JIT: Assertion failed '(imm < maxVal) || ((imm & signBitsMask) == signBitsMask)' during 'Generate code'

[jakobbotsch]

// Generated by Fuzzlyn v2.2 on 2024-08-05 19:14:52
// Run on Arm64 MacOS
// Seed: 16897731911671998240-vectort,vector64,vector128,armadvsimd,armadvsimdarm64,armaes,armarmbase,armarmbasearm64,armcrc32,armcrc32arm64,armdp,armrdm,armrdmarm64,armsha1,armsha256
// Reduced from 67.3 KiB to 0.3 KiB in 00:00:23
// Hits JIT assert in Debug:
// Assertion failed '(imm < maxVal) || ((imm & signBitsMask) == signBitsMask)' in 'Program:Main(Fuzzlyn.ExecutionServer.IRuntime)' during 'Generate code' (IL size 16; hash 0xade6b36b; MinOpts)
// 
//     File: /Users/runner/work/1/s/src/coreclr/jit/emitarm64.cpp Line: 2676
// 
using System;
using System.Runtime.CompilerServices;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.Arm;

public class Program
{
    public static void Main()
    {
        int vr2 = 0;
        Vector128.Create<short>((short)((0 * vr2) + 2147483647));
    }
}

cc @dotnet/jit-contrib

[JulieLeeMSFT]

@amanasifkhalid, PTAL.

[amanasifkhalid]

In MinOpts, we don't constant-fold casts, so before rationalizing, we have the following IR for the intrinsic:

*  STORE_LCL_VAR simd16 V02 tmp1
\--*  HWINTRINSIC simd16 short Create
   \--*  CAST      int <- short <- int
      \--*  CNS_INT   int    0x7FFFFFFF

Then during lowering, we lower the intrinsic to DuplicateToVector128, and then try to replace the GT_CAST operand with a constant in Lowering::IsValidConstForMovImm -- this seems like a last-minute effort to make up for the fact that we don't constant-fold in MinOpts. But unlike the folding logic for casts, this path doesn't modify the immediate if it's being casted to a smaller type, which seems illegal. Without asserts, emitter::normalizeImm64 will chop off the overflowing bits, but the failing assert suggests normalizeImm64 should only encounter overly-large immediates at this point if the sign bit has been extended; it doesn't take responsibility for casting immediates to smaller sizes.

We could duplicate the logic from constant-folding to fix the immediate, but since this path seems to only be relevant in MinOpts, I don't think we would gain much. I think the most surgical fix is to block the cast removal if we're narrowing the type, since narrowing casts might affect the immediate.