Assertion failed 'm_dst->TypeGet() != TYP_STRUCT' with COMPlus_JitSkipArrayBoundCheck

[kunalspathak]

Hits following assert with COMPlus_JitSkipArrayBoundCheck=1:

Assert failure(PID 11344 [0x00002c50], Thread: 35792 [0x8bd0]): Assertion failed 'm_dst->TypeGet() != TYP_STRUCT' in 'System.Reflection.PortableExecutable.PEHeaders:ReadSectionHeaders(byref):System.Collections.Immutable.ImmutableArray`1[SectionHeader]:this' during 'Morph - Global' (IL size 65)
    File: D:\git\runtime\src\coreclr\jit\morphblock.cpp Line: 256
    Image: D:\git\runtime\artifacts\tests\coreclr\windows.x64.Checked\tests\Core_Root\CoreRun.exe

Repro: https://gist.github.com/kunalspathak/c45a8eb1e10413ef7e4614d516e94fc4

Tagging subscribers to this area: @JulieLeeMSFT
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Hits following assert with COMPlus_JitSkipArrayBoundCheck=1:

Assert failure(PID 11344 [0x00002c50], Thread: 35792 [0x8bd0]): Assertion failed 'm_dst->TypeGet() != TYP_STRUCT' in 'System.Reflection.PortableExecutable.PEHeaders:ReadSectionHeaders(byref):System.Collections.Immutable.ImmutableArray`1[SectionHeader]:this' during 'Morph - Global' (IL size 65)
    File: D:\git\runtime\src\coreclr\jit\morphblock.cpp Line: 256
    Image: D:\git\runtime\artifacts\tests\coreclr\windows.x64.Checked\tests\Core_Root\CoreRun.exe

Author:	kunalspathak
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[kunalspathak]

@dotnet/jit-contrib

[jakobbotsch]

Moving this to 8.0 since it is a non-standard configuration.

[SingleAccretion]

The issue here was that INDEX morphing would produce IND struct nodes. Usually this would be ok because MorphCommaBlock would compensate here, by creating an OBJ:

runtime/src/coreclr/jit/morphblock.cpp

Lines 462 to 479 in 1bebb14

	if (blockType == TYP_STRUCT)
	{
	CORINFO_CLASS_HANDLE structHnd = comp->gtGetStructHandleIfPresent(effectiveVal);
	if (structHnd == NO_CLASS_HANDLE)
	{
	// TODO-1stClassStructs: get rid of all such cases.
	res = comp->gtNewIndir(blockType, addr);
	}
	else
	{
	res = comp->gtNewObjNode(structHnd, addr);
	comp->gtSetObjGcInfo(res->AsObj());
	}
	}
	else
	{
	res = comp->gtNewIndir(blockType, addr);
	}

However, without the bounds check, there would be no COMMAs, so MorphCommaBlock would not get called, hence the assert.

#69917 fixed this by deleting the problematic INDEX morphing.