jitstress-random: Assertion failed 'node->OperIsLIR()'

[EgorBo]

Failed in two recent runs: https://helixre8s23ayyeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-heads-main-fdbd8b3f6d0c4c0080/JIT.Directed/1/console.64d0864a.log?helixlogtype=result

      Assert failure(PID 8488 [0x00002128], Thread: 7944 [0x1f08]): Assertion failed 'node->OperIsLIR()' in 'PrimitiveVT.CallConv1:Main():int' during 'Rationalize IR' (IL size 1048; hash 0x389ee476; FullOpts)
      
          File: D:\a\_work\1\s\src\coreclr\jit\lir.cpp Line: 1616
          Image: C:\h\w\B88E0917\p\corerun.exe

first appeared in #82731 cc @anthonycanino @tannergooding

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch, @kunalspathak
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Failed in two recent runs: https://helixre8s23ayyeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-heads-main-fdbd8b3f6d0c4c0080/JIT.Directed/1/console.64d0864a.log?helixlogtype=result

      Assert failure(PID 8488 [0x00002128], Thread: 7944 [0x1f08]): Assertion failed 'node->OperIsLIR()' in 'PrimitiveVT.CallConv1:Main():int' during 'Rationalize IR' (IL size 1048; hash 0x389ee476; FullOpts)
      
          File: D:\a\_work\1\s\src\coreclr\jit\lir.cpp Line: 1616
          Image: C:\h\w\B88E0917\p\corerun.exe

first appeared in #82731 cc @anthonycanino @tannergooding

Author:	EgorBo
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[tannergooding]

This looks unrelated to #82731. The EVEX logic is off without a special opt-in and the test in question has no SIMD logic.

It looks like this might instead be related to the new gtSplitTree feature - CC. @jakobbotsch

In particular, we have Trees after Update flow graph opt pass:

***** BB03
STMT00030 ( 0x0B3[E-] ... 0x0BB )
N013 (  5,  5) [001411] -A---O--R--                         *  ASG       int    $VN.Void
N012 (  1,  1) [001409] D------N---                         +--*  LCL_VAR   int    V150 tmp135      d:2 $VN.Void
N011 (  5,  5) [002000] -A---O-----                         \--*  COMMA     int    <l:$68, c:$8b>
N009 (  4,  4) [001998] -A---O--R--                            +--*  ASG       int    $VN.Void
N008 (  1,  1) [001997] D------N---                            |  +--*  LCL_VAR   int    V224 cse10       d:1 $VN.Void
N007 (  4,  4) [001410] n----O-----                            |  \--*  IND       int    <l:$68, c:$8b>
N006 (  1,  2) [001408] -----O-N---                            |     \--*  COMMA     byref  $540
N001 (  0,  0) [001401] -----------                            |        +--*  NOP       void   $501
N005 (  1,  2) [001407] -----O-----                            |        \--*  ARR_ADDR  byref PrimitiveVT.VT1B[] $540
N004 (  1,  2) [001406] -------N---                            |           \--*  ADD       byref  $341
N002 (  1,  1) [001398] -----------                            |              +--*  LCL_VAR   ref    V08 loc8         u:2 $4c0
N003 (  1,  1) [001405] -----------                            |              \--*  CNS_INT   long   16 $108
N010 (  1,  1) [001999] -----------                            \--*  LCL_VAR   int    V224 cse10       u:1 <l:$68, c:$8b>

***** BB03
STMT00031 ( 0x0BD[E-] ... 0x0C4 )
N006 (  6,  5) [000127] -A--G------                         *  ASG       int    $204
N004 (  4,  3) [000124] ----G--N---                         +--*  COMMA     int    $204
N001 (  1,  1) [001955] -----------                         |  +--*  LCL_VAR   long   V216 cse2        u:1 $240
N003 (  3,  2) [001412] n---G--N---                         |  \--*  IND       int    $VN.Void
N002 (  1,  1) [002014] -----------                         |     \--*  LCL_VAR   long   V226 cse12       u:1 $284
N005 (  1,  1) [000125] -----------                         \--*  LCL_VAR   int    V05 loc5         u:2 $8a

