Test failure JIT\\opt\\OSR\\largefuncletframe\\largefuncletframe.cmd

[VincentBu]

Run: runtime-coreclr jitstress 20220412.1

Failed test:

coreclr windows arm64 Checked zapdisable @ Windows.10.Arm64v8.Open

- JIT\\opt\\OSR\\largefuncletframe\\largefuncletframe.cmd

coreclr windows arm64 Checked jitstress2_tiered @ Windows.10.Arm64v8.Open

- JIT\\Performance\\CodeQuality\\Bytemark\\Bytemark\\Bytemark.cmd
- JIT\\Methodical\\eh\\finallyexec\\nonlocalexittobeginningoftry_ro\\nonlocalexittobeginningoftry_ro.cmd
- JIT\\Methodical\\flowgraph\\dev10_bug679008\\GCOverReporting\\GCOverReporting.cmd
- JIT\\superpmi\\superpmicollect\\Bytemark\\Bytemark.cmd
- JIT\\Regression\\CLR-x86-JIT\\v2.1\\b609988\\Desktop\\b609988\\b609988.cmd
- JIT\\Regression\\CLR-x86-JIT\\V1-M12-Beta2\\b73921\\b73921\\b73921.cmd
- JIT\\Directed\\UnrollLoop\\loop6_cs_do\\loop6_cs_do.cmd
- JIT\\Methodical\\eh\\finallyexec\\nonlocalexittobeginningoftry_do\\nonlocalexittobeginningoftry_do.cmd
- JIT\\Regression\\JitBlue\\Runtime_54118\\Runtime_54118\\Runtime_54118.cmd
- JIT\\HardwareIntrinsics\\Arm\\AdvSimd\\AdvSimd_Part10_ro\\AdvSimd_Part10_ro.cmd
- managed\\Compilation\\Compilation\\Compilation.cmd
- JIT\\Performance\\CodeQuality\\Roslyn\\CscBench\\CscBench.cmd
- JIT\\HardwareIntrinsics\\General\\Vector128\\Vector128_r\\Vector128_r.cmd
- JIT\\HardwareIntrinsics\\General\\Vector128\\Vector128_ro\\Vector128_ro.cmd
- JIT\\jit64\\opt\\lur\\lur_02\\lur_02.cmd
- JIT\\Regression\\JitBlue\\Runtime_33972\\Runtime_33972\\Runtime_33972.cmd
- JIT\\HardwareIntrinsics\\Arm\\AdvSimd.Arm64\\AdvSimd.Arm64_Part4_ro\\AdvSimd.Arm64_Part4_ro.cmd
- JIT\\Regression\\JitBlue\\Runtime_40607\\Runtime_40607\\Runtime_40607.cmd

coreclr windows x64 Checked jitstress2 @ Windows.10.Amd64.Open

- JIT\\opt\\OSR\\osrcontainstry\\osrcontainstry.cmd

coreclr windows arm64 Checked jitstress1 @ Windows.10.Arm64v8.Open

- JIT\\opt\\OSR\\osrcontainstry\\osrcontainstry.cmd

coreclr Linux x64 Checked jitstress2 @ Ubuntu.1804.Amd64.Open

- JIT/opt/OSR/osrcontainstry/osrcontainstry.sh

coreclr Linux x64 Checked jitstress1_tiered @ Ubuntu.1804.Amd64.Open

- JIT/superpmi/superpmicollect/Bytemark/Bytemark.sh
- JIT/Performance/CodeQuality/Bytemark/Bytemark/Bytemark.sh
- JIT/HardwareIntrinsics/General/Vector256/Vector256_r/Vector256_r.sh
- JIT/HardwareIntrinsics/General/Vector256/Vector256_ro/Vector256_ro.sh
- JIT/HardwareIntrinsics/General/Vector128/Vector128_r/Vector128_r.sh

