Test failure: System.Xml.Tests.SameInstanceXslTransformWriter.Variations(param0: \"xslt_mutith_attribute_sets.xsl\", param1: \"xslt_mutith_attribute_sets.xml\")

[v-haren]

failed in job: runtime-coreclr libraries-jitstress 20200809.1

Error message

System.Xml.Xsl.XsltException : '' is an invalid QName.


Stack trace
   at System.Xml.Tests.CThreads.Wait() in /_/src/libraries/System.Private.Xml/tests/Xslt/XslTransformApi/CThreads.cs:line 93
   at System.Xml.Tests.CSameInstanceXslTransformTestCase.Variations(Object param0, Object param1) in /_/src/libraries/System.Private.Xml/tests/Xslt/XslTransformApi/CXslTransformMultith.cs:line 93

[ghost]

Tagging subscribers to this area: @buyaa-n, @krwq
See info in area-owners.md if you want to be subscribed.

[echesakov]

This has been failing in runtime-coreclr libraries-jitstress since last Sunday build 20200809.1 and it seems like a codegen issue to me. I am going to take a look and see if there were any changes between 51ad8e4 and 4a58c28 that affected this test.

Marking as 5.0 for now

[BruceForstall]

These failures are causing considerable noise in the test runs (failing every configuration, AFAICT), so we should consider temporarily disabling them if a fix isn't available soon.

[echesakov]

The underlying issue is identified and it's due to the following transformation in morph:

fgMorphTree BB04, STMT00001 (before)
               [000007] -A-XG-------              *  ASG       byte  
               [000006] *------N----              +--*  IND       byte  
               [000004] ------------              |  \--*  ADDR      long  
               [000003] -------N----              |     \--*  LCL_VAR   int    V02 loc1         
               [000005] ------------              \--*  LCL_VAR   bool   V00 arg0         

Local V02 should not be enregistered because: was accessed as a local field

fgMorphTree BB04, STMT00001 (after)
               [000007] -A--G+------              *  ASG       byte  
               [000003] U----+-N----              +--*  LCL_FLD   byte   V02 loc1         [+0]
               [000017] -----+------              \--*  CAST      int <- bool <- int
               [000005] -----+------                 \--*  LCL_VAR   int    V00 arg0 

while before #40535 such tree would be morphed in the following way

fgMorphTree BB04, STMT00001 (before)
               [000007] -A-XG-------              *  ASG       byte  
               [000006] *------N----              +--*  IND       byte  
               [000004] ------------              |  \--*  ADDR      long  
               [000003] -------N----              |     \--*  LCL_VAR   int    V02 loc1         
               [000005] ------------              \--*  LCL_VAR   bool   V00 arg0         
GenTreeNode creates assertion:
               [000007] -A--G-------              *  ASG       byte  
In BB04 New Local Subrange Assertion: V02 in [0..1] index=#01, mask=0000000000000001

fgMorphTree BB04, STMT00001 (after)
               [000007] -A--G+------              *  ASG       byte  
               [000003] D----+-N----              +--*  LCL_VAR   int    V02 loc1         
               [000017] -----+------              \--*  CAST      int <- bool <- int
               [000005] -----+------                 \--*  LCL_VAR   int    V00 arg0         

As a consequence, the upper 3 bytes of local have arbitrary values as it was demonstrated in #40871.

The approach when we set varDsc->lvForceLoadNormalize = true and force loads to be normalized doesn't work since we might have already morphed loads for the corresponding local without requiring normalization.

The potential solution could be (as in 47a9b263998fb9d69523e45f7a98cb26249aaf47):

1. keep folding IND(ADDR(LCL_VAR)) on lhs of ASG into LCL_VAR
2. fold loads IND(ADDR(LCL_VAR)) for compatible types of indirection and locals (i.e. same size and signed-ness); fold to LCL_FLD otherwise
3. run fgDoNormalizeOnStore() on ASG of folded in step 1) nodes

@dotnet/jit-contrib

[BruceForstall]

RC2 merge was done.