From: Andy Ayers Date: Wed, 6 Mar 2019 18:14:40 +0000 (-0800) Subject: JIT: fix issue with assertion prop on isinst helpers (#23056) X-Git-Tag: accepted/tizen/unified/20190813.215958~61^2~24 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=5ce4140ca10cdda9af170d5215ff9de295c58a30;p=platform%2Fupstream%2Fcoreclr.git JIT: fix issue with assertion prop on isinst helpers (#23056) For calls to isinst helpers, morph may rearrange the order of args on the late arg list, so examine the operands to ensure the right ones are passed into the assertion creation code. Added simplified test case. Closes #23039. --- diff --git a/src/jit/assertionprop.cpp b/src/jit/assertionprop.cpp index 0ec9f4b..1ee56b2 100644 --- a/src/jit/assertionprop.cpp +++ b/src/jit/assertionprop.cpp @@ -1989,11 +1989,23 @@ AssertionInfo Compiler::optAssertionGenJtrue(GenTree* tree) op2 = op1->gtCall.gtCallLateArgs->gtOp.gtOp2; op1 = op1->gtCall.gtCallLateArgs; + // For the assertion, ensure op1 is the object being tested. + // Morph may have swizzled the operand order. + GenTree* op1op = op1->gtOp.gtOp1; + + if (op1op->TypeGet() == TYP_I_IMPL) + { + jitstd::swap(op1, op2); + op1op = op1->gtOp.gtOp1; + } + + assert(op1op->TypeGet() == TYP_REF); + // Reverse the assertion assert(assertionKind == OAK_EQUAL || assertionKind == OAK_NOT_EQUAL); assertionKind = (assertionKind == OAK_EQUAL) ? OAK_NOT_EQUAL : OAK_EQUAL; - if (op1->gtOp.gtOp1->gtOper == GT_LCL_VAR) + if (op1op->OperIs(GT_LCL_VAR)) { return optCreateJtrueAssertions(op1, op2, assertionKind); } diff --git a/tests/src/JIT/Regression/JitBlue/GitHub_23039/GitHub_23039.il b/tests/src/JIT/Regression/JitBlue/GitHub_23039/GitHub_23039.il new file mode 100644 index 0000000..df89620 --- /dev/null +++ b/tests/src/JIT/Regression/JitBlue/GitHub_23039/GitHub_23039.il @@ -0,0 +1,40 @@ +// Licensed to the .NET Foundation under one or more agreements. +// The .NET Foundation licenses this file to you under the MIT license. +// See the LICENSE file in the project root for more information. + +.assembly extern mscorlib +{ +} + +.assembly GitHub_23039 +{ +} + +// Bug where assertion prop was tripped up because morph swapped arg +// order on an isinst helper call that fed into a conditional jump, +// and the object being queried was null. + +.class public auto ansi beforefieldinit X`1 extends [mscorlib]System.Object +{ + .method public static hidebysig int32 F() cil managed noinlining + { + .locals init ([0] object) + ldloc.0 + isinst class X`1 + brtrue IS + ldc.i4 100 + ret +IS: ldc.i4 -1 + ret + } +} + +.class public auto ansi beforefieldinit Y extends [mscorlib]System.Object +{ + .method public static hidebysig int32 Main() cil managed + { + .entrypoint + call int32 class X`1::F() + ret + } +} diff --git a/tests/src/JIT/Regression/JitBlue/GitHub_23039/GitHub_23039.ilproj b/tests/src/JIT/Regression/JitBlue/GitHub_23039/GitHub_23039.ilproj new file mode 100644 index 0000000..07d1b0e --- /dev/null +++ b/tests/src/JIT/Regression/JitBlue/GitHub_23039/GitHub_23039.ilproj @@ -0,0 +1,37 @@ + + + + + Debug + AnyCPU + $(MSBuildProjectName) + 2.0 + {95DFC527-4DC1-495E-97D7-E94EE1F7140D} + Exe + {786C830F-07A1-408B-BD7F-6EE04809D6DB};{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC} + ..\..\ + + + + + + + + + False + + + + None + True + + + + + + + + + + +