JIT crash/assert while compiling Grpc.core codebase

[davidwrighton]

Repro instructions:
Download https://microsoft-my.sharepoint.com/:u:/p/davidwr/ETDI552L1RtCugwcniHGv5QBVsNi3PDCpXt6y-tWayhvow?e=f4wH4F and unzip it to a directory.

Using that directory as the working directory, run crossgen2 passing the rsp file in the zip as a response file. For example:

c:\git\runtime\dotnet c:\git\runtime\artifacts\bin\coreclr\windows.x64.Debug\crossgen2\crossgen2.dll @crossgen2repro.rsp

If run against a Debug crossgen2, it will produce an assert

C:\git\runtime\src\coreclr\jit\loopcloning.cpp:183
Assertion failed 'genTypeSize(genActualType(op1Tree->TypeGet())) == genTypeSize(genActualType(op2Tree->TypeGet()))' in 'Grpc.Core.Internal.SliceBufferSafeHandle:ToByteArray():System.Byte[]:this' during 'Clone loops' (IL size 215)

If run against a release crossgen2 it will produce an AV

Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
Repeat 2 times:
--------------------------------
   at Internal.JitInterface.CorInfoImpl.JitCompileMethod(IntPtr ByRef, IntPtr, IntPtr, IntPtr, Internal.JitInterface.CORINFO_METHOD_INFO ByRef, UInt32, IntPtr ByRef, UInt32 ByRef)
--------------------------------
   at Internal.JitInterface.CorInfoImpl.CompileMethodInternal(ILCompiler.DependencyAnalysis.IMethodNode, Internal.IL.MethodIL)
   at Internal.JitInterface.CorInfoImpl.CompileMethod(ILCompiler.DependencyAnalysis.ReadyToRun.MethodWithGCInfo, ILCompiler.Logger)
   at ILCompiler.ReadyToRunCodegenCompilation.<ComputeDependencyNodeDependencies>b__36_0(ILCompiler.DependencyAnalysisFramework.DependencyNodeCore`1<ILCompiler.DependencyAnalysis.NodeFactory>)
   at System.Threading.Tasks.Parallel+<>c__DisplayClass33_0`2[[System.__Canon, System.Private.CoreLib, Version=6.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e],[System.__Canon, System.Private.CoreLib, Version=6.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].<ForEachWorker>b__0(Int32)
   at System.Threading.Tasks.Parallel+<>c__DisplayClass19_0`1[[System.__Canon, System.Private.CoreLib, Version=6.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].<ForWorker>b__1(System.Threading.Tasks.RangeWorker ByRef, Int32, Boolean ByRef)
   at System.Threading.Tasks.TaskReplicator+Replica.Execute()
   at System.Threading.Tasks.TaskReplicator+Replica+<>c.<.ctor>b__4_0(System.Object)
   at System.Threading.Tasks.Task.InnerInvoke()
   at System.Threading.Tasks.Task+<>c.<.cctor>b__271_0(System.Object)
   at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(System.Threading.Thread, System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   at System.Threading.Tasks.Task.ExecuteWithThreadLocal(System.Threading.Tasks.Task ByRef, System.Threading.Thread)
   at System.Threading.Tasks.Task.ExecuteEntryUnsafe(System.Threading.Thread)
   at System.Threading.ThreadPoolWorkQueue.Dispatch()
   at System.Threading.PortableThreadPool+WorkerThread.WorkerThreadStart()
   at System.Threading.Thread.StartCallback()

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

Tagging subscribers to this area: @JulieLeeMSFT
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Repro instructions:
Download https://microsoft-my.sharepoint.com/:u:/p/davidwr/ETDI552L1RtCugwcniHGv5QBVsNi3PDCpXt6y-tWayhvow?e=f4wH4F and unzip it to a directory.

Using that directory as the working directory, run crossgen2 passing the rsp file in the zip as a response file. For example:

c:\git\runtime\dotnet c:\git\runtime\artifacts\bin\coreclr\windows.x64.Debug\crossgen2\crossgen2.dll @crossgen2repro.rsp

If run against a Debug crossgen2, it will produce an assert

C:\git\runtime\src\coreclr\jit\loopcloning.cpp:183
Assertion failed 'genTypeSize(genActualType(op1Tree->TypeGet())) == genTypeSize(genActualType(op2Tree->TypeGet()))' in 'Grpc.Core.Internal.SliceBufferSafeHandle:ToByteArray():System.Byte[]:this' during 'Clone loops' (IL size 215)

