Fix two latent HWIntrinsic miscompiles in gentree.cpp by tannergooding · Pull Request #130832 · dotnet/runtime

tannergooding · 2026-07-16T01:46:55Z

Two latent correctness fixes found while auditing gentree.cpp, each with a regression test.

Fix GetOperForHWIntrinsicId testing the isScalar pointer instead of *isScalar (#130830)

GetOperForHWIntrinsicId refines a GT_SUB into a GT_NEG when the constant op1 is a scalar zero, but it guarded on the isScalar out-param pointer (always non-null) rather than the dereferenced value. This let a packed subtract whose constant has a zero low lane but is not all-zero (e.g. Vector128.Create(0, 1, 2, 3) - x) be reported as a negate. fgOptimizeHWIntrinsic's (-v1) + v2 => v2 - v1 transform then drops the constant entirely.

Fix stray block clobbering needsFixup in gtNewSimdMinMaxNode (#130831)

A stray unconditional block in the min branch of the floating constant fast path overwrote needsFixup for all four cases, making the preceding if/else dead. needsFixup signals that a signed-zero constant needs the AVX512 fixup so min(+0, -0) keeps the correct sign of zero; with it wrongly forced false, Min/MinNumber against a signed-zero constant miscompiles. The min branch now mirrors the already-correct max branch.

Existing coverage in JitBlue/Runtime_98068 exercises Min/MinNumber const-folding but always pairs an operand with NaN, so the finite opposite-signed-zero case was never tested.

Both are pre-existing on main, found by inspection. Tests added under JitBlue/Runtime_130830 and JitBlue/Runtime_130831.

CC. @dotnet/jit-contrib

Note

This PR description was authored with the help of GitHub Copilot.

The scalar-only IsScalarZero refinement guarded on the isScalar pointer (always non-null) rather than *isScalar, so a packed SUB-mapped intrinsic with a constant op1 whose low element is zero -- but which is not all-zero, e.g. Vector128.Create(0, 5, 6, 7) - x -- was mis-mapped to GT_NEG. morph consumes the packed effective oper and drops the real constant, a latent miscompile. Dereference the flag so the refinement only applies to scalar ops. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

The min-branch signed-zero fast path computed eedsFixup per isNumber/isScalar, then an unconditional trailing block overwrote it with IsVectorNegativeZero for all four cases -- so scalar and non-negative-zero vector cases got the wrong value. When it wrongly lands alse, the const-fold fast path is taken without the required AVX512 fixup, a latent miscompile of Min with a signed-zero constant. Mirror the correct max branch: the non-scalar non-number case uses IsVectorNegativeZero and the stray block is removed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Covers packed integer `(cns - v1) + v2` where the constant's low lane is zero, which was previously miscompiled by dropping the constant. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Covers Min/MinNumber with a signed-zero constant, the finite opposite-signed-zero case that Runtime_98068 never exercised. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

azure-pipelines · 2026-07-16T01:47:37Z

Azure Pipelines: Successfully started running 5 pipeline(s). 10 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-07-16T01:48:13Z

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR fixes two latent correctness issues in CoreCLR JIT’s gentree.cpp HWIntrinsic handling and adds targeted JitBlue regression coverage to prevent regressions.

Changes:

Fix GenTreeHWIntrinsic::GetOperForHWIntrinsicId(..., getEffectiveOp: true) to test *isScalar (not the out-param pointer) before treating certain SUB patterns as NEG.
Fix gtNewSimdMinMaxNode (xarch floating const-fold fast path) so needsFixup is computed correctly for signed-zero Min/MinNumber scenarios.
Add new JitBlue regression tests for both miscompiles.

Show a summary per file

File	Description
src/coreclr/jit/gentree.cpp	Correctness fixes for HWIntrinsic effective-op classification and signed-zero fixup gating in SIMD min/max constant folding.
src/tests/JIT/Regression/JitBlue/Runtime_130830/Runtime_130830.cs	Regression test ensuring packed integer subtract isn’t misreported as negate when only the low lane is zero.
src/tests/JIT/Regression/JitBlue/Runtime_130831/Runtime_130831.cs	Regression test intended to validate signed-zero behavior for `Min`/`MinNumber` with constant operands.

