From c8f6f2d6eb11df83585df6b9849d10043a2e8e38 Mon Sep 17 00:00:00 2001 From: Pat Gavlin Date: Tue, 3 Jan 2017 12:24:56 -0800 Subject: [PATCH] Fix DevDiv bug 359737. This bug was an assertion during CSE that ensures that all CSE candidates have value numbers. This assertion tripped because an earlier CSE in the same tree as the faulty candidate re-morphed modulus by a constant into a divide and subtract; the resulting tree was left without value numbers. This change disables the problematic transform when remorphing as part of CSE. Commit migrated from https://github.com/dotnet/coreclr/commit/7b32c8db705fc861ab3c52c47aecc6b647b7d5e8 --- src/coreclr/src/jit/morph.cpp | 3 +- .../JitBlue/DevDiv_359737/DevDiv_359737.il | 42 ++++++++++++++++++++++ .../JitBlue/DevDiv_359737/DevDiv_359737.ilproj | 41 +++++++++++++++++++++ 3 files changed, 85 insertions(+), 1 deletion(-) create mode 100644 src/coreclr/tests/src/JIT/Regression/JitBlue/DevDiv_359737/DevDiv_359737.il create mode 100644 src/coreclr/tests/src/JIT/Regression/JitBlue/DevDiv_359737/DevDiv_359737.ilproj diff --git a/src/coreclr/src/jit/morph.cpp b/src/coreclr/src/jit/morph.cpp index 678bb34..e50a312 100644 --- a/src/coreclr/src/jit/morph.cpp +++ b/src/coreclr/src/jit/morph.cpp @@ -10998,6 +10998,7 @@ GenTreePtr Compiler::fgMorphSmpOp(GenTreePtr tree, MorphAddrContext* mac) // // a % b = a - (a / b) * b; // + assert(!optValnumCSE_phase); tree = fgMorphModToSubMulDiv(tree->AsOp()); op1 = tree->gtOp.gtOp1; op2 = tree->gtOp.gtOp2; @@ -11010,7 +11011,7 @@ GenTreePtr Compiler::fgMorphSmpOp(GenTreePtr tree, MorphAddrContext* mac) // the redundant division. If there's no redundant division then // nothing is lost, lowering would have done this transform anyway. - if ((tree->OperGet() == GT_MOD) && op2->IsIntegralConst()) + if (!optValnumCSE_phase && ((tree->OperGet() == GT_MOD) && op2->IsIntegralConst())) { ssize_t divisorValue = op2->AsIntCon()->IconValue(); size_t absDivisorValue = (divisorValue == SSIZE_T_MIN) ? static_cast(divisorValue) diff --git a/src/coreclr/tests/src/JIT/Regression/JitBlue/DevDiv_359737/DevDiv_359737.il b/src/coreclr/tests/src/JIT/Regression/JitBlue/DevDiv_359737/DevDiv_359737.il new file mode 100644 index 0000000..9917c21 --- /dev/null +++ b/src/coreclr/tests/src/JIT/Regression/JitBlue/DevDiv_359737/DevDiv_359737.il @@ -0,0 +1,42 @@ +// Licensed to the .NET Foundation under one or more agreements. +// The .NET Foundation licenses this file to you under the MIT license. +// See the LICENSE file in the project root for more information. + +.assembly extern mscorlib {} +.assembly DevDiv_359737 {} + +// This test originally repro'd a bug in morph that transformed modulus by a constant into division and subtraction +// while re-morphing as part of CSE. + +.class C extends [mscorlib]System.Object +{ + .method static int16 M() cil managed noinlining + { + ldc.i4 0x78804C04 + conv.ovf.u2 + dup + rem + ret + } + + .method static int32 Main() cil managed + { + .entrypoint + + .try + { + call int16 C::M() + pop + leave.s done + } + catch [mscorlib]System.Exception + { + pop + leave.s done + } + + done: + ldc.i4 100 + ret + } +} diff --git a/src/coreclr/tests/src/JIT/Regression/JitBlue/DevDiv_359737/DevDiv_359737.ilproj b/src/coreclr/tests/src/JIT/Regression/JitBlue/DevDiv_359737/DevDiv_359737.ilproj new file mode 100644 index 0000000..f05d981 --- /dev/null +++ b/src/coreclr/tests/src/JIT/Regression/JitBlue/DevDiv_359737/DevDiv_359737.ilproj @@ -0,0 +1,41 @@ + + + + + Debug + AnyCPU + $(MSBuildProjectName) + 2.0 + {95DFC527-4DC1-495E-97D7-E94EE1F7140D} + Exe + Properties + 512 + {786C830F-07A1-408B-BD7F-6EE04809D6DB};{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC} + $(ProgramFiles)\Common Files\microsoft shared\VSTT .0\UITestExtensionPackages + ..\..\ + 7a9bfb7d + + + + + + + + + False + + + + None + True + + + + + + + + + + + -- 2.7.4