Assertion failed 'assertion->op2.u1.iconFlags != GTF_EMPTY'

[BruceForstall]

Failure in:

pipeline: runtime-coreclr libraries-jitstressregs
net7.0-Linux-Release-arm64-CoreCLR_checked-jitstressregs3
System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests

https://dev.azure.com/dnceng/public/_build/results?buildId=1825354&view=ms.vss-test-web.build-test-results-tab&runId=48379878&paneView=debug&resultId=192608

+ export COMPlus_TieredCompilation=0
+ export COMPlus_DbgEnableMiniDump=1
+ export COMPlus_DbgMiniDumpName=/home/helixbot/dotnetbuild/dumps/coredump.%d.dmp
+ export COMPlus_JitStressRegs=3
+ printenv
+ grep COMPlus
COMPlus_TieredCompilation=0
COMPlus_DbgMiniDumpName=/home/helixbot/dotnetbuild/dumps/coredump.%d.dmp
COMPlus_JitStressRegs=3
COMPlus_DbgEnableMiniDump=1
+ ./RunTests.sh --runtime-path /root/helix/work/correlation
----- start Wed Jun 15 04:35:42 UTC 2022 =============== To repro directly: =====================================================
pushd .
/root/helix/work/correlation/dotnet exec --runtimeconfig System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests.runtimeconfig.json --depsfile System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests.deps.json xunit.console.dll System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing 
popd
===========================================================================================================
/root/helix/work/workitem/e /root/helix/work/workitem/e
  Discovering: System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests (method display = ClassAndMethod, method display options = None)
  Discovered:  System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests (found 24 test cases)
  Starting:    System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests (parallel test collections = on, max threads = 4)

Assert failure(PID 27 [0x0000001b], Thread: 41 [0x0029]): Assertion failed 'assertion->op2.u1.iconFlags != GTF_EMPTY' in 'Microsoft.CodeAnalysis.CSharp.Binder:BindNonGenericSimpleNamespaceOrTypeOrAliasSymbol(Microsoft.CodeAnalysis.CSharp.Syntax.IdentifierNameSyntax,Microsoft.CodeAnalysis.CSharp.BindingDiagnosticBag,Roslyn.Utilities.ConsList`1[[Microsoft.CodeAnalysis.CSharp.Symbols.TypeSymbol, Microsoft.CodeAnalysis.CSharp, Version=3.11.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]],bool,Microsoft.CodeAnalysis.CSharp.Symbols.NamespaceOrTypeSymbol):NamespaceOrTypeOrAliasSymbolWithAnnotations:this' during 'Assertion prop' (IL size 423; hash 0xca7cf7b9; FullOpts)

    File: /__w/1/s/src/coreclr/jit/assertionprop.cpp Line: 2035
    Image: /root/helix/work/correlation/dotnet

[createdump] Gathering state for process 27 dotnet
[createdump] Crashing thread 00000029 signal 00000006

@dotnet/jit-contrib

[ghost]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Failure in:

pipeline: runtime-coreclr libraries-jitstressregs
net7.0-Linux-Release-arm64-CoreCLR_checked-jitstressregs3
System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests

https://dev.azure.com/dnceng/public/_build/results?buildId=1825354&view=ms.vss-test-web.build-test-results-tab&runId=48379878&paneView=debug&resultId=192608

+ export COMPlus_TieredCompilation=0
+ export COMPlus_DbgEnableMiniDump=1
+ export COMPlus_DbgMiniDumpName=/home/helixbot/dotnetbuild/dumps/coredump.%d.dmp
+ export COMPlus_JitStressRegs=3
+ printenv
+ grep COMPlus
COMPlus_TieredCompilation=0
COMPlus_DbgMiniDumpName=/home/helixbot/dotnetbuild/dumps/coredump.%d.dmp
COMPlus_JitStressRegs=3
COMPlus_DbgEnableMiniDump=1
+ ./RunTests.sh --runtime-path /root/helix/work/correlation
----- start Wed Jun 15 04:35:42 UTC 2022 =============== To repro directly: =====================================================
pushd .
/root/helix/work/correlation/dotnet exec --runtimeconfig System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests.runtimeconfig.json --depsfile System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests.deps.json xunit.console.dll System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing 
popd
===========================================================================================================
/root/helix/work/workitem/e /root/helix/work/workitem/e
  Discovering: System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests (method display = ClassAndMethod, method display options = None)
  Discovered:  System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests (found 24 test cases)
  Starting:    System.Text.Json.SourceGeneration.Roslyn3.11.Unit.Tests (parallel test collections = on, max threads = 4)

