JIT: Assertion failed '!"Non-store block node in Lowering"'

[jakobbotsch]

Seeing this assertion in win-x86 libraries.pmi replay:
Example console log: https://helixr1107v0xdcypoyl9e7f.blob.core.windows.net/dotnet-runtime-refs-pull-123690-merge-5bff0455b68440a8b7/windows-x86-2/1/console.24c68eb7.log

[13:00:38] Invoking: C:\h\w\ACEB0980\p\superpmi.exe -a -v ewi -f C:\h\w\ACEB0980\t\tmptzy50v66\libraries.pmi.windows.x86.checked.mch_fail.mcl -details C:\h\w\ACEB0980\t\tmptzy50v66\libraries.pmi.windows.x86.checked.mch_details.csv -jitoption force JitEnableNoWayAssert=1 -jitoption force JitNoForceFallback=1 -jitoption force JitAlignLoops=0 -jit2option force JitEnableNoWayAssert=1 -jit2option force JitNoForceFallback=1 -jit2option force JitAlignLoops=0 -p -failureLimit 100 C:\h\w\ACEB0980\p\base\checked\clrjit_win_x86_x86.dll C:\h\w\ACEB0980\p\diff\checked\clrjit_win_x86_x86.dll C:\h\w\ACEB0980\w\BE7809DC\e\artifacts\spmi\mch\db46fd97-a8e8-4bda-9cec-d7feb061154c.windows.x86\libraries.pmi.windows.x86.checked.mch

[13:06:31] ERROR: Exception thrown: DebugBreak or AV Exception 123

[13:06:31] ERROR: Method 167054 of size 339 failed to load and compile correctly by JIT1 (C:\h\w\ACEB0980\p\base\checked\clrjit_win_x86_x86.dll).

[13:06:31] ERROR: Exception thrown: DebugBreak or AV Exception 123

[13:06:31] ERROR: Method 167054 of size 339 failed to load and compile correctly by JIT2 (C:\h\w\ACEB0980\p\diff\checked\clrjit_win_x86_x86.dll).

[13:06:31] ERROR: Exception thrown: DebugBreak or AV Exception 123

[13:06:31] ERROR: Method 149203 of size 339 failed to load and compile correctly by JIT1 (C:\h\w\ACEB0980\p\base\checked\clrjit_win_x86_x86.dll).

[13:06:31] ERROR: Exception thrown: DebugBreak or AV Exception 123

[13:06:31] ERROR: Method 149203 of size 339 failed to load and compile correctly by JIT2 (C:\h\w\ACEB0980\p\diff\checked\clrjit_win_x86_x86.dll).

[13:06:31] ISSUE: <ASSERT> #167054 D:\a\_work\1\s\src\coreclr\jit\lsraxarch.cpp (535) - Assertion failed '!"Non-store block node in Lowering"' in 'Microsoft.CodeAnalysis.Diagnostics.HostAnalysisScope+<>c__DisplayClass11_0:<RegisterSymbolAction>b__0(Microsoft.CodeAnalysis.Diagnostics.SymbolAnalysisContext):this' during 'Linear scan register alloc' (IL size 339; hash 0x9e1b0bc1; FullOpts)

From a quick look it looks like a retyping bug in object stack allocation. We have

------------ BB09 [0008] [06B..072) -> BB11(1) (always), preds={BB08} succs={BB11}

***** BB09 [0008]
STMT00053 ( 0x06B[E--] ... 0x070 )
               [000174] -ACXG------                         ▌  COMMA     struct
               [000173] H-CXG------                         ├──▌  CALL help byref  CORINFO_HELP_GET_GCSTATIC_BASE
               [000172] H---------- arg0                    │  └──▌  CNS_INT(h) int    0xDF31EDC class System.Collections.Immutable.ImmutableArray`1[Microsoft.CodeAnalysis.IParameterSymbol]
               [000175] DA--G------                         └──▌  STORE_LCL_VAR struct<System.Collections.Immutable.ImmutableArray`1, 4> V24 tmp15        
               [000170] n---G------                            └──▌  BLK       struct<System.Collections.Immutable.ImmutableArray`1, 4>
               [000169] -----------                               └──▌  ADD       byref 
               [000167] I----------                                  ├──▌  IND       ref   
               [000166] H----------                                  │  └──▌  CNS_INT(h) int    0x71224C0 static box ptr
               [000168] -----------                                  └──▌  CNS_INT   int    4 Fseq[<unknown field>]

before, and

***** BB09 [0008]
STMT00053 ( 0x06B[E--] ... 0x070 )
               [000174] -ACXG------                         ▌  COMMA     byref 
               [000173] H-CXG------                         ├──▌  CALL help byref  CORINFO_HELP_GET_GCSTATIC_BASE
               [000172] H---------- arg0                    │  └──▌  CNS_INT(h) int    0xDF31EDC class System.Collections.Immutable.ImmutableArray`1[Microsoft.CodeAnalysis.IParameterSymbol]
               [000175] DA--G------                         └──▌  STORE_LCL_VAR byref  V24 tmp15        
               [000170] n---G------                            └──▌  BLK       struct<System.Collections.Immutable.ImmutableArray`1, 4>
               [000169] -----------                               └──▌  ADD       byref 
               [000167] I----------                                  ├──▌  IND       ref   
               [000166] H----------                                  │  └──▌  CNS_INT(h) int    0x71224C0 static box ptr
               [000168] -----------                                  └──▌  CNS_INT   int    4 Fseq[<unknown field>]

after. Notice the illegal IR at [000175]. cc @dotnet/jit-contrib @AndyAyersMS

[EgorBo]

Seems to be happening in ObjectAllocator::RewriteUses() if that helps

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @dotnet/jit-contrib
See info in area-owners.md if you want to be subscribed.

[AndyAyersMS]

I'll take a look.

[AndyAyersMS]

We have allocated a local struct's referent on the stack, so want to retype the field occurrences to BYREFs. So far so good.

We correctly don't retype the store as it's not a field reference, but because of a quirk in how retyping works we go on to try and retype the parent node (COMMA).

The type of the COMMA is nebulous here (since the store does not produce a value) but the convention is that it matches its op2 type. So when we retype the COMMA to BYREF it propagates down and retypes the store, because calling ChangeType on a COMMA propagates that type back down the tree.

The fix is to not perform ancestor retyping in such cases.