[Fuzzlyn] Failure for another complex expression

[tannergooding]

This is new to .NET 8 and repros in Preview 3

// Generated by Fuzzlyn v1.5 on 2023-05-01 18:27:03
// Run on X64 Windows
// Seed: 13596672517773814950
// Reduced from 193.8 KiB to 1.2 KiB in 00:03:38
// Debug: Outputs 0
// Release: Outputs 255
public struct S0
{
    public byte F3;
    public uint F4;
    public long F5;
    public byte F6;
    public uint F7;
}

public struct S1
{
    public S0 F2;
}

public class Program
{
    public static IRuntime s_rt;
    public static ushort s_1;
    public static S1 s_2;
    public static S1 s_15;
    public static void Main()
    {
        s_rt = new Runtime();
        S0 vr19 = s_2.F2;
        var vr20 = new S1();
        var vr21 = s_2.F2.F4;
        var vr22 = new short[] { 0 };
        M24(vr20, vr19.F3, vr21, vr22, (sbyte)M23(vr19, 0), 1);
    }

    public static ulong M23(S0 arg1, ushort arg2)
    {
        var vr3 = arg1.F3--;
        var vr4 = arg1.F7;
        var vr6 = new short[] { 0 };
        var vr7 = (sbyte)s_1;
        Program.M24(s_15, vr3, vr4, vr6, vr7, arg2);
        return s_1;
    }

    public static void M24(S1 argThis, byte arg0, uint arg1, short[] arg2, sbyte arg3, ushort arg4)
    {
        s_rt.WriteLine(arg0);
    }
}

public interface IRuntime
{
    void WriteLine<T>(T value);
}

public class Runtime : IRuntime
{
    public void WriteLine<T>(T value) => System.Console.WriteLine(value);
}

[ghost]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

This is new to .NET 8 and repros in Preview 3

// Generated by Fuzzlyn v1.5 on 2023-05-01 18:27:03
// Run on X64 Windows
// Seed: 13596672517773814950
// Reduced from 193.8 KiB to 1.2 KiB in 00:03:38
// Debug: Outputs 0
// Release: Outputs 255
public struct S0
{
    public byte F3;
    public uint F4;
    public long F5;
    public byte F6;
    public uint F7;
}

public struct S1
{
    public S0 F2;
}

public class Program
{
    public static IRuntime s_rt;
    public static ushort s_1;
    public static S1 s_2;
    public static S1 s_15;
    public static void Main()
    {
        s_rt = new Runtime();
        S0 vr19 = s_2.F2;
        var vr20 = new S1();
        var vr21 = s_2.F2.F4;
        var vr22 = new short[] { 0 };
        M24(vr20, vr19.F3, vr21, vr22, (sbyte)M23(vr19, 0), 1);
    }

    public static ulong M23(S0 arg1, ushort arg2)
    {
        var vr3 = arg1.F3--;
        var vr4 = arg1.F7;
        var vr6 = new short[] { 0 };
        var vr7 = (sbyte)s_1;
        Program.M24(s_15, vr3, vr4, vr6, vr7, arg2);
        return s_1;
    }

    public static void M24(S1 argThis, byte arg0, uint arg1, short[] arg2, sbyte arg3, ushort arg4)
    {
        s_rt.WriteLine(arg0);
    }
}

public interface IRuntime
{
    void WriteLine<T>(T value);
}

public class Runtime : IRuntime
{
    public void WriteLine<T>(T value) => System.Console.WriteLine(value);
}

Author:	tannergooding
Assignees:	-
Labels:	bug, arch-x64, area-CodeGen-coreclr
Milestone:	-

[TIHan]

Quickly tested this, not related to cac06a5

[jakobbotsch]

Bisected to d4feb5b (cc @SingleAccretion)

Disasm diff: https://www.diffchecker.com/pHl73Xaw/

base_dump.txt
diff_dump.txt

[jakobbotsch]

Actually this looks like db717e3.

[jakobbotsch]

This is a variant on #81049, here we have call args morphing reordering a LCL_FLD on a newly address exposed local with the call that elided the copy.