Assertion failure in AOT compiler re speculative inlining

[rmacnak-google]

$ dart runtime/tools/dartfuzz/dartfuzz.dart --no-fp --no-ffi --flat --seed 2380220029 fuzz.dart
$ DART_CONFIGURATION='ReleaseX64C' DART_VM_FLAGS='--enable-asserts' pkg/vm/tool/precompiler2 fuzz.dart snapshot

../../runtime/vm/compiler/aot/precompiler.cc: 3657: error: unreachable code
version=3.2.0-edge.00c69057c26fc11cb6068763e882dd19ac50b002 (be) (Fri Aug 18 16:17:16 2023 -0700) on "linux_x64"
pid=113476, thread=113476, isolate_group=isolate(0x55cbdd23d560), isolate=(nil)((nil))
os=linux, arch=x64, comp=yes, sim=no
isolate_instructions=0, vm_instructions=0
fp=7ffe13eb49d0, sp=7ffe13eb4898, pc=55cbdbcc17bc
  pc 0x000055cbdbcc17bc fp 0x00007ffe13eb49d0 dart::Profiler::DumpStackTrace(void*)+0x7c
  pc 0x000055cbdbb3dde4 fp 0x00007ffe13eb4ab0 dart::Assert::Fail(char const*, ...) const+0x84
  pc 0x000055cbdbff5436 fp 0x00007ffe13eb5150 dart::PrecompileParsedFunctionHelper::Compile(dart::CompilationPipeline*)+0xb56
  pc 0x000055cbdbff5747 fp 0x00007ffe13eb5810 /usr/local/google/home/rmacnak/dart1/sdk/pkg/vm/tool/../../../out/ReleaseX64C/gen_snapshot+0xa7e747
  pc 0x000055cbdbff1487 fp 0x00007ffe13eb5920 dart::Precompiler::CompileFunction(dart::Precompiler*, dart::Thread*, dart::Zone*, dart::Function const&)+0x177
  pc 0x000055cbdbff0204 fp 0x00007ffe13eb59b0 dart::Precompiler::ProcessFunction(dart::Function const&)+0xe4
  pc 0x000055cbdbfeb97b fp 0x00007ffe13eb5a10 dart::Precompiler::Iterate()+0x9b
  pc 0x000055cbdbfe8782 fp 0x00007ffe13eb6110 dart::Precompiler::DoCompileAll()+0x1572
  pc 0x000055cbdbfe71a8 fp 0x00007ffe13eb65a0 dart::Precompiler::CompileAll()+0xb8
  pc 0x000055cbdc18437e fp 0x00007ffe13eb6700 Dart_Precompile+0x24e
  pc 0x000055cbdbb1b95c fp 0x00007ffe13eb6890 dart::bin::main(int, char**)+0x8dc

@alexmarkov

[rmacnak-google]

Reduced to

@pragma("vm:never-inline")
hide() => null;

@pragma("vm:never-inline")
int foo2() {
  int loc0 = 23;
  try {
    while (--loc0 > 0) {
      hide();
    }
  } catch (exception, stackTrace) {
  } finally {
    return loc0 ~/ -1;
  }
}

main() {
  foo2();
}

The phi for loc0 between the catch entry and the normal entry has been assigned the type int by SSA construction, but the parameter for loc0 coming from the catch entry is untyped. Code looking at the type of the phi decides its safe to do an unboxed integer operation, select representation adds the unboxing, code generation in the catch side of the phi notes it can't prove the input is int and tries to emit a deopt stub.