Assertion failed '!"BBJ_EHFINALLYRET predecessor of block that doesn't follow a BBJ_CALLFINALLY!"'

[BruceForstall]

pipeline: runtime-coreclr libraries-pgo
job: net10.0-linux-Release-x64-fullpgo-Ubuntu.2204.Amd64.Open
test: System.Linq.Tests Work Item

https://dev.azure.com/dnceng-public/public/_build/results?buildId=1021952&view=ms.vss-test-web.build-test-results-tab&runId=27376374&paneView=debug&resultId=213647

DOTNET_TC_QuickJitForLoops=1
DOTNET_EnableCrashReport=1
DOTNET_TieredCompilation=1
DOTNET_JitProfileCasts=1
DOTNET_DbgMiniDumpName=/home/helixbot/dotnetbuild/dumps/coredump.%d.dmp
DOTNET_TieredPGO=1
DOTNET_DbgEnableMiniDump=1
DOTNET_ReadyToRun=0
+ ./RunTests.sh --runtime-path /datadisks/disk1/work/B6DF09DD/p
========================= Begin custom configuration settings ==============================
export __IsXUnitLogCheckerSupported=1
export XUNIT_HIDE_PASSING_OUTPUT_DIAGNOSTICS=1
========================== End custom configuration settings ===============================
----- start Mon Apr 21 06:53:23 PM UTC 2025 =============== To repro directly: =====================================================
pushd .
/datadisks/disk1/work/B6DF09DD/p/dotnet exec --runtimeconfig System.Linq.Tests.runtimeconfig.json --depsfile System.Linq.Tests.deps.json xunit.console.dll System.Linq.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing 
popd
===========================================================================================================
/datadisks/disk1/work/B6DF09DD/w/B9EC09FA/e /datadisks/disk1/work/B6DF09DD/w/B9EC09FA/e
  Discovering: System.Linq.Tests (method display = ClassAndMethod, method display options = None)
  Discovered:  System.Linq.Tests (found 1794 of 1799 test cases)
  Starting:    System.Linq.Tests (parallel test collections = on [2 threads], stop on fail = off)
    System.Linq.Tests.SelectManyTests.IndexOverflow [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.SkipWhileTests.IndexSkipWhileOverflowBeyondIntMaxValueElements [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.SelectTests.Overflow [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.WhereTests.IndexOverflows [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.TakeWhileTests.IndexTakeWhileOverflowBeyondIntMaxValueElements [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.IndexTests.LargeEnumerable [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.IndexTests.LargeEnumerable_ThrowsOverflowException [SKIP]
      Condition(s) not met: "IsStressModeEnabled"

Assert failure(PID 29070 [0x0000718e], Thread: 29091 [0x71a3]): Assertion failed '!"BBJ_EHFINALLYRET predecessor of block that doesn't follow a BBJ_CALLFINALLY!"' in 'System.Linq.Tests.LifecycleTests:BinaryOperations_SourceEnumeratorsDisposed():this' during 'Find loops' (IL size 485; hash 0x25bcd202; Tier1-OSR)

    File: /__w/1/s/src/coreclr/jit/fgdiagnostic.cpp:2860
    Image: /datadisks/disk1/work/B6DF09DD/p/dotnet

[createdump] Gathering state for process 29070 dotnet
[createdump] Crashing thread 71a3 signal 6 (0006)
[createdump] Writing crash report to file /home/helixbot/dotnetbuild/dumps/coredump.29070.dmp.crashreport.json
[createdump] Crash report successfully written
[createdump] Writing minidump with heap to file /home/helixbot/dotnetbuild/dumps/coredump.29070.dmp
[createdump] Written 351559680 bytes (85830 pages) to core file
[createdump] Target process is alive
[createdump] Dump successfully written in 653ms
waitpid() returned successfully (wstatus 00000000) WEXITSTATUS 0 WTERMSIG 0
./RunTests.sh: line 178: 29070 Aborted                 (core dumped) "$RUNTIME_PATH/dotnet" exec --runtimeconfig System.Linq.Tests.runtimeconfig.json --depsfile System.Linq.Tests.deps.json xunit.console.dll System.Linq.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing $RSP_FILE
/datadisks/disk1/work/B6DF09DD/w/B9EC09FA/e
----- end Mon Apr 21 06:55:20 PM UTC 2025 ----- exit code 134 ----------------------------------------------------------