***** BB03
STMT00217 ( 0x0C9[E-] ... ??? )
N006 ( 18, 13) [000856] -A--G---R--                         *  ASG       struct (copy) $204
N005 (  9,  6) [000855] D------N---                         +--*  LCL_VAR   struct<PrimitiveVT.VT1A, 4> V86 tmp71        d:2 $VN.Void
N004 (  8,  6) [000129] n---G------                         \--*  OBJ       struct<PrimitiveVT.VT1A, 4> <l:$442, c:$441>
N003 (  2,  2) [000134] ----G------                            \--*  COMMA     long   $25e
N001 (  1,  1) [001956] -----------                               +--*  LCL_VAR   long   V216 cse2        u:1 $240
N002 (  1,  1) [002015] -----------                               \--*  LCL_VAR   long   V226 cse12       u:1 $284

We then have:

*************** In fgDebugCheckBBlist
*************** In fgDebugCheckLoopTable: loop table not valid

*************** Starting PHASE Compute edge weights (2, false)
 -- not optimizing or no profile data, so not computing edge weights

*************** Finishing PHASE Compute edge weights (2, false) [no changes]

*************** Starting PHASE Stress gtSplitTree

In gtSplitTree we end up getting:

lvaGrabTemp returning 239 (V239 rat5) called for Spilling to split statement for tree.
Splitting STMT00030 at [002000]
Splitting STMT00031 at [000127]
Splitting STMT00217 at [000129]

And at the end of gtSplitTree in Trees after Stress gtSplitTree we have:

***** BB03
STMT00030 ( 0x0B3[E-] ... 0x0BB )
N005 (  1,  3) [001411] -A---O--R--                         *  ASG       int    $VN.Void
N004 (  1,  1) [001409] D------N---                         +--*  LCL_VAR   int    V150 tmp135      d:2 $VN.Void
N003 (  1,  1) [002000] -----O-----                         \--*  COMMA     int    <l:$68, c:$8b>
N001 (  0,  0) [002093] -----------                            +--*  NOP       void  
N002 (  1,  1) [001999] -----------                            \--*  LCL_VAR   int    V224 cse10       u:1 <l:$68, c:$8b>

***** BB03
STMT00031 ( 0x0BD[E-] ... 0x0C4 )
N006 (  6,  5) [000127] -A--G------                         *  ASG       int    $204
N003 (  3,  2) [001412] n---G--N---                         +--*  IND       int    $VN.Void
N002 (  1,  1) [002014] -----------                         |  \--*  LCL_VAR   long   V226 cse12       u:1 $284
N005 (  1,  1) [000125] -----------                         \--*  LCL_VAR   int    V05 loc5         u:2 $8a

***** BB03
STMT00323 ( 0x0C9[E-] ... ??? )
N005 (  6,  5) [002095] -A--G---R--                         *  ASG       long  
N004 (  3,  2) [002094] D------N---                         +--*  LCL_VAR   long   V240 rat6        
N003 (  2,  2) [000134] ----G------                         \--*  COMMA     long   $25e
N001 (  1,  1) [001956] -----------                            +--*  LCL_VAR   long   V216 cse2        u:1 $240
N002 (  1,  1) [002015] -----------                            \--*  LCL_VAR   long   V226 cse12       u:1 $284

***** BB03
STMT00217 ( 0x0C9[E-] ... ??? )
N004 ( 19, 13) [000856] -A--G---R--                         *  ASG       struct (copy) $204
N003 (  9,  6) [000855] D------N---                         +--*  LCL_VAR   struct<PrimitiveVT.VT1A, 4> V86 tmp71        d:2 $VN.Void
N002 (  9,  6) [000129] n---G------                         \--*  OBJ       struct<PrimitiveVT.VT1A, 4> <l:$442, c:$441>
N001 (  3,  2) [002096] -----------                            \--*  LCL_VAR   long   V240 rat6        

So between STMT00031 and STMT00217 we've introduced a new STMT00323 which contains the comma from STMT00217. We've somehow lost COMMA 000124, it's actually nowhere in the "after split tree" contents, but I would have maybe expected it to be between STMT00030 and STMT00031 based on how the other split happened.

[jakobbotsch]

@tannergooding What node is it asserting on? [000124] was just removed because it is a location and it has no side effects.

Maybe the ARR_ADDR node causes the problem since it is meant as an annotation, so I'm not sure how freely we can move it around.

[tannergooding]

It's asserting on 000124 because its finding the comma as part of validating LIR immediately after rationalization

Rationalization itself appears to not hit the comma due to the splitting that happens.

[jakobbotsch]

Rationalization itself appears to not hit the comma due to the splitting that happens.

Ah, then the problem is that we are improperly rethreading the nodes after the splitting, rationalization should not be seeing that node.