JIT: Assertion failed 'type != TYP_VOID' during 'Optimize Valnum CSEs'

[amanasifkhalid]

Hit by Antigen on macOS arm64:

// Found by Antigen
// Reduced from 24.98 KB to 779 B.
using System;
using System.Collections.Generic;
using System.Runtime.CompilerServices;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.Arm;
using System.Runtime.Intrinsics.X86;
using System.Numerics;
public class TestClass
{
    static Vector64<uint> s_v64_uint_23 = Vector64<uint>.AllBitsSet;
    Vector64<uint> v64_uint_74 = Vector64.Create((uint)2, 2);
    public void Method0()
    {
        unchecked
        {
            AdvSimd.MaxPairwise(v64_uint_74 += Vector64.ConditionalSelect(Vector64<uint>.Zero, s_v64_uint_23, s_v64_uint_23) & v64_uint_74, v64_uint_74 += (s_v64_uint_23 ^ v64_uint_74)& (s_v64_uint_23 = v64_uint_74));
            return;
        }
    }
    public static void Main(string[] args)
    {
        new TestClass().Method0();
    }
}
/*
Environment:

set DOTNET_TieredCompilation=0

Assert failure(PID 13404 [0x0000345c], Thread: 5136 [0x1410]): Assertion failed 'type != TYP_VOID' in 'TestClass:Method0():this' during 'Optimize Valnum CSEs' (IL size 111; hash 0x46e9aa75; FullOpts)
    File: C:\wk\runtime\src\coreclr\jit\gentree.cpp:8388
    Image: C:\aman\Core_Root\corerun.exe
*/

cc @dotnet/jit-contrib

[jakobbotsch]

We have a tree that looks like:

N017 ( 45, 48)              [000022] --CXG+-----                         └──▌  HWINTRINSIC simd8  uint And <l:$248, c:$247>
N012 ( 40, 44) CSE #06 (def)[000018] --CXG+-----                            ├──▌  COMMA     simd8  <l:$245, c:$244>
N006 ( 17, 15) CSE #02 (def)[000009] H-CXG+-----                            │  ├──▌  CALL help byref  CORINFO_HELP_GET_GCSTATIC_BASE $181
N005 (  3, 12) CSE #01 (def)[000008] H----+----- arg0 in x0                 │  │  └──▌  CNS_INT(h) long   0x7fff12f9eea8 class TestClass $1c1
N011 ( 23, 29) CSE #07 (def)[000016] --CXG+-----                            │  └──▌  COMMA     simd8  <l:$245, c:$244>
N008 ( 17, 15) CSE #02 (use)[000015] H-CXG+-----                            │     ├──▌  CALL help byref  CORINFO_HELP_GET_GCSTATIC_BASE $181
N007 (  3, 12) CSE #01 (use)[000014] H----+----- arg0 in x0                 │     │  └──▌  CNS_INT(h) long   0x7fff12f9eea8 class TestClass $1c1
N010 (  6, 14)              [000012] I---G+-----                            │     └──▌  IND       simd8  <l:$243, c:$c5>
N009 (  3, 12) CSE #05 (def)[000011] H----+-----                            │        └──▌  CNS_INT(h) long   0x236f19f2d80 static Fseq[s_v64_uint_23] $1c2
N016 (  4,  3) CSE #03 (use)[000021] ---XG+-----                            └──▌  IND       simd8  <l:$241, c:$246>
N015 (  3,  4)              [000076] -----+-N---                               └──▌  ADD       byref  $180
N013 (  1,  1)              [000019] -----+-----                                  ├──▌  LCL_VAR   ref    V00 this         u:1 $80
N014 (  1,  2)              [000075] -----+-----                                  └──▌  CNS_INT   long   8 Fseq[v64_uint_74] $140

We first CSE candidate 6 which turns it into:

N020 ( 46, 49)              [000022] -ACXG+-----                            │     └──▌  HWINTRINSIC simd8  uint And <l:$248, c:$247>
N015 ( 41, 45)              [000095] -ACXG------                            │        ├──▌  COMMA     simd8  <l:$245, c:$244>
N013 ( 40, 44)              [000018] -ACXG+-----                            │        │  ├──▌  COMMA     void   <l:$245, c:$244>
N006 ( 17, 15) CSE #02 (def)[000009] H-CXG+-----                            │        │  │  ├──▌  CALL help byref  CORINFO_HELP_GET_GCSTATIC_BASE $181
N005 (  3, 12) CSE #01 (def)[000008] H----+----- arg0 in x0                 │        │  │  │  └──▌  CNS_INT(h) long   0x7fff12f9eea8 class TestClass $1c1
N012 ( 23, 29) CSE #07 (def)[000016] -ACXG+-----                            │        │  │  └──▌  COMMA     void   <l:$245, c:$244>
N008 ( 17, 15) CSE #02 (use)[000015] H-CXG+-----                            │        │  │     ├──▌  CALL help byref  CORINFO_HELP_GET_GCSTATIC_BASE $181
N007 (  3, 12) CSE #01 (use)[000014] H----+----- arg0 in x0                 │        │  │     │  └──▌  CNS_INT(h) long   0x7fff12f9eea8 class TestClass $1c1
N011 (  6, 14) CSE #06 (def)[000093] DA--G------                            │        │  │     └──▌  STORE_LCL_VAR simd8  V10 cse1         d:1 $VN.Void
N010 (  6, 14)              [000012] I---G+-----                            │        │  │        └──▌  IND       simd8  <l:$243, c:$c5>
N009 (  3, 12) CSE #05 (def)[000011] H----+-----                            │        │  │           └──▌  CNS_INT(h) long   0x236f19f2d80 static Fseq[s_v64_uint_23] $1c2
N014 (  1,  1)              [000094] -----------                            │        │  └──▌  LCL_VAR   simd8  V10 cse1         u:1 <l:$245, c:$244>
N019 (  4,  3) CSE #03 (use)[000021] ---XG+-----                            │        └──▌  IND       simd8  <l:$241, c:$246>
N018 (  3,  4)              [000076] -----+-N---                            │           └──▌  ADD       byref  $180
N016 (  1,  1)              [000019] -----+-----                            │              ├──▌  LCL_VAR   ref    V00 this         u:1 $80
N017 (  1,  2)              [000075] -----+-----                            │              └──▌  CNS_INT   long   8 Fseq[v64_uint_74] $140

Now [000016] has become void typed. We proceed to try to CSE it but then we hit the assert.
Unclear to me why these are separate CSE candidates in the first place given that they have the same VNs.