JIT: Assertion failed 'cond == test->AsOp()->gtOp1' during 'Update flow graph early pass'

[jakobbotsch]

// Generated by Fuzzlyn v3.3 on 2025-08-23 16:26:13
// Run on Arm64 MacOS
// Seed: 17015990397549431234-vectort,vector64,vector128,armadvsimd,armadvsimdarm64,armaes,armarmbase,armarmbasearm64,armcrc32,armcrc32arm64,armdp,armrdm,armrdmarm64,armsha1,armsha256
// Reduced from 36.5 KiB to 0.5 KiB in 00:00:13
// Hits JIT assert for Release:
// Assertion failed 'cond == test->AsOp()->gtOp1' in 'Program:M0()' during 'Update flow graph early pass' (IL size 32; hash 0xaf50ff37; FullOpts)
// 
//     File: /Users/runner/work/1/s/src/coreclr/jit/fgopt.cpp Line: 4535
// 
public class Program
{
    public static uint s_3;
    public static ulong s_7;
    public static void Main()
    {
        M0();
    }

    public static void M0()
    {
        long[] var3 = default(long[]);
        sbyte var24 = default(sbyte);
        if ((ulong)M1() > (ulong)var3[0])
        {
            var24 = var24;
        }
        else
        {
            uint var25 = s_3;
        }

        ulong var39 = s_7;
    }

    public static int M1()
    {
        return default(int);
    }
}

cc @dotnet/jit-contrib

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[jakobbotsch]

SPMI collection attached

F825B53E.zip

[AndyAyersMS]

We have

               [000012] --CXG------                         *  JTRUE     void  
               [000022] ---XG------                         \--*  COMMA     int   
               [000009] ---XG------                            +--*  INDEX_ADDR byref long[]
               [000007] -----------                            |  +--*  LCL_VAR   ref    V00 loc0         
               [000008] -----------                            |  \--*  CNS_INT   int    0
               [000021] -----------                            \--*  CNS_INT   int    1

and so gtReverseCond prepends a NOT, but the caller asserts there is no new IR.

I don't think the caller's assertion is necessary.

[jakobbotsch]

We still have an IR invariant that the operand of a JTRUE is always a relop. It would be nice to remove, but there are more places that have assertions about that. But as it is, it seems like the issue is in whoever produced that IR without folding it away.

[AndyAyersMS]

The simplification happens when substituting the inline return expression. Not sure how hard it will be to fix that.

INLINER: during 'fgInline' result 'success' reason 'below ALWAYS_INLINE size' for 'Program:M0()' calling 'Program:M1():int'
INLINER: during 'fgInline' result 'success' reason 'below ALWAYS_INLINE size'

Replacing the return expression placeholder [000005] with [000019]
               [000005] --C--------                         *  RET_EXPR  int   (for [000004]) -> [000019]

Inserting the inline return expression
               [000019] -----------                         *  CNS_INT   int    0


Folding long operator with constant nodes into a constant:
               [000006] --C--------                         *  CAST      long <- int
               [000019] -----------                         \--*  CNS_INT   int    0
Bashed to long constant:
               [000006] -----------                         *  CNS_INT   long   0

Folding binary operator with a constant operand:
               [000011] N-CXG----U-                         *  LE        int   
               [000006] -----------                         +--*  CNS_INT   long   0
               [000010] n--XG------                         \--*  IND       long  
               [000009] ---XG------                            \--*  INDEX_ADDR byref long[]
               [000007] -----------                               +--*  LCL_VAR   ref    V00 loc0         
               [000008] -----------                               \--*  CNS_INT   int    0
Transformed into:
               [000022] ---XG------                         *  COMMA     int   
               [000009] ---XG------                         +--*  INDEX_ADDR byref long[]
               [000007] -----------                         |  +--*  LCL_VAR   ref    V00 loc0         
               [000008] -----------                         |  \--*  CNS_INT   int    0
               [000021] -----------                         \--*  CNS_INT   int    1
**************** Inline Tree

[AndyAyersMS]

I think we can fix this up later in the substitution walk, when we reconsider the JTRUE.