JIT: Wrong result with do-while loops

[jakobbotsch]

// Generated by Fuzzlyn v2.8 on 2025-04-27 22:46:08
// Run on X86 Windows
// Seed: 2255917678885586044-vectort,vector128,vector256,x86aes,x86avx,x86avx2,x86avx512bw,x86avx512bwvl,x86avx512cd,x86avx512cdvl,x86avx512dq,x86avx512dqvl,x86avx512f,x86avx512fvl,x86bmi1,x86bmi2,x86fma,x86lzcnt,x86pclmulqdq,x86popcnt,x86sse,x86sse2,x86sse3,x86sse41,x86sse42,x86ssse3,x86x86base
// Reduced from 118.3 KiB to 1.0 KiB in 00:17:25
// Debug: Outputs <0, 0, 0, 0, 0, 0, 0, 0>
// Release: Outputs <1, 0, 0, 0, 0, 0, 0, 0>
using System;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;

public class Program
{
    public static IRuntime s_rt;
    public static int s_5 = 1;
    public static Vector<int>[] s_10 = new Vector<int>[]
    {
        Vector128.CreateScalar(0).AsVector()
    };
    public static byte s_21;
    public static void Main()
    {
        s_rt = new Runtime();
        bool vr5 = 0 <= M10();
        s_rt.WriteLine(s_10[0]);
    }

    public static byte M10()
    {
        byte lvar2 = default(byte);
        do
        {
            s_5 = 0;
            int lvar4 = 0;
            do
            {
                s_10[0] = Vector128.CreateScalar(s_5).AsVector();
            }
            while (lvar4 < 0);
        }
        while (lvar2 > 1);
        return s_21;
    }
}

public interface IRuntime
{
    void WriteLine<T>(T value);
}

public class Runtime : IRuntime
{
    public void WriteLine<T>(T value) => System.Console.WriteLine(value);
}

cc @dotnet/jit-contrib

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[BruceForstall]

It looks like the Hoist loop code phase is hoisting a read of s_5 in the CreateScalar call above the def of that variable in the outer loop.

[jakobbotsch]

Sounds similar in spirit to #75442 (and other older issues mentioned in that one). The memory dependence stuff in VN is supposed to prevent this, so looks like some handling around that is wrong here.

[tannergooding]

Another case found by Fuzzlyn:

// Generated by Fuzzlyn v3.0 on 2025-05-18 19:22:37
// Run on X64 Linux
// Seed: 4824504964424222320-vectort,vector128,vector256,x86aes,x86avx,x86avx2,x86avx512bw,x86avx512bwvl,x86avx512cd,x86avx512cdvl,x86avx512dq,x86avx512dqvl,x86avx512f,x86avx512fvl,x86avx512fx64,x86bmi1,x86bmi1x64,x86bmi2,x86bmi2x64,x86fma,x86lzcnt,x86lzcntx64,x86pclmulqdq,x86popcnt,x86popcntx64,x86sse,x86ssex64,x86sse2,x86sse2x64,x86sse3,x86sse41,x86sse41x64,x86sse42,x86sse42x64,x86ssse3,x86x86base
// Reduced from 233.4 KiB to 0.8 KiB in 00:14:39
// Debug: Outputs 1
// Release: Outputs 0
using System;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;

public partial class Program
{
    public static ulong s_4;
    public static uint s_5;
    public static void Main()
    {
        M0();
        System.Console.WriteLine(s_5);
    }

    public static void M0()
    {
        int lvar3 = default(int);
        do
        {
            s_4 = 1;
            s_5 = (uint)Bmi2.X64.ZeroHighBits(s_4, 1);
            ulong lvar6 = 0;
            do
            {
                var vr0 = Vector128.CreateScalar(s_5);
                var vr1 = Vector128.Create<uint>(0);
                if (Sse41.TestC(vr0, vr1))
                {
                    return;
                }
            }
            while (lvar6 > 0);
        }
        while (lvar3 < 0);
    }
}