JIT: Assertion failed 'newLclValue.BothDefined()' during 'Do value numbering'

[jakobbotsch]

// Generated by Fuzzlyn v2.4 on 2024-12-01 16:32:26
// Run on X64 Linux
// Seed: 7861295224295601455-vectort,vector128,vector256,x86aes,x86avx,x86avx2,x86avx512bw,x86avx512bwvl,x86avx512cd,x86avx512cdvl,x86avx512dq,x86avx512dqvl,x86avx512f,x86avx512fvl,x86avx512fx64,x86bmi1,x86bmi1x64,x86bmi2,x86bmi2x64,x86fma,x86lzcnt,x86lzcntx64,x86pclmulqdq,x86popcnt,x86popcntx64,x86sse,x86ssex64,x86sse2,x86sse2x64,x86sse3,x86sse41,x86sse41x64,x86sse42,x86sse42x64,x86ssse3,x86x86base
// Reduced from 115.8 KiB to 0.9 KiB in 00:02:27
// Hits JIT assert in Release:
// Assertion failed 'newLclValue.BothDefined()' in 'Program:Main(Fuzzlyn.ExecutionServer.IRuntime)' during 'Do value numbering' (IL size 61; hash 0xade6b36b; FullOpts)
// 
//     File: /__w/1/s/src/coreclr/jit/valuenum.cpp Line: 6138
// 
using System;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;

public class C0
{
    public uint F0;
}

public struct S0
{
    public C0 F2;
}

public class C3
{
    public byte F0;
}

public class Program
{
    public static S0 s_3;
    public static void Main()
    {
        var vr5 = Vector256.Create(1, 0, 0, 0);
        Vector256<long> vr15 = Vector256.Create<long>(0);
        Vector256<long> vr8 = Avx512F.VL.CompareNotEqual(vr5, vr15);
        long vr9 = 0;
        var vr10 = new C3();
        vr8 = M3(vr10);
        long vr11 = vr9;
        var vr12 = s_3.F2.F0;
        vr8 = vr8;
    }

    public static Vector256<long> M3(C3 argThis)
    {
        try
        {
        }
        finally
        {
            byte var5 = argThis.F0;
        }

        return Vector256.Create<long>(0);
    }
}

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[jakobbotsch]

The problem is that the mask<->vector conversion optimization needs to reject all cases where it cannot convert a store or use. In this case there is a store into a Vector256<long> typed local via a return buffer passed to M3, but the pass does not reject it and converts it to a mask. Hence we end up with illegal IR (store to a too small local via retbuf).