Wrong constant propagation on Linux in release

[jakobbotsch]

On Linux in release the following program outputs 1 in debug, but 0 in release:

using System.Runtime.CompilerServices;

struct S1
{
}

struct S3
{
    public int F1;
    public ulong F2;
    public S1 F6;
    public S3(int f1, S1 f6): this()
    {
        F1 = f1;
        F6 = f6;
    }
}

struct S5
{
    public S3 F0;
    public S5(S3 f0): this()
    {
        F0 = f0;
    }
}

public class Program
{
    public static void Main()
    {
        S5 vr13 = new S5(new S3(1, new S1()));
        int vr14 = vr13.F0.F1;
        M();
        System.Console.WriteLine(vr14); // 1 in debug, 0 in release
    }

    [MethodImpl(MethodImplOptions.NoInlining)]
    private static void M(){}
}

I'm not 100% sure that this isn't the same as #10440, however this only reproduces on Linux so there is definitely something different here.

[jakobbotsch]

The disassembly is:

; Assembly listing for method Program:Main()
; Emitting BLENDED_CODE for X64 CPU with AVX
; optimized code
; rbp based frame
; partially interruptible
; Final local variable assignments
;
;  V00 loc0         [V00    ] (  2,  2   )  struct ( 8) [rbp-0x08]   do-not-enreg[XSF] must-init addr-exposed ld-addr-op
;# V01 OutArgs      [V01    ] (  1,  1   )  lclBlk ( 0) [rsp+0x00]
;  V02 tmp1         [V02,T00] (  4,  8   )  struct (24) [rbp-0x20]   do-not-enreg[SFB]
;  V03 tmp2         [V03,T01] (  1,  2   )  struct (24) [rbp-0x38]   do-not-enreg[SFB]
;* V04 tmp3         [V04,T02] (  0,  0   )     int  ->  zero-ref
;  V05 tmp4         [V05    ] (  2,  4   )  struct ( 8) [rbp-0x40]   do-not-enreg[XSF] addr-exposed
;* V06 tmp5         [V06    ] (  0,  0   )  struct (24) zero-ref    do-not-enreg[SB]
;
; Lcl frame size = 64

G_M5094_IG01:
       55                   push     rbp
       4883EC40             sub      rsp, 64
       C5F877               vzeroupper
       488D6C2440           lea      rbp, [rsp+40H]
       33C0                 xor      rax, rax
       488945F8             mov      qword ptr [rbp-08H], rax

G_M5094_IG02:
       C645F800             mov      byte  ptr [rbp-08H], 0
       480FBE45F8           movsx    rax, byte  ptr [rbp-08H]
       8845C0               mov      byte  ptr [rbp-40H], al
       33C0                 xor      rax, rax
       488D7DE0             lea      rdi, bword ptr [rbp-20H]
       C4E17857C0           vxorps   xmm0, xmm0
       C4E17A7F07           vmovdqu  qword ptr [rdi], xmm0
       48894710             mov      qword ptr [rdi+16], rax
       C745E001000000       mov      dword ptr [rbp-20H], 1
       480FBE45C0           movsx    rax, byte  ptr [rbp-40H]
       488D7DF0             lea      rdi, bword ptr [rbp-10H]
       8807                 mov      byte  ptr [rdi], al
       C4E17A6F45E0         vmovdqu  xmm0, qword ptr [rbp-20H]
       C4E17A7F45C8         vmovdqu  qword ptr [rbp-38H], xmm0
       488B45F0             mov      rax, qword ptr [rbp-10H]
       488945D8             mov      qword ptr [rbp-28H], rax
       E8A2FBFFFF           call     Program:M()
       33FF                 xor      edi, edi                        ; wrong
       E80BFCFFFF           call     System.Console:WriteLine(int)
       90                   nop

G_M5094_IG03:
       488D6500             lea      rsp, [rbp]
       5D                   pop      rbp
       C3                   ret

; Total bytes of code 108, prolog size 19 for method Program:Main()
; ============================================================

Without the call to M it is correct:

; Assembly listing for method Program:Main()
; Emitting BLENDED_CODE for X64 CPU with AVX
; optimized code
; rsp based frame
; partially interruptible
; Final local variable assignments
;
;  V00 loc0         [V00    ] (  2,  2   )  struct ( 8) [rsp+0x40]   do-not-enreg[XSF] must-init addr-exposed ld-addr-op
;# V01 OutArgs      [V01    ] (  1,  1   )  lclBlk ( 0) [rsp+0x00]
;  V02 tmp1         [V02,T00] (  4,  8   )  struct (24) [rsp+0x28]   do-not-enreg[SFB]
;  V03 tmp2         [V03,T01] (  2,  4   )  struct (24) [rsp+0x10]   do-not-enreg[SFB]
;  V04 tmp3         [V04    ] (  2,  4   )  struct ( 8) [rsp+0x08]   do-not-enreg[XSF] addr-exposed
;* V05 tmp4         [V05    ] (  0,  0   )  struct (24) zero-ref    do-not-enreg[SB]
;
; Lcl frame size = 72

G_M5094_IG01:
       4883EC48             sub      rsp, 72
       C5F877               vzeroupper
       33C0                 xor      rax, rax
       4889442440           mov      qword ptr [rsp+40H], rax

G_M5094_IG02:
       C644244000           mov      byte  ptr [rsp+40H], 0
       480FBE7C2440         movsx    rdi, byte  ptr [rsp+40H]
       40887C2408           mov      byte  ptr [rsp+08H], dil
       33FF                 xor      rdi, rdi
       488D442428           lea      rax, bword ptr [rsp+28H]
       C4E17857C0           vxorps   xmm0, xmm0
       C4E17A7F00           vmovdqu  qword ptr [rax], xmm0
       48897810             mov      qword ptr [rax+16], rdi
       C744242801000000     mov      dword ptr [rsp+28H], 1
       480FBE7C2408         movsx    rdi, byte  ptr [rsp+08H]
       488D442438           lea      rax, bword ptr [rsp+38H]
       408838               mov      byte  ptr [rax], dil
       C4E17A6F442428       vmovdqu  xmm0, qword ptr [rsp+28H]
       C4E17A7F442410       vmovdqu  qword ptr [rsp+10H], xmm0
       488B7C2438           mov      rdi, qword ptr [rsp+38H]
       48897C2420           mov      qword ptr [rsp+20H], rdi
       8B7C2410             mov      edi, dword ptr [rsp+10H]
       E806FCFFFF           call     System.Console:WriteLine(int)
       90                   nop

G_M5094_IG03:
       4883C448             add      rsp, 72
       C3                   ret

; Total bytes of code 112, prolog size 14 for method Program:Main()
; ============================================================

Here is a JIT dump:
https://gist.github.com/jakobbotsch/725a429e55d8cede0a40c91b7dc84808

Value numbering gives the argument to WriteLine the same VN as 0 and then it is constant propagated:

After constant propagation on [000042]:
     ( 15,  7) [000045] ------------              ▌  STMT      void  (IL 0x023...  ???)
N005 ( 15,  7) [000043] --CXG-------              └──▌  CALL      void   System.Console.WriteLine $VN.Void
N003 (  1,  1) [000042] ------------ arg0 in rdi     └──▌  CNS_INT   int    0 $80

[jakobbotsch]

Actually the difference is in struct S1. With

struct S1
{
  int F1;
}

this repros on Windows too. If S1 is empty, then it only repros on Linux. So this is probably some variant of #10440 after all...

[briansull]

I am testing a fix for this issue