coreclr windows x64 Checked jitstress1_tiered @ Windows.10.Amd64.Open

- JIT\\HardwareIntrinsics\\General\\Vector256\\Vector256_r\\Vector256_r.cmd
- JIT\\superpmi\\superpmicollect\\Bytemark\\Bytemark.cmd
- JIT\\Performance\\CodeQuality\\Bytemark\\Bytemark\\Bytemark.cmd
- JIT\\HardwareIntrinsics\\General\\Vector128\\Vector128_r\\Vector128_r.cmd
- JIT\\HardwareIntrinsics\\General\\Vector128\\Vector128_ro\\Vector128_ro.cmd
- JIT\\HardwareIntrinsics\\General\\Vector256\\Vector256_ro\\Vector256_ro.cmd
- JIT\\Regression\\JitBlue\\GitHub_18522\\GitHub_18522_8\\GitHub_18522_8.cmd
- JIT\\jit64\\opt\\lur\\lur_02\\lur_02.cmd

coreclr OSX arm64 Checked jitstress1 @ OSX.1200.ARM64.Open

- JIT/opt/OSR/osrcontainstry/osrcontainstry.sh

coreclr OSX x64 Checked jitstress1 @ OSX.1200.Amd64.Open

- JIT/opt/OSR/osrcontainstry/osrcontainstry.sh

coreclr OSX x64 Checked jitstress1_tiered @ OSX.1200.Amd64.Open

- JIT/superpmi/superpmicollect/Bytemark/Bytemark.sh
- JIT/Directed/UnrollLoop/loop6_cs_ro/loop6_cs_ro.sh
- JIT/Methodical/eh/leaves/tryfinallyloop_do/tryfinallyloop_do.sh
- JIT/Regression/CLR-x86-JIT/V1-M12-Beta2/b55875/b55875/b55875.sh
- JIT/Directed/UnrollLoop/loop6_cs_do/loop6_cs_do.sh
- JIT/jit64/opt/lim/lim_002/lim_002.sh

coreclr OSX arm64 Checked zapdisable @ OSX.1200.ARM64.Open

- JIT/opt/OSR/largefuncletframe/largefuncletframe.sh

One of error message:

Assert failure(PID 1164 [0x0000048c], Thread: 13236 [0x33b4]): Assertion failed 'shadowNum >= info.compLocalsCount' in 'System.Diagnostics.Debug:Assert(bool)' during 'Post-Emit' (IL size 17; hash 0xd9bbd812; Tier0)

File: D:\a\_work\1\s\src\coreclr\jit\compiler.cpp Line: 5289
Image: D:\h\w\A6350938\p\corerun.exe
Return code:      1
Raw output file:      D:\h\w\A6350938\w\A2E9095D\uploads\Reports\JIT.opt\OSR\largefuncletframe\largefuncletframe.output.txt
Raw output:
BEGIN EXECUTION
"D:\h\w\A6350938\p\corerun.exe" -p "System.Reflection.Metadata.MetadataUpdater.IsSupported=false"  largefuncletframe.dll
Expected: 100
Actual: -1073740286
END EXECUTION - FAILED
FAILED
Test Harness Exitcode is : 1
To run the test:

set CORE_ROOT=D:\h\w\A6350938\p
D:\h\w\A6350938\w\A2E9095D\e\JIT\opt\OSR\largefuncletframe\largefuncletframe.cmd
Expected: True
Actual:   False


Stack trace
   at JIT_opt._OSR_largefuncletframe_largefuncletframe_._OSR_largefuncletframe_largefuncletframe_cmd()

Tagging subscribers to this area: @JulieLeeMSFT
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Run: runtime-coreclr jitstress 20220412.1

Failed test:

