Importer's spilling logic for stfld is not correct

[SingleAccretion]

Reproduction (requires InlineIL.Fody):

using InlineIL;
using System;
using System.Runtime.CompilerServices;

int b = 0;
Console.WriteLine(Problem(10, ref b));

[MethodImpl(MethodImplOptions.NoInlining)]
static int Problem(int a, ref int b)
{
    IL.Emit.Ldarga(0);
    IL.Emit.Starg(1);

    IL.Emit.Ldarg(0);
    IL.Emit.Ldarg(1);
    IL.Emit.Ldc_I4(0);
    IL.Emit.Stfld(new FieldRef(typeof(StructWithIndex), "Index"));

    return IL.Return<int>();
}

struct StructWithIndex
{
    public int Index;
}

Compile and run.

Expected result: program prints 10.

Actual result: program prints 0.

Cause: the importer sometimes only spills "value classes" (TYP_STRUCT-containing trees) here:

runtime/src/coreclr/jit/importer.cpp

Lines 16277 to 16302 in a583698

	/* stfld can interfere with value classes (consider the sequence
	ldloc, ldloca, ..., stfld, stloc). We will be conservative and
	spill all value class references from the stack. */
	if (obj && ((obj->gtType == TYP_BYREF) || (obj->gtType == TYP_I_IMPL)))
	{
	assert(tiObj);
	// If we can resolve the field to be within some local,
	// then just spill that local.
	//
	GenTreeLclVarCommon* const lcl = obj->IsLocalAddrExpr();
	if (lcl != nullptr)
	{
	impSpillLclRefs(lcl->GetLclNum());
	}
	else if (impIsValueType(tiObj))
	{
	impSpillEvalStack();
	}
	else
	{
	impSpillValueClasses();
	}
	}

[ghost]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Reproduction (requires InlineIL.Fody):

using InlineIL;
using System;
using System.Runtime.CompilerServices;

int b = 0;
Console.WriteLine(Problem(10, ref b));

[MethodImpl(MethodImplOptions.NoInlining)]
static int Problem(int a, ref int b)
{
    IL.Emit.Ldarga(0);
    IL.Emit.Starg(1);

    IL.Emit.Ldarg(0);
    IL.Emit.Ldarg(1);
    IL.Emit.Ldc_I4(0);
    IL.Emit.Stfld(new FieldRef(typeof(StructWithIndex), "Index"));

    return IL.Return<int>();
}

struct StructWithIndex
{
    public int Index;
}

Compile and run.

Expected result: program prints 10.

Actual result: program prints 0.

Cause: the importer sometimes only spills "value classes" (TYP_STRUCT-containing trees) here:

runtime/src/coreclr/jit/importer.cpp

Lines 16277 to 16302 in a583698

	/* stfld can interfere with value classes (consider the sequence
	ldloc, ldloca, ..., stfld, stloc). We will be conservative and
	spill all value class references from the stack. */
	if (obj && ((obj->gtType == TYP_BYREF) || (obj->gtType == TYP_I_IMPL)))
	{
	assert(tiObj);
	// If we can resolve the field to be within some local,
	// then just spill that local.
	//
	GenTreeLclVarCommon* const lcl = obj->IsLocalAddrExpr();
	if (lcl != nullptr)
	{
	impSpillLclRefs(lcl->GetLclNum());
	}
	else if (impIsValueType(tiObj))
	{
	impSpillEvalStack();
	}
	else
	{
	impSpillValueClasses();
	}
	}

Author:	SingleAccretion
Assignees:	-
Labels:	bug, area-CodeGen-coreclr
Milestone:	8.0.0