Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

JIT: Invalid smnegl transformation #92537

Closed
jakobbotsch opened this issue Sep 23, 2023 · 3 comments · Fixed by #93003
Closed

JIT: Invalid smnegl transformation #92537

jakobbotsch opened this issue Sep 23, 2023 · 3 comments · Fixed by #93003
Assignees
Labels
area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
Milestone

Comments

@jakobbotsch
Copy link
Member

// Generated by Fuzzlyn v1.6 on 2023-09-23 15:15:18
// Run on Arm64 Windows
// Seed: 17929576410580344290
// Reduced from 324.8 KiB to 0.4 KiB in 00:04:43
// Debug: Outputs -2472766155
// Release: Outputs 1822201141

public class C0
{
    public uint F4;
    public C0(uint f4)
    {
        F4 = f4;
    }
}

public class Program
{
    public static C0 s_8 = new C0(2472766155U);
    public static ushort[] s_39 = new ushort[]{1};
    public static void Main()
    {
        uint vr2 = s_8.F4;
        long vr0 = -(s_39[0] * (long)vr2);
        System.Console.WriteLine(vr0);
    }
}

The codegen is

G_M27646_IG03:  ;; offset=0x001C
            movz    x0, #0x1D78      // data for Program:s_8
            movk    x0, #0x7A00 LSL #16
            movk    x0, #657 LSL #32
            ldr     x1, [x0]
            ldr     w1, [x1, #0x08]
            ldr     x0, [x0, #0x08]
            ldr     w2, [x0, #0x08]
            cmp     w2, #0
            bls     G_M27646_IG06
            ldrh    w0, [x0, #0x10]
            smnegl  x0, w0, w1
            movz    x1, #0x5B90      // code for System.Console:WriteLine(long)
            movk    x1, #0x8153 LSL #16
            movk    x1, #0x7FFE LSL #32
            ldr     x1, [x1]
            blr     x1

This looks like a regression introduced by #91886, cc @c272 @kunalspathak

@ghost ghost added the untriaged New issue has not been triaged by the area owner label Sep 23, 2023
@dotnet-issue-labeler dotnet-issue-labeler bot added the area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI label Sep 23, 2023
@jakobbotsch jakobbotsch added this to the 9.0.0 milestone Sep 23, 2023
@ghost
Copy link

ghost commented Sep 23, 2023

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details
// Generated by Fuzzlyn v1.6 on 2023-09-23 15:15:18
// Run on Arm64 Windows
// Seed: 17929576410580344290
// Reduced from 324.8 KiB to 0.4 KiB in 00:04:43
// Debug: Outputs -2472766155
// Release: Outputs 1822201141

public class C0
{
    public uint F4;
    public C0(uint f4)
    {
        F4 = f4;
    }
}

public class Program
{
    public static C0 s_8 = new C0(2472766155U);
    public static ushort[] s_39 = new ushort[]{1};
    public static void Main()
    {
        uint vr2 = s_8.F4;
        long vr0 = -(s_39[0] * (long)vr2);
        System.Console.WriteLine(vr0);
    }
}

The codegen is

G_M27646_IG03:  ;; offset=0x001C
            movz    x0, #0x1D78      // data for Program:s_8
            movk    x0, #0x7A00 LSL #16
            movk    x0, #657 LSL #32
            ldr     x1, [x0]
            ldr     w1, [x1, #0x08]
            ldr     x0, [x0, #0x08]
            ldr     w2, [x0, #0x08]
            cmp     w2, #0
            bls     G_M27646_IG06
            ldrh    w0, [x0, #0x10]
            smnegl  x0, w0, w1
            movz    x1, #0x5B90      // code for System.Console:WriteLine(long)
            movk    x1, #0x8153 LSL #16
            movk    x1, #0x7FFE LSL #32
            ldr     x1, [x1]
            blr     x1

This looks like a regression introduced by #91886, cc @c272 @kunalspathak

Author: jakobbotsch
Assignees: -
Labels:

area-CodeGen-coreclr, untriaged

Milestone: -

@ghost ghost removed the untriaged New issue has not been triaged by the area owner label Sep 23, 2023
@jakobbotsch
Copy link
Member Author

@c272 @kunalspathak Can you please take a look at this? We hit tons of bad code gen problems in the fuzzers because of this issue.

@kunalspathak
Copy link
Member

Will take a look.

jakobbotsch added a commit to jakobbotsch/runtime that referenced this issue Oct 4, 2023
The newly introduced TryLowerNegToMulLongOp would always lower to a
signed multiplication, even for unsigned multiplications.

Also apply a couple of other fixes to the transformation:
* Replace uses of GenTree::ReplaceWith with LIR::Use::ReplaceWith
* Add some necessary interference checks

Fix dotnet#92537
@jakobbotsch jakobbotsch self-assigned this Oct 4, 2023
@ghost ghost added the in-pr There is an active PR which will close this issue when it is merged label Oct 4, 2023
kunalspathak pushed a commit that referenced this issue Oct 5, 2023
* JIT: Fix invalid smnegl transformation

The newly introduced TryLowerNegToMulLongOp would always lower to a
signed multiplication, even for unsigned multiplications.

Also apply a couple of other fixes to the transformation:
* Replace uses of GenTree::ReplaceWith with LIR::Use::ReplaceWith
* Add some necessary interference checks

Fix #92537

* Add test
@ghost ghost removed the in-pr There is an active PR which will close this issue when it is merged label Oct 5, 2023
@ghost ghost locked as resolved and limited conversation to collaborators Nov 5, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants