sbyte F5;
    public S1(S0 f1) : this()
    {
        F1 = f1;
    }
}

public class Program
{
    public static IRuntime s_rt;
    public static S0 s_2;
    public static S1[] s_43;
    public static void Main()
    {
        var vr1 = new S0(0);
        M26(vr1);
    }

    public static void M26(S0 argThis)
    {
        S0 var0 = s_2;
        if (!(var0.F6 != -14975))
        {
            if (argThis.F1)
            {
                S0 var5 = var0;
                s_rt.WriteLine(var5.F6);
            }
            else
            {
                s_43 = new S1[]
                {
                    new S1(new S0(0)),
                    new S1(new S0(0)),
                    new S1(new S0(0)),
                    new S1(new S0(0)),
                    new S1(new S0(0)),
                    new S1(new S0(0)),
                    new S1(new S0(0)),
                    new S1(new S0(0))
                };
            }
        }
    }
}

public interface IRuntime
{
    void WriteLine<T>(T value);
}

public class Runtime : IRuntime
{
    public void WriteLine<T>(T value) => System.Console.WriteLine(value);
}

There is an SPMI collection available that should work with build a37ae11: col.zip

cc @dotnet/jit-contrib

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[BruceForstall]

Another case:

// Generated by Fuzzlyn v2.5 on 2025-04-20 16:57:09
// Run on Arm64 Windows
// Seed: 5704166520278956155-vectort,vector64,vector128,armadvsimd,armadvsimdarm64,armaes,armarmbase,armarmbasearm64,armcrc32,armcrc32arm64,armdp,armrdm,armrdmarm64,armsha1,armsha256,armsve
// Reduced from 68.2 KiB to 0.6 KiB in 00:00:58
// Hits JIT assert in Release:
// Assertion failed 'FitsIn(tree->TypeGet(), value)' in 'Program:Main(Fuzzlyn.ExecutionServer.IRuntime)' during 'Assertion prop' (IL size 82; hash 0xade6b36b; FullOpts)
// 
//     File: D:\a\_work\1\s\src\coreclr\jit\assertionprop.cpp Line: 2951
// 
using System;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.Arm;

public class C0
{
    public ushort F0;
}

public class Program
{
    public static void Main()
    {
        C0 vr2 = new C0();
        if (-1 == vr2.F0)
        {
            vr2.F0 = vr2.F0;
            for (int vr3 = 0; vr3 < 0; vr3++)
            {
            }

            var vr4 = vr2.F0;
            var vr5 = Vector128.CreateScalar(vr4).AsVector();
            short vr6 = (short)Sve.SaturatingIncrementByActiveElementCount(0, vr5);
            System.Console.WriteLine(vr6);
        }
    }
}