[JitStressWithRandomNumbers] seq_short_1_d fails

[sandreenko]

Example:
https://helixre8s23ayyeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-pull-57900-merge-f26c04388af241ca9d/JIT.Methodical.eE/1/console.0f01af6b.log?sv=2019-07-07&se=2021-09-12T00%3A10%3A43Z&sr=c&sp=rl&sig=xX%2FwSE9hoH%2FWaOhtQFIwGMXAc9V3kIgeQes1vC4jiNM%3D

Repro steps (windows x64):

set COMPlus_TieredCompilation=0
set COMPlus_JitStress=99
JIT\Methodical\explicit\coverage\seq_short_1_d\seq_short_1_d.cmd

Error log:

      Expected: 100
      Actual: 118
      END EXECUTION - FAILED

the issue from a quality week JitStress experiment.

Tagging subscribers to this area: @JulieLeeMSFT
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Example:
https://helixre8s23ayyeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-pull-57900-merge-f26c04388af241ca9d/JIT.Methodical.eE/1/console.0f01af6b.log?sv=2019-07-07&se=2021-09-12T00%3A10%3A43Z&sr=c&sp=rl&sig=xX%2FwSE9hoH%2FWaOhtQFIwGMXAc9V3kIgeQes1vC4jiNM%3D

Repro steps (windows x64):

set COMPlus_TieredCompilation=0
set COMPlus_JitStress=99
JIT\Methodical\explicit\coverage\seq_short_1_d\seq_short_1_d.cmd

Error log:

      Expected: 100
      Actual: 118
      END EXECUTION - FAILED

Author:	sandreenko
Assignees:	-
Labels:	JitStress, area-CodeGen-coreclr
Milestone:	6.0.0

[kunalspathak]

Taking a look.

[kunalspathak]

The failure method gets inlined normally but with JitStress=99, it doesn't get inline.

*************** In fgFindBasicBlocks() for TestApp:test_0_17(short,AA,AA):short
weight= 77 : state  16 [ ldarga.s ]
weight= 17 : state 110 [ ldflda ]
weight= 79 : state  40 [ call ]
weight= 19 : state  42 [ ret ]
Random rejection (r=89 > t=75)


Inline expansion aborted, inline not profitable

During execution, we call test_0_17(100, new AA(100), new AA(0)) where AA is a struct:

internal struct AA
{
    public short tmp1;
    public short q; //this field is the testing subject
    public ushort tmp2;
    public int tmp3;
}

public AA(short qq)
{
  tmp1 = 106;
  tmp2 = 107;
  tmp3 = 108;
  q = qq;
}

Here is the code we generate for the call

lea     r8,[rsp+30h]    ; new AA(0)
lea     rdx,[rsp+40h]   ; new AA(100)
mov     ecx,64h         ; 100
call    CLRStub[MethodDescPrestub]@7ffeeec92078 (00007ffe`eec92078)  ; call to test_0_17()

If we see the contents of rdx, they are as expected:

 0:000> dw rdx
000000a1`08d7e540  006a 0064 006b 0000 006c 0000 7fff 0000

The test_0_17() looks like this:

public static short call_target_ref(ref short arg) { return arg; }
private static short test_0_17(short num, AA init, AA zero)
{
  return AA.call_target_ref(ref init.q);
}

The generated code for test_0_17 looks like this:

seq_short_1_d!TestApp.test_0_17(Int16, AA, AA):
00007ffe`eecb06f0 50              push    rax
00007ffe`eecb06f1 8b442404        mov     eax, dword ptr [rsp+4] ; <-- should be mov eax, word ptr [rdx+2] instead
00007ffe`eecb06f5 480fbfc0        movsx   rax,ax
00007ffe`eecb06f9 4883c408        add     rsp,8
00007ffe`eecb06fd c3              ret

[kunalspathak]

If I turn off struct promotion, we see expected code getting generated.

00007ffe`ea49b9c2 480fbf4202      movsx   rax,word ptr [rdx+2]
00007ffe`ea49b9c7 c3              ret

Still investigating.