@dotnet/jit-contrib

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[BruceForstall]

Saw a Fuzzlyn repro:

// Generated by Fuzzlyn v2.8 on 2025-04-24 03:58:44
// Run on X64 Windows
// Seed: 13048126064131946891-vectort,vector128,vector256,vector512,x86aes,x86avx,x86avx2,x86avx512bw,x86avx512bwvl,x86avx512cd,x86avx512cdvl,x86avx512dq,x86avx512dqvl,x86avx512f,x86avx512fvl,x86avx512fx64,x86avx512vbmi,x86avx512vbmivl,x86bmi1,x86bmi1x64,x86bmi2,x86bmi2x64,x86fma,x86lzcnt,x86lzcntx64,x86pclmulqdq,x86popcnt,x86popcntx64,x86sse,x86ssex64,x86sse2,x86sse2x64,x86sse3,x86sse41,x86sse41x64,x86sse42,x86sse42x64,x86ssse3,x86x86base
// Reduced from 208.2 KiB to 2.5 KiB in 00:01:42
// Hits JIT assert in Release:
// Assertion failed '!"BBJ_EHFINALLYRET predecessor of block that doesn't follow a BBJ_CALLFINALLY!"' in 'Program:M0()' during 'Find loops' (IL size 190; hash 0xaf50ff37; FullOpts)
// 
//     File: C:\gh\runtime\src\coreclr\jit\fgdiagnostic.cpp Line: 2860
// 
using System;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;

public class C0
{
}

public class C1
{
    public bool F2;
}

public class Program
{
    public static Vector<sbyte> s_6;
    public static void Main()
    {
        CollectibleALC alc = new CollectibleALC();
        System.Reflection.Assembly asm = alc.LoadFromAssemblyPath(System.Reflection.Assembly.GetExecutingAssembly().Location);
        System.Reflection.MethodInfo mi = asm.GetType(typeof(Program).FullName).GetMethod(nameof(MainInner));
        System.Type runtimeTy = asm.GetType(typeof(Runtime).FullName);
        mi.Invoke(null, new object[] { System.Activator.CreateInstance(runtimeTy) });
    }

    public static void MainInner(IRuntime rt)
    {
        M0();
    }

    public static void M0()
    {
        C1 var20 = default(C1);
        try
        {
            for (uint lvar34 = 0; lvar34 < 1; lvar34++)
            {
                return;
            }

            for (long lvar35 = 0; lvar35 > 0; lvar35--)
            {
                try
                {
                    s_6 = Vector.Create<sbyte>(0);
                }
                finally
                {
                    var vr0 = new C0[][]
                    {
                        new C0[]
                        {
                            new C0()
                        },
                        new C0[]
                        {
                            new C0()
                        },
                        new C0[]
                        {
                            new C0()
                        },
                        new C0[]
                        {
                            new C0()
                        },
                        new C0[]
                        {
                            new C0()
                        },
                        new C0[]
                        {
                            new C0()
                        }
                    };
                }
            }
        }
        catch (System.Exception)when (var20.F2)
        {
        }
    }
}

public interface IRuntime
{
    void WriteLine<T>(string site, T value);
}

public class Runtime : IRuntime
{
    public void WriteLine<T>(string site, T value) => System.Console.WriteLine(value);
}

public class CollectibleALC : System.Runtime.Loader.AssemblyLoadContext
{
    public CollectibleALC() : base(true)
    {
    }
}

[jakobbotsch]

We have a loop whose header block is the start of a finally, and whose backedge is a callfinally edge. We cannot canonicalize a loop of this form: it is not possible to create a preheader for it since the preheader will be the new start of the finally, but the callfinally backedge cannot be updated to jump past the preheader.

The actual loop structure is spurious and appears only because of an enclosing filter and the potential of control to transfer (once) from the filter to the enclosed finally. But we cannot model the intricate multi-pass flow precisely.

I don't see much we can do here except try to disallow loops with callfinally backedges.