coreclr windows arm64 Checked zapdisable @ Windows.10.Arm64v8.Open

- JIT\\opt\\OSR\\largefuncletframe\\largefuncletframe.cmd

coreclr windows arm64 Checked jitstress2_tiered @ Windows.10.Arm64v8.Open

- JIT\\Performance\\CodeQuality\\Bytemark\\Bytemark\\Bytemark.cmd
- JIT\\Methodical\\eh\\finallyexec\\nonlocalexittobeginningoftry_ro\\nonlocalexittobeginningoftry_ro.cmd
- JIT\\Methodical\\flowgraph\\dev10_bug679008\\GCOverReporting\\GCOverReporting.cmd
- JIT\\superpmi\\superpmicollect\\Bytemark\\Bytemark.cmd
- JIT\\Regression\\CLR-x86-JIT\\v2.1\\b609988\\Desktop\\b609988\\b609988.cmd
- JIT\\Regression\\CLR-x86-JIT\\V1-M12-Beta2\\b73921\\b73921\\b73921.cmd
- JIT\\Directed\\UnrollLoop\\loop6_cs_do\\loop6_cs_do.cmd
- JIT\\Methodical\\eh\\finallyexec\\nonlocalexittobeginningoftry_do\\nonlocalexittobeginningoftry_do.cmd
- JIT\\Regression\\JitBlue\\Runtime_54118\\Runtime_54118\\Runtime_54118.cmd
- JIT\\HardwareIntrinsics\\Arm\\AdvSimd\\AdvSimd_Part10_ro\\AdvSimd_Part10_ro.cmd
- managed\\Compilation\\Compilation\\Compilation.cmd
- JIT\\Performance\\CodeQuality\\Roslyn\\CscBench\\CscBench.cmd
- JIT\\HardwareIntrinsics\\General\\Vector128\\Vector128_r\\Vector128_r.cmd
- JIT\\HardwareIntrinsics\\General\\Vector128\\Vector128_ro\\Vector128_ro.cmd
- JIT\\jit64\\opt\\lur\\lur_02\\lur_02.cmd
- JIT\\Regression\\JitBlue\\Runtime_33972\\Runtime_33972\\Runtime_33972.cmd
- JIT\\HardwareIntrinsics\\Arm\\AdvSimd.Arm64\\AdvSimd.Arm64_Part4_ro\\AdvSimd.Arm64_Part4_ro.cmd
- JIT\\Regression\\JitBlue\\Runtime_40607\\Runtime_40607\\Runtime_40607.cmd

coreclr windows x64 Checked jitstress2 @ Windows.10.Amd64.Open

- JIT\\opt\\OSR\\osrcontainstry\\osrcontainstry.cmd

coreclr windows arm64 Checked jitstress1 @ Windows.10.Arm64v8.Open

- JIT\\opt\\OSR\\osrcontainstry\\osrcontainstry.cmd

coreclr Linux x64 Checked jitstress2 @ Ubuntu.1804.Amd64.Open

- JIT/opt/OSR/osrcontainstry/osrcontainstry.sh

coreclr Linux x64 Checked jitstress1_tiered @ Ubuntu.1804.Amd64.Open

- JIT/superpmi/superpmicollect/Bytemark/Bytemark.sh
- JIT/Performance/CodeQuality/Bytemark/Bytemark/Bytemark.sh
- JIT/HardwareIntrinsics/General/Vector256/Vector256_r/Vector256_r.sh
- JIT/HardwareIntrinsics/General/Vector256/Vector256_ro/Vector256_ro.sh
- JIT/HardwareIntrinsics/General/Vector128/Vector128_r/Vector128_r.sh

coreclr windows x64 Checked jitstress1_tiered @ Windows.10.Amd64.Open

- JIT\\HardwareIntrinsics\\General\\Vector256\\Vector256_r\\Vector256_r.cmd
- JIT\\superpmi\\superpmicollect\\Bytemark\\Bytemark.cmd
- JIT\\Performance\\CodeQuality\\Bytemark\\Bytemark\\Bytemark.cmd
- JIT\\HardwareIntrinsics\\General\\Vector128\\Vector128_r\\Vector128_r.cmd
- JIT\\HardwareIntrinsics\\General\\Vector128\\Vector128_ro\\Vector128_ro.cmd
- JIT\\HardwareIntrinsics\\General\\Vector256\\Vector256_ro\\Vector256_ro.cmd
- JIT\\Regression\\JitBlue\\GitHub_18522\\GitHub_18522_8\\GitHub_18522_8.cmd
- JIT\\jit64\\opt\\lur\\lur_02\\lur_02.cmd

