JIT: fix bug in jump threading (#85942)

Verify that the purported dominator of a block to be jump threaded dominates
all of the block's predecessors.

This will initially be true (modulo some odd cases with finally continuations),
but if we've jump threaded through the dominator it may not remain true as
we do not update dominators when optimizing.

Fixes #85892.

diff --git a/src/coreclr/jit/redundantbranchopts.cpp b/src/coreclr/jit/redundantbranchopts.cpp
index abf6e5c..de0dd3d 100644 (file)
--- a/src/coreclr/jit/redundantbranchopts.cpp
+++ b/src/coreclr/jit/redundantbranchopts.cpp
@@ -807,6 +807,24 @@ bool Compiler::optJumpThreadCheck(BasicBlock* const block, BasicBlock* const dom
         }
     }
 
+    // Verify that dom block dominates all of block's predecessors.
+    //
+    // This will initially be true but if we jump thread through
+    // dom block, it may no longer be true.
+    //
+    if (domBlock != nullptr)
+    {
+        for (BasicBlock* const predBlock : block->PredBlocks())
+        {
+            if (!fgDominate(domBlock, predBlock))
+            {
+                JITDUMP("Dom " FMT_BB " is stale (does not dominate pred " FMT_BB "); no threading\n", domBlock->bbNum,
+                        predBlock->bbNum);
+                return false;
+            }
+        }
+    }
+
     // Since flow is going to bypass block, make sure there
     // is nothing in block that can cause a side effect.
     //

diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_85892/Runtime_85892.cs b/src/tests/JIT/Regression/JitBlue/Runtime_85892/Runtime_85892.cs
new file mode 100644 (file)
index 0000000..bd88dbb
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_85892/Runtime_85892.cs
@@ -0,0 +1,102 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System;
+using System.Runtime.CompilerServices;
+using Xunit;
+
+// Generated by Fuzzlyn v1.5 on 2023-05-07 18:03:16
+// Run on X64 Windows
+// Seed: 7683094625213390431
+// Reduced from 235.6 KiB to 1.4 KiB in 00:02:04
+// Debug: Prints 0 line(s)
+// Release: Prints 1 line(s)
+
+public interface I1
+{
+}
+
+public interface I2
+{
+}
+
+public struct S0 : I2
+{
+    public ushort F0;
+    public short F1;
+    public uint F2;
+    public uint F3;
+    public S0(ushort f0, short f1, uint f2, uint f3): this()
+    {
+        F0 = f0;
+        F1 = f1;
+        F2 = f2;
+        F3 = f3;
+    }
+}
+
+public class C0 : I1
+{
+    public short F0;
+}
+
+public class Runtime_85892
+{
+    public static I1[] s_17 = new I1[]{new C0()};
+    public static long[] s_107;
+    
+    [Fact]
+    public static int Test()
+    {
+        int  ret = 100;
+        bool vr2 = default(bool);
+        long vr3 = 1234;
+        bool vr4 = !!M51();
+        if (vr4)
+        {
+            try
+            {
+                System.Console.WriteLine(12);
+            }
+            finally
+            {
+                var vr5 = new S0(0, 0, 0, 0);
+                M58(vr5, new S0(0, 0, 0, 0));
+            }
+
+            if (!vr4)
+            {
+                System.Console.WriteLine(34);
+            }
+        }
+
+        if (vr4)
+        {
+            s_107 = s_107;
+        }
+
+        if (vr4)
+        {
+            var vr6 = new C0();
+            System.Console.WriteLine(5678);
+            ret = -1;
+        }
+
+        return ret;
+    }
+
+    static void M57(ref I1 arg2)
+    {
+    }
+
+    static void M58(S0 argThis, I2 arg2)
+    {
+    }
+
+    static bool M51()
+    {
+        bool var27 = default(bool);
+        M57(ref s_17[0]);
+        return var27;
+    }
+}

diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_85892/Runtime_85892.csproj b/src/tests/JIT/Regression/JitBlue/Runtime_85892/Runtime_85892.csproj
new file mode 100644 (file)
index 0000000..1bb887e
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_85892/Runtime_85892.csproj
@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <Optimize>True</Optimize>
+    <DebugType>None</DebugType>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="$(MSBuildProjectName).cs" />
+  </ItemGroup>
+</Project>
\ No newline at end of file