Assert failure(PID 27 [0x0000001b], Thread: 41 [0x0029]): Assertion failed 'assertion->op2.u1.iconFlags != GTF_EMPTY' in 'Microsoft.CodeAnalysis.CSharp.Binder:BindNonGenericSimpleNamespaceOrTypeOrAliasSymbol(Microsoft.CodeAnalysis.CSharp.Syntax.IdentifierNameSyntax,Microsoft.CodeAnalysis.CSharp.BindingDiagnosticBag,Roslyn.Utilities.ConsList`1[[Microsoft.CodeAnalysis.CSharp.Symbols.TypeSymbol, Microsoft.CodeAnalysis.CSharp, Version=3.11.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]],bool,Microsoft.CodeAnalysis.CSharp.Symbols.NamespaceOrTypeSymbol):NamespaceOrTypeOrAliasSymbolWithAnnotations:this' during 'Assertion prop' (IL size 423; hash 0xca7cf7b9; FullOpts)

    File: /__w/1/s/src/coreclr/jit/assertionprop.cpp Line: 2035
    Image: /root/helix/work/correlation/dotnet

[createdump] Gathering state for process 27 dotnet
[createdump] Crashing thread 00000029 signal 00000006

@dotnet/jit-contrib

Author:	BruceForstall
Assignees:	-
Labels:	arch-arm64, os-linux, JitStress, area-CodeGen-coreclr
Milestone:	7.0.0

[BruceForstall]

Also failed, win-arm64, jitstress=1:

https://dev.azure.com/dnceng/public/_build/results?buildId=1825729&view=ms.vss-test-web.build-test-results-tab&runId=48389188&resultId=197945&paneView=debug
https://helixre107v0xdeko0k025g8.blob.core.windows.net/dotnet-runtime-refs-heads-main-03f1b1291ff3489a86/System.Resources.Extensions.Tests/1/console.64d2804c.log?helixlogtype=result

[jakobbotsch]

Presumably from #70521, cc @SingleAccretion

[SingleAccretion]

Indeed looks related; I am taking a look already.

[SingleAccretion]

So, as suspected, the assert has been surfaced by #70521, however, the cause has been there for a long time.

In the dump (for the failure listed in the issue) we have the following tree (reconstructed manually):

EQ
  IND
    LCL_VAR ref
  COMMA
    ASG
      LCL_VAR V39
      COMMA
        ASG
          LCL_VAR V114
          CNS_INT 0x7F28B60008 $H // Neither this node nor $H are handles
        ADD                    $H // Notice this is wrong (doesn't include the offset)
          LCL_VAR V114         $H
          CNS_INT 0xD70
    LCL_VAR V39

As can be seen, CSE created a "base" VN with its "shared const" functionality, and that base VN was incorrectly assigned to the ADD node, here:

runtime/src/coreclr/jit/optcse.cpp

Line 3266 in 4c6b53b

cseUse->gtVNPair = val->gtVNPair; // The 'cseUse' is equal to 'val'

val here was created earlier as val = m_pCompiler->gtNewIconNode(dsc->csdConstDefValue, cseLclVarTyp); and represents the "base" VN.

One thing that is not clear to me is how did the "base" VN turn out not to be a handle -- they're selected from values present in IR, it seems highly unlikely that user code could contain a non-handle value which was that close. Notably, CSE itself loses the "handle-ness" when it creates the "base" constant node, but here the source VN was not a handle.

Will continue the investigation tomorrow.

Edit: the "base" VN originated from a module ID (some VM pointer) that is not a handle.