coreclr OSX arm64 Checked jitstress1 @ OSX.1200.ARM64.Open

- JIT/opt/OSR/osrcontainstry/osrcontainstry.sh

coreclr OSX x64 Checked jitstress1 @ OSX.1200.Amd64.Open

- JIT/opt/OSR/osrcontainstry/osrcontainstry.sh

coreclr OSX x64 Checked jitstress1_tiered @ OSX.1200.Amd64.Open

- JIT/superpmi/superpmicollect/Bytemark/Bytemark.sh
- JIT/Directed/UnrollLoop/loop6_cs_ro/loop6_cs_ro.sh
- JIT/Methodical/eh/leaves/tryfinallyloop_do/tryfinallyloop_do.sh
- JIT/Regression/CLR-x86-JIT/V1-M12-Beta2/b55875/b55875/b55875.sh
- JIT/Directed/UnrollLoop/loop6_cs_do/loop6_cs_do.sh
- JIT/jit64/opt/lim/lim_002/lim_002.sh

coreclr OSX arm64 Checked zapdisable @ OSX.1200.ARM64.Open

- JIT/opt/OSR/largefuncletframe/largefuncletframe.sh

One of error message:

Assert failure(PID 1164 [0x0000048c], Thread: 13236 [0x33b4]): Assertion failed 'shadowNum >= info.compLocalsCount' in 'System.Diagnostics.Debug:Assert(bool)' during 'Post-Emit' (IL size 17; hash 0xd9bbd812; Tier0)

File: D:\a\_work\1\s\src\coreclr\jit\compiler.cpp Line: 5289
Image: D:\h\w\A6350938\p\corerun.exe
Return code:      1
Raw output file:      D:\h\w\A6350938\w\A2E9095D\uploads\Reports\JIT.opt\OSR\largefuncletframe\largefuncletframe.output.txt
Raw output:
BEGIN EXECUTION
"D:\h\w\A6350938\p\corerun.exe" -p "System.Reflection.Metadata.MetadataUpdater.IsSupported=false"  largefuncletframe.dll
Expected: 100
Actual: -1073740286
END EXECUTION - FAILED
FAILED
Test Harness Exitcode is : 1
To run the test:

set CORE_ROOT=D:\h\w\A6350938\p
D:\h\w\A6350938\w\A2E9095D\e\JIT\opt\OSR\largefuncletframe\largefuncletframe.cmd
Expected: True
Actual:   False


Stack trace
   at JIT_opt._OSR_largefuncletframe_largefuncletframe_._OSR_largefuncletframe_largefuncletframe_cmd()

Author:	VincentBu
Assignees:	-
Labels:	arch-arm64, os-linux, os-mac-os-x, os-windows, JitStress, arch-x64, area-CodeGen-coreclr, untriaged
Milestone:	-

[BruceForstall]

Due to #67884

[AndyAyersMS]

Oddly, can't repro this failure

coreclr windows x64 Checked jitstress2 @ Windows.10.Amd64.Open

- JIT\\opt\\OSR\\osrcontainstry\\osrcontainstry.cmd

as a standalone test. Going to see if it repros when batched up like CI runs it.

[AndyAyersMS]

Guessing the fix is that gsCopyShadowParams should not allocate the gsShadowVarInfo array until after it has been shown that there are indeed vulnerable params.

Otherwise the array contents are uninitialized. Odd though that we don't run into this problem already.

[AndyAyersMS]

The only other use (outside of the GS) code is in copyprop:

runtime/src/coreclr/jit/copyprop.cpp

Lines 294 to 301 in 73665cc

	// Shadowed parameters are special: they will (at most) have one use, that is one on the RHS of an
	// assignment to their shadow, and we must not substitute them anywhere. So we'll not push any defs.
	if ((gsShadowVarInfo != nullptr) && lvaGetDesc(lclNum)->lvIsParam &&
	(gsShadowVarInfo[lclNum].shadowCopy != BAD_VAR_NUM))
	{
	assert(!curSsaName->Lookup(lclNum));
	return;
	}

Seems like having an uninitalized array here might lead to spurious asserts and/or nondeterministic codegen, but we haven't seen this. But is since it is looking for BAD_VAR_NUM maybe we just get lucky, whereas with my change we are asserting on any unreasonble looking value.

At any rate, I am still trying to get a local repro....