[release/9.0-staging] JIT: Fix invalid removal of explicit zeroing in methods without .localsinit

[jakobbotsch]

Backport of #115556 to release/9.0-staging

Customer Impact

• Customer reported
• Found internally

The JIT may mistakenly remove explicit field zeroing for some struct fields in methods without .localsinit (e.g. by having the SkipLocalsInit attribute applied in C#). This can happen when the IL first zero-initializes the full struct local using e.g. initobj, and then later zeroes a particular field of the struct local using stfld. Under certain circumstances, the JIT mistakenly eliminates both explicit zeroings of the field, leaving no zero initialization present, resulting in the field containing stack garbage.

Reported by customer in #113658.

Regression

• Yes
• No

This was exposed by support for cross-block assertion prop enabled in #94689.

Testing

Unit test added, and tested manually on user's test case.

Risk

Low

[Copilot]

Pull Request Overview

This PR backports a fix to the JIT to address an issue where explicit zeroing of struct fields gets mistakenly removed in methods without .localsinit (when the SkipLocalsInit attribute is applied).

• Ensures explicit field zeroing is preserved by killing dependent assertions for dead fields.
• Adds a dedicated test case to validate the fix.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/tests/JIT/Regression/JitBlue/Runtime_113658/Runtime_113658.csproj	New test project configuration for JIT regression.
src/tests/JIT/Regression/JitBlue/Runtime_113658/Runtime_113658.cs	New test validating correct zeroing behavior.
src/coreclr/jit/morphblock.cpp	Introduces calls to kill dependent assertions in field-by-field initialization and copy paths to prevent incorrect removal of zeroing.

Comments suppressed due to low confidence (2)

src/coreclr/jit/morphblock.cpp:409

• Double-check that killing dependent assertions here correctly targets only fields that are truly dead, ensuring that no valid assertions are unintentionally removed.

m_comp->fgKillDependentAssertionsSingle(m_dstLclNum DEBUGARG(m_store));

src/coreclr/jit/morphblock.cpp:1238

• Verify that the use of fgKillDependentAssertionsSingle in the field-by-field copy logic is consistent with its use in the initialization routine and does not remove assertions that should be preserved.

m_comp->fgKillDependentAssertionsSingle(m_dstLclNum DEBUGARG(m_store));

[jeffschwMSFT]

lgtm. please get a code review. we will take for consideration in 9.0.x

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.