Assertion failed 'genActualType(op1) == genActualType(op2)' in 'System.SpanTests.SpanTests:AsciiNeedle_ProperlyHandlesEdgeCases_Byte(bool)

[JulieLeeMSFT]

Pipeline: runtime-coreclr libraries-pgo / 20250607.1
Test leg: net10.0-windows-Release-x64-jitosr_stress_random-Windows.10.Amd64.Open
Work Item: System.Memory.Tests

C:\h\w\B57809F1\w\B47409B0\e>"C:\h\w\B57809F1\p\dotnet.exe" exec --runtimeconfig System.Memory.Tests.runtimeconfig.json --depsfile System.Memory.Tests.deps.json xunit.console.dll System.Memory.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing  
  Discovering: System.Memory.Tests (method display = ClassAndMethod, method display options = None)
  Discovered:  System.Memory.Tests (found 2812 of 2841 test cases)
  Starting:    System.Memory.Tests (parallel test collections = on [4 threads], stop on fail = off)

Assert failure(PID 9172 [0x000023d4], Thread: 9312 [0x2460]): Assertion failed 'genActualType(op1) == genActualType(op2)' in 'System.SpanTests.SpanTests:AsciiNeedle_ProperlyHandlesEdgeCases_Byte(bool)' during 'Morph - Global' (IL size 479; hash 0xb15a988f; Tier1-OSR)

    File: D:\a\_work\1\s\src\coreclr\jit\morph.cpp:9127
    Image: C:\h\w\B57809F1\p\dotnet.exe

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[JulieLeeMSFT]

Same assert in net10.0-windows-Release-x64-jitosr_stress_random-Windows.10.Amd64.Open > System.Text.Json.Tests Work Item

C:\h\w\B57809F1\w\A67508F0\e>"C:\h\w\B57809F1\p\dotnet.exe" exec --runtimeconfig System.Text.Json.Tests.runtimeconfig.json --depsfile System.Text.Json.Tests.deps.json xunit.console.dll System.Text.Json.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing  
  Discovering: System.Text.Json.Tests (method display = ClassAndMethod, method display options = None)
  Discovered:  System.Text.Json.Tests (found 8842 of 8909 test cases)
  Starting:    System.Text.Json.Tests (parallel test collections = on [4 threads], stop on fail = off)

Assert failure(PID 1624 [0x00000658], Thread: 2552 [0x09f8]): Assertion failed 'genActualType(op1) == genActualType(op2)' in 'System.Text.Json.Tests.Utf8JsonWriterTests:WriteStartEndWithPropertyNameObject(System.Text.Json.JsonWriterOptions):this' during 'Morph - Global' (IL size 158; hash 0xcbb7fda6; Tier1-OSR)

    File: D:\a\_work\1\s\src\coreclr\jit\morph.cpp:9127
    Image: C:\h\w\B57809F1\p\dotnet.exe

[AndyAyersMS]

During morph, we have

fgMorphTree BB201, STMT00251 (before)
               [000920] -----------                         *  JTRUE     void  
               [000919] ---------U-                         \--*  GT        int   
               [000917] -----------                            +--*  LCL_VAR   byref  V80 tmp72        
               [000915] -----------                            \--*  ADD       byref 
               [000913] -----------                               +--*  LCL_VAR   byref  V79 tmp71        
               [000914] -----------                               \--*  CNS_INT   long   8

Assertion prop in BB201:
Constant Assertion: V80 == 457237140, index = #64
               [000917] -----------                         *  CNS_INT   byref  0x2731b40e294

Assertion prop in BB201:
Constant Assertion: V79 == [000002731B40E288], index = #62
               [005516] H----------                         *  CNS_INT(h) long   0x2731b40e288 static Fseq[<unknown field>]

Folding long operator with constant nodes into a constant:
               [000915] -----------                         *  ADD       long  
               [005516] H----+-----                         +--*  CNS_INT(h) long   0x2731b40e288 static Fseq[<unknown field>]
               [000914] -----+-----                         \--*  CNS_INT   long   8
Bashed to long constant:
               [000915] -----------                         *  CNS_INT   long   0x2731b40e290 Fseq[<unknown field>, 8]

Seems like when we substitute a constant we need to match the type of the original node. Or something like that.