JIT: gcstress failure in BMI1 test x64 minopts

[AndyAyersMS]

Suspect this is likely a test bug, as the test is new....

To repro: build x64 checked, build tests\src\jit\HardwareIntrinsics\X86\bmi1\Bmi1_r.csproj

complus_gcstress=C
complus_heapverify=1
complus_jitminopts=1

D:\repos\coreclr2\bin\tests\Windows_NT.x64.Checked\Tests\Core_Root\corerun.exe D:\repos\coreclr\bin\tests\Windows_NT.x64.Release\jit\HardwareIntrinsics\X86\bmi1\Bmi1_r\Bmi1_r.exe
Beginning test case AndNot.UInt32 at 7/25/2018 11:58:26 AM
Random seed: 20010415; set environment variable CORECLR_SEED to this value to repro


Ending test case at 7/25/2018 11:58:30 AM
Beginning test case AndNot.UInt64 at 7/25/2018 11:58:30 AM
Random seed: 20010415; set environment variable CORECLR_SEED to this value to repro


Ending test case at 7/25/2018 11:58:30 AM
Beginning test case ExtractLowestSetBit.UInt32 at 7/25/2018 11:58:30 AM
Random seed: 20010415; set environment variable CORECLR_SEED to this value to repro


Assert failure(PID 7416 [0x00001cf8], Thread: 21256 [0x5308]): !CREATE_CHECK_STRING(!"Detected use of a corrupted OBJECTREF. Possible GC hole.")

CORECLR! `Object::ValidateInner'::`1'::catch$12 + 0x13E (0x00007ff9`002e2a74)
CORECLR! CallSettingFrame + 0x20 (0x00007ff9`001d2390)
CORECLR! _FrameHandler3::CxxCallCatchBlock + 0x15A (0x00007ff9`001d0b3a)
NTDLL! RtlCaptureContext + 0x3E3 (0x00007ff9`4ae343f3)
CORECLR! Object::ValidateInner + 0x73 (0x00007ff8`ff8f41a3)
CORECLR! Object::Validate + 0x143 (0x00007ff8`ff8f4013)
CORECLR! GcInfoDecoder::ReportRegisterToGC + 0x123 (0x00007ff8`fffbdc03)
CORECLR! GcInfoDecoder::ReportSlotToGC + 0xCD (0x00007ff8`fffbde41)
CORECLR! GcInfoDecoder::EnumerateLiveSlots + 0xCBE (0x00007ff8`fffbd056)
CORECLR! EECodeManager::EnumGcRefs + 0x3A3 (0x00007ff8`ffcabc63)
    File: d:\repos\coreclr2\src\vm\object.cpp Line: 806
    Image: D:\repos\coreclr2\bin\tests\Windows_NT.x64.Checked\Tests\Core_Root\CoreRun.exe

cc @dotnet/jit-contrib @tannergooding

[BruceForstall]

Dup of https://github.com/dotnet/coreclr/issues/18997, https://github.com/dotnet/coreclr/issues/19008

[tannergooding]

I'll take a closer look here and see if I can't find out what test code is causing the failure (it is probably some bug in one of the new scenarios).

[tannergooding]

Also repros in debug builds with just complus_gcstress=C, as a simpler repro.

[tannergooding]

Looks like this might be an actual bug, given that the minimal repro is:

public static partial class Program
{
    private static void Main(string[] args)
    {
        var test = new TestClass();
        test.RunClassFldScenario();
    }
}

public sealed unsafe class TestClass
{
    private uint _fld;

    public void RunClassFldScenario()
    {
        _fld = 1;
        Bmi1.ExtractLowestSetBit(_fld);
    }
}

[tannergooding]

JitDmp.txt

[AndyAyersMS]

So I take it vblsi eax, dword ptr [rax+8] writes to eax ?

For some reason the GC tracker doesn't see this and thinks rax still holds a GC ref.

[tannergooding]

Yes, Extract lowest set bit from r/m64, and set that bit in r64

[tannergooding]

I think I see the problem, INS_blsi (and a few others that write to integer registers) aren't included in: emitInsCanOnlyWriteSSE2OrAVXReg. So emitGCregDeadUpd doesn't get called at the end of emitOutputAM.

[tannergooding]

I'll have an update out sometime later tonight after I finish validating the fix (and checking for other new instructions that would hit this)

[tannergooding]

See dotnet/coreclr#19141