JIT: Debug: Throws 'System.NullReferenceException', Release: Runs successfully

[BruceForstall]

// Generated by Fuzzlyn v2.5 on 2025-04-11 19:54:45
// Run on Arm64 MacOS
// Seed: 17225220246896154744-vectort,vector64,vector128,armadvsimd,armadvsimdarm64,armaes,armarmbase,armarmbasearm64,armcrc32,armcrc32arm64,armdp,armrdm,armrdmarm64,armsha1,armsha256
// Reduced from 24.9 KiB to 0.7 KiB in 00:00:20
// Debug: Throws 'System.NullReferenceException'
// Release: Runs successfully
using System;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.Arm;

public struct S0
{
    public sbyte F2;
    public Vector<int> F4;
    public bool F7;
}

public class C0
{
    public S0 F2;
}

public class Program
{
    public static Vector<long> s_1;
    public static S0[] s_5 = new S0[]
    {
        new S0()
    };
    public static void Main()
    {
        var vr2 = new C0();
        bool vr3 = M1(vr2);
        System.Console.WriteLine(s_1);
    }

    public static bool M1(C0 argThis)
    {
        S0[] vr9 = default(S0[]);
        S0 var6 = vr9[0];
        var6.F2 = 0;
        argThis.F2.F2 = var6.F2;
        return s_5[0].F7;
    }
}

https://dev.azure.com/dnceng-public/public/_build/results?buildId=1013771&view=ms.vss-build-web.run-extensions-tab

@dotnet/jit-contrib

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[jakobbotsch]

Repros on win-x64 as well.

[JulieLeeMSFT]

@kunalspathak, PTAL.

[kunalspathak]

Looks like physical promotion is removing null[0] which results in behavior change:

before physical promotion:

***** BB01 [0000]
STMT00000 ( 0x000[E-] ... 0x007 )
               [000004] DA-XG------                         ▌  STORE_LCL_VAR struct<S0, 48> V01 loc0         
               [000003] n--XG------                         └──▌  BLK       struct<S0, 48>
               [000002] ---XG------                            └──▌  INDEX_ADDR byref S0[]
               [000000] -----------                               ├──▌  CNS_INT   ref    null
               [000001] -----------                               └──▌  CNS_INT   int    0

***** BB01 [0000]
STMT00001 ( 0x008[E-] ... 0x00B )
               [000008] UA---------                         ▌  STORE_LCL_FLD byte   V01 loc0         [+0]
               [000006] -----------                         └──▌  CNS_INT   int    0

***** BB01 [0000]
STMT00002 ( 0x010[E-] ... 0x01C )
               [000016] nA-XG------                         ▌  STOREIND  byte  
               [000015] ---X-------                         ├──▌  FIELD_ADDR byref  S0:F2
               [000010] ---X-------                         │  └──▌  FIELD_ADDR byref  C0:F2
               [000009] -----------                         │     └──▌  LCL_VAR   ref    V00 arg0          (last use)
               [000014] -----------                         └──▌  LCL_FLD   byte   V01 loc0         [+0] (last use)

***** BB01 [0000]
STMT00003 ( 0x021[E-] ... 0x031 )
               [000027] --CXG------                         ▌  RETURN    int   
               [000026] n-CXG------                         └──▌  IND       ubyte 
               [000025] --CXG------                            └──▌  FIELD_ADDR byref  S0:F7
               [000024] --CXG------                               └──▌  INDEX_ADDR byref S0[]
               [000022] --CXG------                                  ├──▌  COMMA     ref   
               [000021] H-CXG------                                  │  ├──▌  CALL help byref  CORINFO_HELP_GET_GCSTATIC_BASE
               [000020] H---------- arg0                             │  │  └──▌  CNS_INT(h) long   0x7ffc45e79f30 class Program
               [000018] I---G------                                  │  └──▌  IND       ref   
               [000017] H----------                                  │     └──▌  CNS_INT(h) long   0x1b172400bf0 static Fseq[s_5]
               [000023] -----------                                  └──▌  CNS_INT   int    0

after physical promotion:

***** BB01 [0000]
STMT00002 ( 0x010[E-] ... 0x01C )
               [000016] nA-XG------                         ▌  STOREIND  byte  
               [000015] ---X-------                         ├──▌  FIELD_ADDR byref  S0:F2
               [000010] ---X-------                         │  └──▌  FIELD_ADDR byref  C0:F2
               [000009] -----------                         │     └──▌  LCL_VAR   ref    V00 arg0          (last use)
               [000031] -----------                         └──▌  CAST      int <- byte <- int
               [000006] -----------                            └──▌  CNS_INT   int    0

***** BB01 [0000]
STMT00003 ( 0x021[E-] ... 0x031 )
               [000027] --CXG------                         ▌  RETURN    int   
               [000026] n-CXG------                         └──▌  IND       ubyte 
               [000025] --CXG------                            └──▌  FIELD_ADDR byref  S0:F7
               [000024] --CXG------                               └──▌  INDEX_ADDR byref S0[]
               [000022] --CXG------                                  ├──▌  COMMA     ref   
               [000021] H-CXG------                                  │  ├──▌  CALL help byref  CORINFO_HELP_GET_GCSTATIC_BASE
               [000020] H---------- arg0                             │  │  └──▌  CNS_INT(h) long   0x7ffc45e79f30 class Program
               [000018] I---G------                                  │  └──▌  IND       ref   
               [000017] H----------                                  │     └──▌  CNS_INT(h) long   0x1b172400bf0 static Fseq[s_5]
               [000023] -----------                                  └──▌  CNS_INT   int    0

It seems like CanSkipEntry() need to take into account if the replacement is changing the exception behavior?

STMT00000 ( 0x000[E-] ... 0x007 )
               [000004] DA-XG------                         ▌  STORE_LCL_VAR struct<S0, 48> V01 loc0         
               [000003] n--XG------                         └──▌  BLK       struct<S0, 48>
               [000002] ---XG------                            └──▌  INDEX_ADDR byref S0[]
               [000000] -----------                               ├──▌  CNS_INT   ref    null
               [000001] -----------                               └──▌  CNS_INT   int    0
Processing block operation [000004] that involves replacements
  V03 (V01.[000..001)) (last use) <- src+000
  => Remainder strategy: do nothing (remainder dying)
  Skipping def of V03 (V01.[000..001)); it is dying

@jakobbotsch ?