Assertion failed 'loop->EntryEdge(0)->getSourceBlock()->KindIs(BBJ_ALWAYS)'

[BruceForstall]

System.Linq.Tests Work Item
net9.0-linux-Release-x64-CoreCLR_checked-fullpgo_random_gdv_edge-Ubuntu.2204.Amd64.Open

https://dev.azure.com/dnceng-public/public/_build/results?buildId=526820&view=ms.vss-test-web.build-test-results-tab&runId=12404218&paneView=debug

Also, net9.0-windows-Release-x64-CoreCLR_checked-jitosr_stress_random-Windows.10.Amd64.Open

DOTNET_TC_QuickJitForLoops=1
DOTNET_JitRandomGuardedDevirtualization=1
DOTNET_EnableCrashReport=1
DOTNET_TieredCompilation=1
DOTNET_JitRandomEdgeCounts=1
DOTNET_DbgMiniDumpName=/home/helixbot/dotnetbuild/dumps/coredump.%d.dmp
DOTNET_TieredPGO=1
DOTNET_DbgEnableMiniDump=1
DOTNET_JitRandomlyCollect64BitCounts=1
DOTNET_ReadyToRun=0
+ ./RunTests.sh --runtime-path /datadisks/disk1/work/9AB7088D/p
========================= Begin custom configuration settings ==============================
export __IsXUnitLogCheckerSupported=1
========================== End custom configuration settings ===============================
----- start Sun Jan 14 04:53:15 PM UTC 2024 =============== To repro directly: =====================================================
pushd .
/datadisks/disk1/work/9AB7088D/p/dotnet exec --runtimeconfig System.Linq.Tests.runtimeconfig.json --depsfile System.Linq.Tests.deps.json xunit.console.dll System.Linq.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing 
popd
===========================================================================================================
/datadisks/disk1/work/9AB7088D/w/A7A808BC/e /datadisks/disk1/work/9AB7088D/w/A7A808BC/e
  Discovering: System.Linq.Tests (method display = ClassAndMethod, method display options = None)
  Discovered:  System.Linq.Tests (found 1750 of 1754 test cases)
  Starting:    System.Linq.Tests (parallel test collections = on, max threads = 2)
    System.Linq.Tests.TakeWhileTests.IndexTakeWhileOverflowBeyondIntMaxValueElements [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.ToArrayTests.ToArray_FailOnExtremelyLargeCollection [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.SkipWhileTests.IndexSkipWhileOverflowBeyondIntMaxValueElements [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.WhereTests.IndexOverflows [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.SelectTests.Overflow [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.IndexTests.LargeEnumerable [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.IndexTests.LargeEnumerable_ThrowsOverflowException [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.SelectManyTests.IndexOverflow [SKIP]
      Condition(s) not met: "IsStressModeEnabled"

Assert failure(PID 4147 [0x00001033], Thread: 4558 [0x11ce]): Assertion failed 'loop->EntryEdge(0)->getSourceBlock()->KindIs(BBJ_ALWAYS)' in 'System.Linq.Enumerable:SumSignedIntegersVectorized[long](System.ReadOnlySpan`1[long]):long' during 'Unroll loops' (IL size 547; hash 0x004dc3a8; Tier1)

    File: /__w/1/s/src/coreclr/jit/fgdiagnostic.cpp Line: 4772
    Image: /datadisks/disk1/work/9AB7088D/p/dotnet

[createdump] Gathering state for process 4147 dotnet
[createdump] Crashing thread 11ce signal 6 (0006)
[createdump] Writing crash report to file /home/helixbot/dotnetbuild/dumps/coredump.4147.dmp.crashreport.json
[createdump] Crash report successfully written
[createdump] Writing minidump with heap to file /home/helixbot/dotnetbuild/dumps/coredump.4147.dmp
[createdump] Written 382439424 bytes (93369 pages) to core file
[createdump] Target process is alive
[createdump] Dump successfully written in 763ms
waitpid() returned successfully (wstatus 00000000) WEXITSTATUS 0 WTERMSIG 0
./RunTests.sh: line 180:  4147 Aborted                 (core dumped) "$RUNTIME_PATH/dotnet" exec --runtimeconfig System.Linq.Tests.runtimeconfig.json --depsfile System.Linq.Tests.deps.json xunit.console.dll System.Linq.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing $RSP_FILE
/datadisks/disk1/work/9AB7088D/w/A7A808BC/e
----- end Sun Jan 14 04:54:28 PM UTC 2024 ----- exit code 134 ----------------------------------------------------------

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

System.Linq.Tests Work Item
net9.0-linux-Release-x64-CoreCLR_checked-fullpgo_random_gdv_edge-Ubuntu.2204.Amd64.Open

https://dev.azure.com/dnceng-public/public/_build/results?buildId=526820&view=ms.vss-test-web.build-test-results-tab&runId=12404218&paneView=debug

Also, net9.0-windows-Release-x64-CoreCLR_checked-jitosr_stress_random-Windows.10.Amd64.Open

