Skip to content

JIT: fix issue in assertion prop phi inference #116326

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 9, 2025
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions src/coreclr/jit/assertionprop.cpp
Original file line number Diff line number Diff line change
@@ -4285,6 +4285,11 @@ Compiler::AssertVisit Compiler::optVisitReachingAssertions(ValueNum vn, TAssertV
GenTreeLclVarCommon* node = ssaDef->GetDefNode();
assert(node->IsPhiDefn());

// Keep track of the set of phi-preds
//
BitVecTraits traits(fgBBNumMax + 1, this);
BitVec visitedBlocks = BitVecOps::MakeEmpty(&traits);

for (GenTreePhi::Use& use : node->Data()->AsPhi()->Uses())
{
GenTreePhiArg* phiArg = use.GetNode()->AsPhiArg();
@@ -4295,6 +4300,22 @@ Compiler::AssertVisit Compiler::optVisitReachingAssertions(ValueNum vn, TAssertV
// The visitor wants to abort the walk.
return AssertVisit::Abort;
}
BitVecOps::AddElemD(&traits, visitedBlocks, phiArg->gtPredBB->bbNum);
}

// Verify the set of phi-preds covers the set of block preds
//
for (BasicBlock* const pred : ssaDef->GetBlock()->PredBlocks())
{
if (!BitVecOps::IsMember(&traits, visitedBlocks, pred->bbNum))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doesn't it mean the SSA is basically stale?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, RBO messes up SSA, though in the past we've argued that it generally doesn't lead to making bad assumptions. This is one case where it does.

{
JITDUMP("... optVisitReachingAssertions in " FMT_BB ": pred " FMT_BB " not a phi-pred\n",
ssaDef->GetBlock()->bbNum, pred->bbNum);

// We missed examining a block pred. Fail the phi inference.
//
return AssertVisit::Abort;
}
}
return AssertVisit::Continue;
}
@@ -4431,6 +4452,7 @@ GenTree* Compiler::optAssertionPropGlobal_RelOp(ASSERT_VALARG_TP assertions,
// and if all of them are known to be non-null, we can bash the comparison to true/false.
if (op2->IsIntegralConst(0) && op1->TypeIs(TYP_REF))
{
JITDUMP("Checking PHI [%06u] arguments for non-nullness\n", dspTreeID(op1))
auto visitor = [this](ValueNum reachingVN, ASSERT_TP reachingAssertions) {
return optAssertionVNIsNonNull(reachingVN, reachingAssertions) ? AssertVisit::Continue : AssertVisit::Abort;
};
@@ -5005,6 +5027,7 @@ bool Compiler::optAssertionVNIsNonNull(ValueNum vn, ASSERT_VALARG_TP assertions)
}
}
}

return false;
}

8 changes: 8 additions & 0 deletions src/coreclr/jit/fgdiagnostic.cpp
Original file line number Diff line number Diff line change
@@ -409,6 +409,12 @@ FILE* Compiler::fgOpenFlowGraphFile(bool* wbDontClose, Phases phase, PhasePositi

#ifdef DEBUG
dumpFunction = JitConfig.JitDumpFg().contains(info.compMethodHnd, info.compClassHnd, &info.compMethodInfo->args);
dumpFunction |= ((unsigned)JitConfig.JitDumpFgHash() == info.compMethodHash());

if (opts.IsTier0())
{
dumpFunction &= (JitConfig.JitDumpFgTier0() > 0);
}

CompAllocator allocator = getAllocatorDebugOnly();
filename = JitConfig.JitDumpFgFile();
@@ -656,6 +662,8 @@ FILE* Compiler::fgOpenFlowGraphFile(bool* wbDontClose, Phases phase, PhasePositi
// Here are the config values that control it:
// DOTNET_JitDumpFg A string (ala the DOTNET_JitDump string) indicating what methods to dump
// flowgraphs for.
// DOTNET_JitDumpFgHash Dump flowgraphs for methods with this hash
// DOTNET_JitDumpFgTier0 Dump tier-0 compilations
// DOTNET_JitDumpFgDir A path to a directory into which the flowgraphs will be dumped.
// DOTNET_JitDumpFgFile The filename to use. The default is "default.[xml|dot]".
// Note that the new graphs will be appended to this file if it already exists.
17 changes: 10 additions & 7 deletions src/coreclr/jit/jitconfigvalues.h
Original file line number Diff line number Diff line change
@@ -262,13 +262,16 @@ CONFIG_METHODSET(JitUnwindDump, "JitUnwindDump") // Dump the unwind codes for th
// JitDumpFg - dump flowgraph
//

CONFIG_METHODSET(JitDumpFg, "JitDumpFg") // Dumps Xml/Dot Flowgraph for specified method
CONFIG_STRING(JitDumpFgDir, "JitDumpFgDir") // Directory for Xml/Dot flowgraph dump(s)
CONFIG_STRING(JitDumpFgFile, "JitDumpFgFile") // Filename for Xml/Dot flowgraph dump(s) (default: "default")
CONFIG_STRING(JitDumpFgPhase, "JitDumpFgPhase") // Phase-based Xml/Dot flowgraph support. Set to the short name of a
// phase to see the flowgraph after that phase. Leave unset to dump
// after COLD-BLK (determine first cold block) or set to * for all
// phases
CONFIG_METHODSET(JitDumpFg, "JitDumpFg") // Dumps Xml/Dot Flowgraph for specified method
CONFIG_INTEGER(JitDumpFgHash, "JitDumpFgHash", 0) // Dumps Xml/Dot Flowgraph for specified method
CONFIG_INTEGER(JitDumpFgTier0, "JitDumpFgTier0", 1) // Dumps Xml/Dot Flowgraph for tier-0 compilations of specified
// methods
CONFIG_STRING(JitDumpFgDir, "JitDumpFgDir") // Directory for Xml/Dot flowgraph dump(s)
CONFIG_STRING(JitDumpFgFile, "JitDumpFgFile") // Filename for Xml/Dot flowgraph dump(s) (default: "default")
CONFIG_STRING(JitDumpFgPhase, "JitDumpFgPhase") // Phase-based Xml/Dot flowgraph support. Set to the short name of a
// phase to see the flowgraph after that phase. Leave unset to dump
// after COLD-BLK (determine first cold block) or set to * for all
// phases
CONFIG_STRING(JitDumpFgPrePhase, "JitDumpFgPrePhase") // Same as JitDumpFgPhase, but specifies to dump pre-phase, not
// post-phase.
CONFIG_INTEGER(JitDumpFgDot, "JitDumpFgDot", 1) // 0 == dump XML format; non-zero == dump DOT format
41 changes: 41 additions & 0 deletions src/tests/JIT/Regression/JitBlue/Runtime_116212/Runtime_116212.cs
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

using System.Runtime.CompilerServices;
using Xunit;

public class Runtime_116212
{
[Fact]
public static void Test() => Problem(1, null);

[MethodImpl(MethodImplOptions.NoInlining)]
static void SideEffect(int x = 0) { }

[MethodImpl(MethodImplOptions.NoInlining)]
static bool Problem(int a, object? o)
{
if (o == null)
{
if (a == 0)
{
SideEffect();
}

if (a == 0)
{
o = new object();
}
}

object? oo = o;

if (oo != null)
{
SideEffect(oo.GetHashCode());
return true;
}

return false;
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<Optimize>True</Optimize>
</PropertyGroup>
<ItemGroup>
<Compile Include="$(MSBuildProjectName).cs" />
</ItemGroup>
</Project>
Loading
Oops, something went wrong.