[release/10.0] JIT: only imply non-null assertions from exact-type assertions

[EgorBo]

Fixes #132599 in release/10.0. There is no PR to backport: main is already unaffected because #123856 deleted optImpliedByTypeOfAssertions outright as a throughput cleanup, so the bug was fixed there by accident and never flagged for servicing.

Customer Impact

• Customer reported
• Found internally

Reported in #132599. Silent wrong code, no exception: enumerating a large OpenXML worksheet returned 0 rows (or a truncated count) once the method tiered up, so the customer's 1,000,000-row import quietly dropped data.

optImpliedByTypeOfAssertions treated any lcl != <const> assertion as a non-null assertion — it only checked op2.kind == O2K_CONST_INT and never that the constant was 0. The exact-type assertion produced by the guarded devirtualization check on Type.Equals (t is RuntimeType) therefore activated the unrelated t != typeof(Row) assertion on the same VN, inside the devirtualized block itself. Assertion prop then folded the live comparison to a constant and dropped the matching arm:

VN relop based constant assertion prop in BB24:
Assertion index=#09: [002712] != 1230248688 (gcref)
...
Bashed to int constant: CNS_INT int 1
Conditional folded at BB24
BB24 becomes a BBJ_ALWAYS to BB06     <-- 'count++' block now unreachable

Any virtualCall().Equals(typeof(T)) in a hot loop can hit this. Mitigations were DOTNET_TieredPGO=0 or DOTNET_JitEnableGuardedDevirtualization=0.

Regression

• Yes
• No

Long-standing: the missing iconVal == 0 check predates .NET 10. It became reachable in practice as GDV started producing exact-type assertions in more shapes.

Testing

Added regression test Runtime_132599, reduced from the customer report to a self-contained 30-line case

Risk

Low. The change only narrows an implication to the case the surrounding code already documents ("must be a Non Null assertion"), so it can only remove assertions that were never valid.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR fixes a JIT assertion propagation bug in release/10.0 where non-null implications were incorrectly derived from any lcl != <const> assertion, even when the constant was not 0. The change narrows the implication to only treat lcl != 0 as non-null, and adds a targeted regression test based on the reported OpenXML iterator data-loss scenario.

Changes:

• Restrict non-null implication logic to != 0 constant assertions in optImpliedByTypeOfAssertions.
• Add a new JIT regression test (Runtime_132599) that validates correctness under Tiered Compilation + Tiered PGO.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/coreclr/jit/assertionprop.cpp	Adds the missing iconVal == 0 check so only true non-null assertions imply non-null.
src/tests/JIT/Regression/JitBlue/Runtime_132599/Runtime_132599.cs	New regression test reproducing the reported silent wrong-code pattern in a small self-contained case.
src/tests/JIT/Regression/JitBlue/Runtime_132599/Runtime_132599.csproj	Test project config enabling Tiered Compilation and Tiered PGO for the regression scenario.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.