DOTNET_TC_QuickJitForLoops=1
DOTNET_JitRandomGuardedDevirtualization=1
DOTNET_EnableCrashReport=1
DOTNET_TieredCompilation=1
DOTNET_JitRandomEdgeCounts=1
DOTNET_DbgMiniDumpName=/home/helixbot/dotnetbuild/dumps/coredump.%d.dmp
DOTNET_TieredPGO=1
DOTNET_DbgEnableMiniDump=1
DOTNET_JitRandomlyCollect64BitCounts=1
DOTNET_ReadyToRun=0
+ ./RunTests.sh --runtime-path /datadisks/disk1/work/9AB7088D/p
========================= Begin custom configuration settings ==============================
export __IsXUnitLogCheckerSupported=1
========================== End custom configuration settings ===============================
----- start Sun Jan 14 04:53:15 PM UTC 2024 =============== To repro directly: =====================================================
pushd .
/datadisks/disk1/work/9AB7088D/p/dotnet exec --runtimeconfig System.Linq.Tests.runtimeconfig.json --depsfile System.Linq.Tests.deps.json xunit.console.dll System.Linq.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing 
popd
===========================================================================================================
/datadisks/disk1/work/9AB7088D/w/A7A808BC/e /datadisks/disk1/work/9AB7088D/w/A7A808BC/e
  Discovering: System.Linq.Tests (method display = ClassAndMethod, method display options = None)
  Discovered:  System.Linq.Tests (found 1750 of 1754 test cases)
  Starting:    System.Linq.Tests (parallel test collections = on, max threads = 2)
    System.Linq.Tests.TakeWhileTests.IndexTakeWhileOverflowBeyondIntMaxValueElements [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.ToArrayTests.ToArray_FailOnExtremelyLargeCollection [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.SkipWhileTests.IndexSkipWhileOverflowBeyondIntMaxValueElements [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.WhereTests.IndexOverflows [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.SelectTests.Overflow [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.IndexTests.LargeEnumerable [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.IndexTests.LargeEnumerable_ThrowsOverflowException [SKIP]
      Condition(s) not met: "IsStressModeEnabled"
    System.Linq.Tests.SelectManyTests.IndexOverflow [SKIP]
      Condition(s) not met: "IsStressModeEnabled"

Assert failure(PID 4147 [0x00001033], Thread: 4558 [0x11ce]): Assertion failed 'loop->EntryEdge(0)->getSourceBlock()->KindIs(BBJ_ALWAYS)' in 'System.Linq.Enumerable:SumSignedIntegersVectorized[long](System.ReadOnlySpan`1[long]):long' during 'Unroll loops' (IL size 547; hash 0x004dc3a8; Tier1)

    File: /__w/1/s/src/coreclr/jit/fgdiagnostic.cpp Line: 4772
    Image: /datadisks/disk1/work/9AB7088D/p/dotnet

[createdump] Gathering state for process 4147 dotnet
[createdump] Crashing thread 11ce signal 6 (0006)
[createdump] Writing crash report to file /home/helixbot/dotnetbuild/dumps/coredump.4147.dmp.crashreport.json
[createdump] Crash report successfully written
[createdump] Writing minidump with heap to file /home/helixbot/dotnetbuild/dumps/coredump.4147.dmp
[createdump] Written 382439424 bytes (93369 pages) to core file
[createdump] Target process is alive
[createdump] Dump successfully written in 763ms
waitpid() returned successfully (wstatus 00000000) WEXITSTATUS 0 WTERMSIG 0
./RunTests.sh: line 180:  4147 Aborted                 (core dumped) "$RUNTIME_PATH/dotnet" exec --runtimeconfig System.Linq.Tests.runtimeconfig.json --depsfile System.Linq.Tests.deps.json xunit.console.dll System.Linq.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing $RSP_FILE
/datadisks/disk1/work/9AB7088D/w/A7A808BC/e
----- end Sun Jan 14 04:54:28 PM UTC 2024 ----- exit code 134 ----------------------------------------------------------

Author:	BruceForstall
Assignees:	jakobbotsch
Labels:	JitStress, area-CodeGen-coreclr, blocking-clean-ci-optional
Milestone:	9.0.0

[jakobbotsch]

The problem is the following code:

runtime/src/coreclr/jit/optimizer.cpp

Lines 3884 to 3911 in 45b56e5

	// Control will fall through from the initBlock to its successor, which is either
	// the preheader HEAD (if it exists), or the now empty TOP (if totalIter == 0),
	// or the first cloned top.
	//
	// If the initBlock is a BBJ_COND drop the condition (and make initBlock a BBJ_ALWAYS block).
	//
	// TODO: Isn't this missing validity checks? This seems dangerous.
	//
	if (initBlock->KindIs(BBJ_COND))
	{
	assert(dupCond);
	Statement* initBlockBranchStmt = initBlock->lastStmt();
	noway_assert(initBlockBranchStmt->GetRootNode()->OperIs(GT_JTRUE));
	fgRemoveStmt(initBlock, initBlockBranchStmt);
	fgRemoveRefPred(initBlock->GetTrueTarget(), initBlock);
	initBlock->SetKindAndTarget(BBJ_ALWAYS, initBlock->GetFalseTarget());
	// TODO-NoFallThrough: If bbFalseTarget can diverge from bbNext, it may not make sense to set
	// BBF_NONE_QUIRK
	initBlock->SetFlags(BBF_NONE_QUIRK);
	}
	else
	{
	// the loop must execute
	assert(!dupCond);
	assert(totalIter > 0);
	noway_assert(initBlock->KindIs(BBJ_ALWAYS));
	}

It converts a BBJ_COND to a BBJ_ALWAYS. If it removes a branch into a previously unnatural loop then that loop may now become natural without having been canonicalized.

The code is also responsible for #96591 and I have a local change that should fix both these issues by just removing the optimization (we can just let RBO handle the cases where loop inversion introduced something trivially true/false).

context.zip