Assertion failed 'op1 != nullptr' in 'TestUtil.TestLog:VerifyOutput():int:this' during 'Morph - Global' (IL size 130)

[MichalStrehovsky]

This is a new failure that started showing up in the Pri-0 test suite.

>	clrjitilc.dll!Compiler::optNonNullAssertionProp_Call(unsigned __int64 * const & assertions, GenTreeCall * call) Line 3838	C++
 	clrjitilc.dll!Compiler::optAssertionProp_Call(unsigned __int64 * const & assertions, GenTreeCall * call, Statement * stmt) Line 3881	C++
 	clrjitilc.dll!Compiler::optAssertionProp(unsigned __int64 * const & assertions, GenTree * tree, Statement * stmt, BasicBlock * block) Line 4161	C++
 	clrjitilc.dll!Compiler::fgMorphTree(GenTree * tree, Compiler::MorphAddrContext * mac) Line 15507	C++
 	clrjitilc.dll!Compiler::fgMorphCast(GenTree * tree) Line 519	C++
 	clrjitilc.dll!Compiler::fgMorphSmpOp(GenTree * tree, Compiler::MorphAddrContext * mac) Line 11810	C++
 	clrjitilc.dll!Compiler::fgMorphTree(GenTree * tree, Compiler::MorphAddrContext * mac) Line 15544	C++
 	clrjitilc.dll!Compiler::fgMorphSmpOp(GenTree * tree, Compiler::MorphAddrContext * mac) Line 12465	C++
 	clrjitilc.dll!Compiler::fgMorphTree(GenTree * tree, Compiler::MorphAddrContext * mac) Line 15544	C++
 	clrjitilc.dll!Compiler::fgMorphSmpOp(GenTree * tree, Compiler::MorphAddrContext * mac) Line 12465	C++
 	clrjitilc.dll!Compiler::fgMorphTree(GenTree * tree, Compiler::MorphAddrContext * mac) Line 15544	C++
 	clrjitilc.dll!Compiler::fgMorphStmts(BasicBlock * block, bool * lnot, bool * loadw) Line 16430	C++
 	clrjitilc.dll!Compiler::fgMorphBlocks() Line 16673	C++

We're hitting this for code in the shape of:

if (String.Empty.Equals(diff))

The problem is that String.Empty field is an intrinsic, so we import it specially (as a literal string), and there's super special handling for CoreRT because empty string can be referred to as IAT_VALUE (no need for an indirection like on CoreCLR):

runtimelab/src/coreclr/src/jit/gentree.cpp

Lines 6072 to 6086 in ca9bccd

	case IAT_VALUE:
	// For CoreRT only - Constant object can be a frozen string.
	if (!IsTargetAbi(CORINFO_CORERT_ABI))
	{
	// Non CoreRT - This case is illegal, creating a TYP_REF from an INT_CNS
	noway_assert(!"unreachable IAT_VALUE case in gtNewStringLiteralNode");
	}
	tree = gtNewIconEmbHndNode(pValue, nullptr, GTF_ICON_STR_HDL, nullptr);
	tree->gtType = TYP_REF;
	#ifdef DEBUG
	tree->AsIntCon()->gtTargetHandle = (size_t)pValue;
	#endif
	tree = gtNewOperNode(GT_NOP, TYP_REF, tree); // prevents constant folding
	break;

Note we're wrapping the literal in a GT_NOP to prevent constant folding.

We then hit the GT_NOP handling here (because this argument to the Equals method call is the GT_NOP):

runtimelab/src/coreclr/src/jit/gentree.cpp

Lines 8546 to 8552 in dc7b1d2

	if (thisArg->OperIs(GT_NOP, GT_ASG) == false)
	{
	if ((thisArg->gtFlags & GTF_LATE_ARG) == 0)
	{
	return thisArg;
	}
	}

And end up returning null from gtGetThisArg which asserts optNonNullAssertionProp_Call.

This error mode can probably be simulated on CoreCLR by just whacking CEEJitInfo::emptyStringLiteral to return IAT_VALUE (it would generate bad code, but the assert is hit before the code finishes generating) and compiling String.Empty.Equals("some other string").

@sandreenko Would you be able to recommend the best course of action for this?

[sandreenko]

Hi @MichalStrehovsky, thank you for the analysis, looking at this now.

[sandreenko]

Could you please give me Complus_JitDump for the method with complus_JitDumpBeforeAfterMorph=1?
I was able to get such tress, but gtGetThisArg returns GT_NOP from:

runtimelab/src/coreclr/src/jit/gentree.cpp

Lines 8554 to 8558 in dc7b1d2

	if (call->gtCallLateArgs != nullptr)
	{
	unsigned argNum = 0;
	fgArgTabEntry* thisArgTabEntry = gtArgEntryByArgNum(call, argNum);
	GenTree* result = thisArgTabEntry->GetNode();

[MichalStrehovsky]

Thank you for looking into it! The gtCallLateArgs are null in my case. This is for Ngen, not sure if that matters.

Here's the ngendump with beforeaftermorph set:

ngendump.txt

There's something odd with how the trees look like: the this argument seems to be missing in the dump.

[MichalStrehovsky]

Btw if I remove the tree = gtNewOperNode(GT_NOP, TYP_REF, tree); // prevents constant folding line, the ngendump looks saner and the issue is not hit:

ngendump2.txt