If run against a release crossgen2 it will produce an AV

Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
Repeat 2 times:
--------------------------------
   at Internal.JitInterface.CorInfoImpl.JitCompileMethod(IntPtr ByRef, IntPtr, IntPtr, IntPtr, Internal.JitInterface.CORINFO_METHOD_INFO ByRef, UInt32, IntPtr ByRef, UInt32 ByRef)
--------------------------------
   at Internal.JitInterface.CorInfoImpl.CompileMethodInternal(ILCompiler.DependencyAnalysis.IMethodNode, Internal.IL.MethodIL)
   at Internal.JitInterface.CorInfoImpl.CompileMethod(ILCompiler.DependencyAnalysis.ReadyToRun.MethodWithGCInfo, ILCompiler.Logger)
   at ILCompiler.ReadyToRunCodegenCompilation.<ComputeDependencyNodeDependencies>b__36_0(ILCompiler.DependencyAnalysisFramework.DependencyNodeCore`1<ILCompiler.DependencyAnalysis.NodeFactory>)
   at System.Threading.Tasks.Parallel+<>c__DisplayClass33_0`2[[System.__Canon, System.Private.CoreLib, Version=6.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e],[System.__Canon, System.Private.CoreLib, Version=6.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].<ForEachWorker>b__0(Int32)
   at System.Threading.Tasks.Parallel+<>c__DisplayClass19_0`1[[System.__Canon, System.Private.CoreLib, Version=6.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]].<ForWorker>b__1(System.Threading.Tasks.RangeWorker ByRef, Int32, Boolean ByRef)
   at System.Threading.Tasks.TaskReplicator+Replica.Execute()
   at System.Threading.Tasks.TaskReplicator+Replica+<>c.<.ctor>b__4_0(System.Object)
   at System.Threading.Tasks.Task.InnerInvoke()
   at System.Threading.Tasks.Task+<>c.<.cctor>b__271_0(System.Object)
   at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(System.Threading.Thread, System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
   at System.Threading.Tasks.Task.ExecuteWithThreadLocal(System.Threading.Tasks.Task ByRef, System.Threading.Thread)
   at System.Threading.Tasks.Task.ExecuteEntryUnsafe(System.Threading.Thread)
   at System.Threading.ThreadPoolWorkQueue.Dispatch()
   at System.Threading.PortableThreadPool+WorkerThread.WorkerThreadStart()
   at System.Threading.Thread.StartCallback()

Author:	davidwrighton
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[AndyAyersMS]

You can also repro this by grabbing Grpc.Core and Grpc.Core.Api 2.38 from nuget, extracting the DLLs, and running PMI:

corerun.exe c:\repos\jitutils\bin\pmi.dll prepall-quiet C:\bugs\r57535\Grpc.Core.dll

DllNotFoundException Grpc.Core.Internal.CommonPlatformDetection::uname (Unable to load DLL 'libc' or one of its dependencies: The specified module could not be found. (0x8007007E))

Assert failure(PID 32692 [0x00007fb4], Thread: 33432 [0x8298]): Assertion failed 'genTypeSize(genActualType(op1Tree->TypeGet())) == genTypeSize(genActualType(op2Tree->TypeGet()))' in 'Grpc.Core.Internal.SliceBufferSafeHandle:ToByteArray():System.Byte[]:this' during 'Clone loops' (IL size 215)

    File: C:\repos\runtime0\src\coreclr\jit\loopcloning.cpp Line: 183
    Image: c:\repos\runtime0\artifacts\tests\coreclr\Windows.x64.Checked\Tests\Core_Root\corerun.exe

[AndyAyersMS]

Issue is that LC_Condition::ToGenTree is trying to set a TYP_LONG variable to a TYP_INT zero.

[AndyAyersMS]

Suspect cloning gets confused because V01 is a long, but morph optimizes a cast to int-sized:

fgMorphTree BB34, STMT00022 (before)
               [000110] ------------              *  JTRUE     void  
               [000109] ------------              \--*  LT        int   
               [000106] ------------                 +--*  LCL_VAR   int    V10 loc9         
               [000108] ------------                 \--*  CAST      int <- long
               [000107] ------------                    \--*  LCL_VAR   long   V01 loc0         

fgMorphTree BB34, STMT00022 (after)
               [000110] -----+------              *  JTRUE     void  
               [000109] J----+-N----              \--*  LT        int   
               [000106] -----+------                 +--*  LCL_VAR   int    V10 loc9         
               [000107] C----+------                 \--*  LCL_VAR   int    V01 loc0         

and so likely cloning thinks V01 is an int?

[AndyAyersMS]

Not clear yet how to fix this...

[EgorBo]

I wonder if a naive fix would help EgorBo@cde5dd5 (well, it does, but how legal it is...)