JIT: Assertion failed 'dsc->TypeGet() != TYP_BYREF' during 'Transform async'

[jakobbotsch]

Another one of these, likely forward sub is the root cause here.

// Generated by Fuzzlyn v3.1 on 2025-05-22 14:51:44
// Run on X64 Windows
// Seed: 6262184068116177154-async,runtimeasync,vectort,vector128,vector256,x86aes,x86avx,x86avx2,x86bmi1,x86bmi1x64,x86bmi2,x86bmi2x64,x86fma,x86lzcnt,x86lzcntx64,x86pclmulqdq,x86pclmulqdqv256,x86popcnt,x86popcntx64,x86sse,x86ssex64,x86sse2,x86sse2x64,x86sse3,x86sse41,x86sse41x64,x86sse42,x86sse42x64,x86ssse3,x86x86base
// Reduced from 106.2 KiB to 2.8 KiB in 00:05:37
// Hits JIT assert for Release with Runtime Async:
// Assertion failed 'dsc->TypeGet() != TYP_BYREF' in 'Program:M1(System.Runtime.Intrinsics.Vector128`1[ubyte],uint,uint,ubyte,System.Numerics.Vector`1[short],System.Runtime.Intrinsics.Vector256`1[ubyte]):int' during 'Transform async' (IL size 145; hash 0xad21e747; FullOpts)
//
//     File: C:\dev\dotnet\runtime3\src\coreclr\jit\async.cpp Line: 654
//
using System;
using System.Numerics;
using System.Threading.Tasks;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;

public class Program
{
    public static long s_1;
    public static byte s_2;
    public static Vector<short>[] s_10 = new Vector<short>[]
    {
        Vector128.CreateScalar((short)0).AsVector()
    };
    public static ushort[] s_21 = new ushort[]
    {
        0,
        0,
        0,
        1,
        0,
        0,
        0,
        0,
        1,
        1
    };
    public static void Main()
    {
        M0().GetAwaiter().GetResult();
    }

    public static async Task M0()
    {
        var vr13 = (byte)0;
        var vr11 = Vector128.CreateScalar(vr13);
        var vr14 = Bmi1.BitFieldExtract(0, 0, 1);
        var vr24 = Vector128.CreateScalar(205039222535274036UL);
        var vr33 = Vector128.CreateScalar(0UL);
        var vr37 = Vector128.CreateScalar(4294967294U);
        var vr36 = Sse2.ConvertToUInt32(vr37);
        var vr35 = Vector128.Create<ulong>(vr36);
        var vr27 = Sse2.And(vr33, vr35);
        var vr16 = Sse41.TestNotZAndNotC(vr24, vr27);
        var vr38 = s_10[0];
        var vr39 = Vector256.Create<byte>(0);
        var vr10 = await M1(vr11, vr14, 0, vr16, vr38, vr39);
    }

    public static async Task<int> M1(Vector128<byte> arg0, uint arg1, uint arg2, bool arg3, Vector<short> arg4, Vector256<byte> arg5)
    {
        uint[][] var14 = default(uint[][]);
        var vr12 = var14[0][0];
        var vr8 = Vector128.Create<uint>(vr12);
        var vr5 = M5(vr8);
        var vr17 = var14[0][0];
        var vr15 = M3(vr17);
        var vr23 = (sbyte)1;
        var vr22 = Vector256.CreateScalar(vr23);
        var vr18 = (short)(await M2(s_1, 0, 0, vr22));
        var vr28 = Vector256.Create<sbyte>(0);
        var vr30 = (sbyte)Bmi1.X64.TrailingZeroCount(0);
        var vr29 = Vector256.Create<sbyte>(vr30);
        var vr26 = Avx2.Xor(vr28, vr29);
        var vr32 = (sbyte)0;
        var vr31 = Vector256.CreateScalar(vr32);
        var vr25 = Avx2.Permute2x128(vr26, vr31, 0);
        var vr4 = (byte)await M2(vr5, vr15, vr18, vr25);
        arg0 = Vector128.Create<byte>(vr4);
        System.Console.WriteLine(arg0);
        return 0;
    }

    public static async Task<uint> M2(long arg0, ulong arg1, short arg2, Vector256<sbyte> arg3)
    {
        var vr21 = Vector256.Create<ushort>(0);
        var vr34 = Vector256.Create(0, 0, 1, 0, 0, 1, 65534, 0, 1, 0, 0, 0, 0, 1, 0, 0);
        var vr20 = Avx2.Subtract(vr21, vr34);
        return 0;
    }

    public static uint M3(ulong arg0)
    {
        int vr42 = (int)s_1++;
        return 0;
    }

    public static sbyte M5(Vector128<uint> arg0)
    {
        int var0 = 1 / (sbyte)((-(-s_2)) | 1);
        return (sbyte)s_2;
    }
}

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.