[dotnet-sdk-11.0.100-preview.7.26366.102] paintnetcore crashed when doing "Move Selected Pixels" with error: System.NullReferenceException: Object reference not set to an instance of an object.

[Junjun-zhao]

Description

When launching paintnetcore and doing the 'Move Selected Pixels' operation on latest build dotnet-sdk-11.0.100-preview.7.26366.102, it crashed with error: System.NullReferenceException: Object reference not set to an instance of an object.

Reproduction Steps

Machine with dotnet-sdk-11.0.100-preview.7.26366.102 installed only and set environment variable “DOTNET_ROLL_FORWARD_ON_NO_CANDIDATE_FX” to 2.

1. Launch "paint.net\paintdotnet.exe".
2. Click "Tool".
3. Click "Move Selected Pixels".
4. Click on the blank area of the Canvas.

Expected behavior

The app still works well.

Actual behavior

App crashed with error:

Exception:
System.AggregateException: One or more errors occurred.
 ---> PaintDotNet.Threading.WorkItemException: An exception went unhandled while executing a work item
 ---> System.NullReferenceException: Object reference not set to an instance of an object.
   at PaintDotNet.Tools.Move.MoveToolLayerOverlay.OnCopyPixelsImplT[TBaseContent,TBaseContentLoader,TBaseMask,TBaseMaskLoader,TSourceTxContent,TSourceTxContentLoader,TSourceTxMask,TSourceTxMaskLoader,TFinalMask,TFinalMaskLoader](RegionPtr`1 outputRegion, RegionPtr`1 baseContentRegion, RegionPtr`1 baseMaskRegion, RegionPtr`1 sourceTxContentRegion, RegionPtr`1 sourceTxMaskRegion, RegionPtr`1 finalMaskRegion) in C:\source\paint.net\PaintDotNet\Tools\Move\MoveToolLayerOverlay.cs:line 335……

Regression?

Yes

Verify Scenarios:
1). Windows 11 24H2 AMD64 + dotnet-sdk-11.0.100-preview.7.26363.123: Pass
2). Windows 11 24H2 AMD64 + dotnet-sdk-11.0.100-preview.7.26366.102: Fail

Known Workarounds

No response

Configuration

Application Name: paintnetcore
OS: Windows 11 24H2
CPU: X64
.NET Build Number: dotnet-sdk-11.0.100-preview.7.26366.102
App & Source checking at: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/3035121

Other information

dotnet --info

.NET SDK:
 Version:           11.0.100-preview.7.26366.102
 Commit:            d2b524965e
 Workload version:  11.0.100-manifests.a03339c4
 MSBuild version:   18.10.0-1.26366.102+d2b524965

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.26100
 OS Platform: Windows
 RID:         win-x64
 Base Path:   C:\Program Files\dotnet\sdk\11.0.100-preview.7.26366.102\

.NET workloads installed:
There are no installed workloads to display.
Configured to use workload sets when installing new manifests.
No workload sets are installed. Run "dotnet workload restore" to install a workload set.

Host:
  Version:      11.0.0-preview.7.26366.102
  Architecture: x64
  Commit:       d2b524965e

.NET SDKs installed:
  11.0.100-preview.7.26366.102 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 11.0.0-preview.7.26366.102 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 11.0.0-preview.7.26366.102 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 11.0.0-preview.7.26366.102 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

@dotnet-actwx-bot @dotnet/compat

[dotnet-policy-service]

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

[hez2010]

Tried investigating the issue with codex and it yielded the below result.

Root cause: PR #130444, specifically ContainHWIntrinsicOperand.

Lowering removes a contained Vector128.CreateScalar[Unsafe] wrapper. Codegen then incorrectly uses the rewritten scalar operand type to distinguish vector and pointer overloads of Sse41/Avx2.ConvertToVector*Int*. It selects the pointer path and treats the scalar value as an address—producing loads from [0x0000] instead of [rbp]/[rsi], causing the Paint.NET NRE.

The fix is to use node->OperIsMemoryLoad()—the preserved overload metadata—instead of testing whether the rewritten operand is SIMD.

In hwintrinsiccodegenxarch.cpp:2765:

- if (!varTypeIsSIMD(op1->TypeGet()))
+ if (node->OperIsMemoryLoad())

and in the AVX2 equivalent at hwintrinsiccodegenxarch.cpp:2968:

- if (!varTypeIsSIMD(op1->gtType))
+ if (node->OperIsMemoryLoad())

---

Why the old condition fails:

Before lowering:
ConvertToVector...(CreateScalarUnsafe(load))
                   ^ SIMD-typed operand

After wrapper removal:
ConvertToVector...(load)
                   ^ scalar-typed operand

The call is still the vector overload, but after lowering its operand is scalar-typed. Therefore:

!varTypeIsSIMD(op1->TypeGet())

becomes true and codegen enters the pointer-overload branch:

GenTreeIndir load = indirForm(targetType, op1);
emit->emitInsLoadInd(..., &load);

That treats the loaded scalar value as an address, effectively introducing an extra indirection. In the Paint.NET repro this generated [0x0000] instead of reading directly from [rbp] or [rsi].

cc: @tannergooding

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[Junjun-zhao]

We have verified this issue, and it has been fixed on dotnet-sdk-11.0.100-preview.7.26378.106.Thanks