DEREF_OF_NULL in /src/coreclr/jit/lsrabuild.cpp

[ellena13]

Pointer GenTree::gtGetOp1(...), that can have only NULL value, is passed as 1st parameter in call to function LinearScan::BuildUse

runtime/src/coreclr/jit/lsraxarch.cpp

Lines 211 to 216 in e40b3ab

	if (tree->TypeGet() != TYP_VOID && tree->gtGetOp1() == nullptr)
	{
	assert(dstCount == 1);
	BuildUse(tree->gtGetOp1());
	BuildDef(tree);
	}

where it is dereferenced at

runtime/src/coreclr/jit/lsrabuild.cpp

Lines 2929 to 2930 in e40b3ab

	RefPosition* LinearScan::BuildUse(GenTree* operand, regMaskTP candidates, int multiRegIdx)
	{

runtime/src/coreclr/jit/lsrabuild.cpp

Lines 2964 to 2967 in e40b3ab

	if (operand->AsLclVar()->IsLastUse(multiRegIdx))
	{
	VarSetOps::RemoveElemD(compiler, currentLiveVars, fieldVarDsc->lvVarIndex);
	}

Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.

Author E. Bykhanova.

[ghost]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

Pointer GenTree::gtGetOp1(...), that can have only NULL value, is passed as 1st parameter in call to function LinearScan::BuildUse

runtime/src/coreclr/jit/lsraxarch.cpp

Lines 211 to 214 in e40b3ab

	if (tree->TypeGet() != TYP_VOID && tree->gtGetOp1() == nullptr)
	{
	assert(dstCount == 1);
	BuildUse(tree->gtGetOp1());

where it is dereferenced at

https://github.com/dotnet/runtime/blob/9476f404988e5f18ecdf99f19d9a4cb5a7bbb219/src/coreclr/jit/lsrabuild.cpp#L3202C1-L3204C1

https://github.com/dotnet/runtime/blob/9476f404988e5f18ecdf99f19d9a4cb5a7bbb219/src/coreclr/jit/lsrabuild.cpp#L3238C9-L3241C10

Found by Linux Verification Center (portal.linuxtesting.ru) with SVACE.

Author E. Bykhanova.

Reproduction Steps

.

Expected behavior

.

Actual behavior

.

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response

Author:	ellena13
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[jakobbotsch]

Looks like dead code, we don't have those kind of passthrough GT_NOP nodes in LIR.