ARM32: Runtime crash with interfaces

[jakobbotsch]

This one crashes in debug (and after M33 prints a message):

// Generated by Fuzzlyn v1.4 on 2021-08-24 18:42:34
// Run on .NET 7.0.0-dev on Arm Linux
// Seed: 4314857431407232792
// Reduced from 582.3 KiB to 3.3 KiB in 02:00:04
// Crashes the runtime
public interface I0
{
}

public interface I3
{
}

public struct S0 : I0
{
    public sbyte F0;
    public short F1;
    public sbyte F2;
    public int F4;
    public bool F5;
    public S0(bool f5): this()
    {
    }

    public S1 M34(S1[] arg0)
    {
        return default(S1);
    }
}

public struct S1 : I0, I3
{
    public short F0;
    public S0 F1;
    public S0 F2;
    public S0 F3;
    public S1(S0 f1, S0 f2, S0 f3): this()
    {
    }
}

public class Program
{
    private static I s_rt;
    public static I3 s_21;
    public static S1 s_29;
    public static S1[][] s_32 = new S1[][]{new S1[]{new S1(new S0(false), new S0(false), new S0(true))}};
    public static I3[][] s_42;
    public static void Main()
    {
        s_rt = new C();
        var vr3 = s_32[0][0].F3.F2;
        M33(vr3);
    }

    public static I0[] M33(sbyte arg0)
    {
        S1 var3;
        I3 var8;
        S1 var9;
        uint var11;
        S0 var12;
        var vr24 = s_32[0];
        new S0(false).M34(vr24);
        I0 var0 = new S0(true);
        var vr0 = new S1[]{new S1(new S0(true), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(true))};
        new S0(true).M34(vr0);
        try
        {
            bool var1 = s_29.F2.F5;
            s_rt.WriteLine(var1);
        }
        finally
        {
            s_42 = new I3[][]{new I3[]{new S1(new S0(true), new S0(true), new S0(true)), new S1(new S0(true), new S0(true), new S0(true))}, new I3[]{new S1(new S0(false), new S0(true), new S0(true)), new S1(new S0(false), new S0(true), new S0(true)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(true), new S0(false), new S0(false))}, new I3[]{new S1(new S0(true), new S0(true), new S0(false)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(false), new S0(false), new S0(false)), new S1(new S0(false), new S0(false), new S0(true)), new S1(new S0(true), new S0(true), new S0(false))}, new I3[]{new S1(new S0(false), new S0(true), new S0(false)), new S1(new S0(true), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(true), new S0(false), new S0(true))}, new I3[]{new S1(new S0(false), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(false), new S0(true), new S0(true)), new S1(new S0(false), new S0(true), new S0(true))}, new I3[]{new S1(new S0(false), new S0(true), new S0(true)), new S1(new S0(false), new S0(false), new S0(false))}};
        }

        var vr30 = new S1[]{new S1(new S0(true), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(true), new S0(false), new S0(false))};
        s_21 = s_29.F2.M34(vr30);
        var0 = new S1(new S0(true), new S0(false), new S0(true));
        var vr2 = new S0(true);
        I3 vr23;
        I3 var2 = new S1(new S0(true), new S0(true), new S0(false));
        bool vr25;
        bool vr26;
        bool vr28;
        bool vr29;
        bool vr31;
        return new I0[]{new S0(false), new S0(true), new S1(new S0(true), new S0(true), new S0(false))};
    }
}

public interface I { void WriteLine<T>(T val); }
public class C : I
{
    public void WriteLine<T>(T val)
    {
        System.Console.WriteLine(val);
    }
}

Tagging subscribers to this area: @JulieLeeMSFT
See info in area-owners.md if you want to be subscribed.

Issue Details

---

This one crashes in debug (and after M33 prints a message):

// Generated by Fuzzlyn v1.4 on 2021-08-24 18:42:34
// Run on .NET 7.0.0-dev on Arm Linux
// Seed: 4314857431407232792
// Reduced from 582.3 KiB to 3.3 KiB in 02:00:04
// Crashes the runtime
public interface I0
{
}

public interface I3
{
}

public struct S0 : I0
{
    public sbyte F0;
    public short F1;
    public sbyte F2;
    public int F4;
    public bool F5;
    public S0(bool f5): this()
    {
    }

    public S1 M34(S1[] arg0)
    {
        return default(S1);
    }
}

public struct S1 : I0, I3
{
    public short F0;
    public S0 F1;
    public S0 F2;
    public S0 F3;
    public S1(S0 f1, S0 f2, S0 f3): this()
    {
    }
}

public class Program
{
    private static I s_rt;
    public static I3 s_21;
    public static S1 s_29;
    public static S1[][] s_32 = new S1[][]{new S1[]{new S1(new S0(false), new S0(false), new S0(true))}};
    public static I3[][] s_42;
    public static void Main()
    {
        s_rt = new C();
        var vr3 = s_32[0][0].F3.F2;
        M33(vr3);
    }

    public static I0[] M33(sbyte arg0)
    {
        S1 var3;
        I3 var8;
        S1 var9;
        uint var11;
        S0 var12;
        var vr24 = s_32[0];
        new S0(false).M34(vr24);
        I0 var0 = new S0(true);
        var vr0 = new S1[]{new S1(new S0(true), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(true))};
        new S0(true).M34(vr0);
        try
        {
            bool var1 = s_29.F2.F5;
            s_rt.WriteLine(var1);
        }
        finally
        {
            s_42 = new I3[][]{new I3[]{new S1(new S0(true), new S0(true), new S0(true)), new S1(new S0(true), new S0(true), new S0(true))}, new I3[]{new S1(new S0(false), new S0(true), new S0(true)), new S1(new S0(false), new S0(true), new S0(true)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(true), new S0(false), new S0(false))}, new I3[]{new S1(new S0(true), new S0(true), new S0(false)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(false), new S0(false), new S0(false)), new S1(new S0(false), new S0(false), new S0(true)), new S1(new S0(true), new S0(true), new S0(false))}, new I3[]{new S1(new S0(false), new S0(true), new S0(false)), new S1(new S0(true), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(true), new S0(false), new S0(true))}, new I3[]{new S1(new S0(false), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(false), new S0(true), new S0(true)), new S1(new S0(false), new S0(true), new S0(true))}, new I3[]{new S1(new S0(false), new S0(true), new S0(true)), new S1(new S0(false), new S0(false), new S0(false))}};
        }

        var vr30 = new S1[]{new S1(new S0(true), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(false)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(true), new S0(false), new S0(true)), new S1(new S0(true), new S0(false), new S0(false))};
        s_21 = s_29.F2.M34(vr30);
        var0 = new S1(new S0(true), new S0(false), new S0(true));
        var vr2 = new S0(true);
        I3 vr23;
        I3 var2 = new S1(new S0(true), new S0(true), new S0(false));
        bool vr25;
        bool vr26;
        bool vr28;
        bool vr29;
        bool vr31;
        return new I0[]{new S0(false), new S0(true), new S1(new S0(true), new S0(true), new S0(false))};
    }
}

public interface I { void WriteLine<T>(T val); }
public class C : I
{
    public void WriteLine<T>(T val)
    {
        System.Console.WriteLine(val);
    }
}

Author:	jakobbotsch
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	6.0.0

[EgorBo]

Asserts in Checked (altjit):

Assert failure(PID 32760 [0x00007ff8], Thread: 16104 [0x3ee8]): Assertion failed 'sizeof(size_t) == sizeof(target_size_t)' in 'Program:M33(byte):I0[]' during 'Emit code' (IL size 1261)

    File: C:\prj\runtime\src\coreclr\jit\emitarm.cpp Line: 5638
    Image: C:\prj\runtime\artifacts\bin\coreclr\windows.x64.Checked\CoreRun.exe

[jakobbotsch]

That assert is common if you try to use 64-bit host with 32-bit altjit. It should go away if you use a 32-bit host. (we ought to fix this at some point)

FWIW, no asserts fire in this test on native arm32 checked builds.

[EgorBo]

That assert is common if you try to use 64-bit host with 32-bit altjit. It should go away if you use a 32-bit host. (we ought to fix this at some point)

FWIW, no asserts fire in this test on native arm32 checked builds.

Ah, makes sense, thanks, Wonder if it goes away with #58279

[davidwrighton]

@EgorBo, @jakobbotsch 64 bit host, targeting ARM32 is the most common scenario for ReadyToRun targetting Arm32. Is this a bug in the JIT, or in the VM? If this is a JIT bug, this is a product issue for .NET 6. Please test as a cross bitness R2R test.

The simple way to do this is to build this as an X64 test, and run it under R2R, and then run crossgen2 with the --targetarch:arm switch instead of --targetarch:x64

[sandreenko]

@EgorBo, @jakobbotsch 64 bit host, targeting ARM32 is the most common scenario for ReadyToRun targetting Arm32. Is this a bug in the JIT, or in the VM? If this is a JIT bug, this is a product issue for .NET 6. Please test as a cross bitness R2R test.
The simple way to do this is to build this as an X64 test, and run it under R2R, and then run crossgen2 with the --targetarch:arm switch instead of --targetarch:x64

They are talking about set complus_alrjitname=clrjit_arm_windows_x64.dll; corerun test.dll. This is not a supported scenario and there is no product need for it, we need only crossgen2 support, not corerun.

[jakobbotsch]

FWIW I also think those asserts are benign and should just be removed, the immediate that is being stored in the variable is masked to 16 bits anyway.

[davidwrighton]

Ah, I see, the asserts are in code which is protected by !idIsReloc(), which in the case of crossgen2 since it is an R2R code generator will not be executed.