Copilot's findings

Files reviewed: 3/3 changed files
Comments generated: 1

Double/Single.Equals treat -0.0 and +0.0 as equal, so the original Assert.Equal assertions did not observe a wrong-signed-zero result. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot's findings

Files reviewed: 3/3 changed files
Comments generated: 2

The merged JitBlue tests need an explicit Compile entry to be built and run in CI; without it Runtime_130830 and Runtime_130831 were not exercised. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot's findings

Files reviewed: 4/4 changed files
Comments generated: 0 new

tannergooding · 2026-07-16T02:43:48Z

CC. @dotnet/jit-contrib, @EgorBo. Two simple bug fixes with regression tests

`Runtime_129288.cs` was added in #129348 (`JIT: don't claim rotates set ZF on xarch`) as a merged-style xunit test (`[Fact] public static int TestEntryPoint()`), but it was never referenced by any `Regression_*.csproj`. Since the SDK-style CLR test projects set `EnableDefaultItems=false`, an unreferenced `.cs` is silently never built or run -- so CI has never exercised this test. This is the same class of bug fixed in #130832. Add it to `Regression_ro_2.csproj` (an `Optimize=True` bucket, correct for this lowering/codegen correctness test), inserted in numeric order alongside its neighbors. I also audited every other `.cs` under `src/tests/JIT/Regression/` for the same issue. The only genuine orphan was `Runtime_129288`. Six other unreferenced `.cs` files are intentionally uncompiled reference sources paired with a hand-written/generated `.il` + `.ilproj` (`Runtime_70259`, `Runtime_70607`, `Runtime_73615`, `Runtime_80731`, `Runtime_40607`, `DevDiv_754566`) and were left as-is. > [!NOTE] > This PR description and the change were generated with the assistance of GitHub Copilot. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

tannergooding and others added 4 commits July 15, 2026 17:58

Add regression test for GetOperForHWIntrinsicId isScalar fix

b30845a

Covers packed integer `(cns - v1) + v2` where the constant's low lane is zero, which was previously miscompiled by dropping the constant. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Add regression test for gtNewSimdMinMaxNode needsFixup fix

ac4ba64

Covers Min/MinNumber with a signed-zero constant, the finite opposite-signed-zero case that Runtime_98068 never exercised. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 16, 2026 01:46

github-actions Bot added the area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI label Jul 16, 2026

dotnet-policy-service Bot assigned tannergooding Jul 16, 2026

Copilot started reviewing on behalf of tannergooding July 16, 2026 01:47 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Comment thread src/tests/JIT/Regression/JitBlue/Runtime_130831/Runtime_130831.cs

Compare signed-zero results bitwise in Runtime_130831

2ad2d7e

Double/Single.Equals treat -0.0 and +0.0 as equal, so the original Assert.Equal assertions did not observe a wrong-signed-zero result. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 16, 2026 02:08

Copilot started reviewing on behalf of tannergooding July 16, 2026 02:08 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Comment thread src/tests/JIT/Regression/JitBlue/Runtime_130830/Runtime_130830.cs

Comment thread src/tests/JIT/Regression/JitBlue/Runtime_130831/Runtime_130831.cs

Reference new JitBlue tests from Regression_ro_2.csproj

45c9dfe

The merged JitBlue tests need an explicit Compile entry to be built and run in CI; without it Runtime_130830 and Runtime_130831 were not exercised. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 16, 2026 02:29

Copilot started reviewing on behalf of tannergooding July 16, 2026 02:29 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

tannergooding mentioned this pull request Jul 16, 2026

Wire up orphaned Runtime_129288 regression test #130836

Merged

This was referenced Jul 16, 2026

The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008

Open

Flaky timeout in CreateFileChangeToken_RootDeletedAndRecreated_TokenFiresWhenFileCreated #129691

Open

tannergooding requested a review from EgorBo July 18, 2026 16:44

build-analysis Bot mentioned this pull request Jul 18, 2026

Unable to pull image from mcr.microsoft.com #117164

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix two latent HWIntrinsic miscompiles in gentree.cpp#130832

Fix two latent HWIntrinsic miscompiles in gentree.cpp#130832
tannergooding wants to merge 6 commits into
dotnet:mainfrom
tannergooding:gentree-correctness-fixes

tannergooding commented Jul 16, 2026

Uh oh!

azure-pipelines Bot commented Jul 16, 2026

Uh oh!

dotnet-policy-service Bot commented Jul 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

tannergooding commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

tannergooding commented Jul 16, 2026

Uh oh!

azure-pipelines Bot commented Jul 16, 2026

Uh oh!

dotnet-policy-service Bot commented Jul 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

tannergooding commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants