JIT.Regression\JitBlue\Runtime_31615\Runtime_31615\Runtime_31615 fails

[EgorBo]

      > C:\h\w\A3A508C1\w\B8E60A0B\e\JIT\Regression\JitBlue\Runtime_31615\Runtime_31615\Runtime_31615.cmd
      Expected: True
      Actual:   False
      Stack Trace:
           at JIT_Regression._JitBlue_Runtime_31615_Runtime_31615_Runtime_31615_._JitBlue_Runtime_31615_Runtime_31615_Runtime_31615_cmd()
           at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
           at System.Reflection.MethodInvoker.Invoke(Object obj, IntPtr* args, BindingFlags invokeAttr)
      Output:
        
        Return code:      1

Failed in many PRs

[ghost]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

      > C:\h\w\A3A508C1\w\B8E60A0B\e\JIT\Regression\JitBlue\Runtime_31615\Runtime_31615\Runtime_31615.cmd
      Expected: True
      Actual:   False
      Stack Trace:
           at JIT_Regression._JitBlue_Runtime_31615_Runtime_31615_Runtime_31615_._JitBlue_Runtime_31615_Runtime_31615_Runtime_31615_cmd()
           at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
           at System.Reflection.MethodInvoker.Invoke(Object obj, IntPtr* args, BindingFlags invokeAttr)
      Output:
        
        Return code:      1

Failed in many PRs

Author:	EgorBo
Assignees:	-
Labels:	area-CodeGen-coreclr
Milestone:	-

[BruceForstall]

Looks like failures are all Windows x86 R2R

[BruceForstall]

First failure was https://dev.azure.com/dnceng-public/public/_build/results?buildId=93803&view=results (runtime-coreclr outerloop build 20221125.2)

[BruceForstall]

Maybe due to #76491?

cc @SingleAccretion @dotnet/jit-contrib

[SingleAccretion]

I will take a look tomorrow.

[BruceForstall]

If I run the test using set RunCrossGen2=1 but without crossgen-ing the framework, I get:

BEGIN EXECUTION
 "C:\gh\runtime3\artifacts\tests\coreclr\windows.x86.Checked\Tests\Core_Root\corerun.exe" -p "System.Reflection.Metadata.MetadataUpdater.IsSupported=false"  Runtime_31615.dll
Check at line 235 failed; have (1.0842106E-19,-1.0842106E-19,-1.5845755E+29,1.0842106E-19); expected (10,20,30,40)
Check at line 246 failed; have (-1.0842106E-19,1.0842106E-19,1.0842106E-19,-1.5845755E+29); expected (20,10,40,30)
Check at line 313 failed; have (1.0842106E-19,-1.0842106E-19,-1.5845755E+29,1.0842106E-19); expected (10,20,30,40)
Failed; 3 errors in 20 tests
Expected: 100
Actual: -1
END EXECUTION - FAILED
FAILED

(this is the actual failure, not the "Actual: False")

[BruceForstall]

Note: test has been disabled and must be re-enabled when this is fixed.

[SingleAccretion]

I investigated this a bit.

#76491 (I assume) exposed a bug that manifests as us getting the address for insertps data wrong, they are one byte before (or 15 bytes after?) from where they should be:

[MethodImpl(MethodImplOptions.NoInlining)]
private static Vector4 Problem()
{
    Vector4 r = new Vector4();
    r.X = 10f;
    r.Y = 20f;
    r.Z = 30f;
    r.W = 40f;
    return r;
}

--- C:\Users\Accretion\source\dotnet\RyuJit\RyuJitReproduction\Program.cs ------
            Vector4 r = new Vector4();
5B7018A0  int         3  
5B7018A1  ?? ?????? 
            Vector4 r = new Vector4();
5B7018A2  cmp         ah,byte ptr [ecx]  
5B7018A4  add         eax,offset RyuJitReproduction.Program.Problem()+0458Fh (5B705E2Fh)  
5B7018A9  push        cs  
            r.Y = 20f;
5B7018AA  insertps    xmm0,dword ptr [RyuJitReproduction.Program.Problem()+0459Fh (5B705E3Fh)],10h
            r.Z = 30f;                                                            ; Notice the misaligned address
5B7018B4  insertps    xmm0,dword ptr [RyuJitReproduction.Program.Problem()+045AFh (5B705E4Fh)],20h  
            r.W = 40f;                                                            ; Notice the misaligned address
5B7018BE  insertps    xmm0,dword ptr [RyuJitReproduction.Program.Problem()+045BFh (5B705E5Fh)],30h  
            return r;                                                             ; Notice the misaligned address
5B7018C8  movups      xmmword ptr [ecx],xmm0  

Notable: only reproduces without VEX encoding on x86 (hence the particular nature of failures).

Not yet clear where the actual bug is or how the fix looks like.