JIT: Incorrectly optimized double-negation in face of inlining

[jakobbotsch]

Description

The following program has different behavior in debug and release mode.

Reproduction Steps

// Generated by Fuzzlyn v1.5 on 2021-11-21 16:25:19
// Run on Arm64 Linux
// Seed: 3319480715990956994
// Reduced from 26.2 KiB to 0.4 KiB in 00:00:42
// Debug: No output
// Release: Prints 0
public class Program
{
    public static bool s_3;
    public static void Main()
    {
        var vr6 = M3(s_3);
        if (M3(vr6))
        {
            System.Console.WriteLine(0);
        }
    }

    public static bool M3(bool arg0)
    {
        arg0 = !arg0;
        return arg0;
    }
}

Expected behavior

Same behavior.

Actual behavior

Different behavior.

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

Does not repro with .NET 6.

[ghost]

Tagging subscribers to this area: @JulieLeeMSFT
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

The following program has different behavior in debug and release mode on ARM64.

Reproduction Steps

// Generated by Fuzzlyn v1.5 on 2021-11-21 16:25:19
// Run on Arm64 Linux
// Seed: 3319480715990956994
// Reduced from 26.2 KiB to 0.4 KiB in 00:00:42
// Debug: No output
// Release: Prints 0
public class Program
{
    public static bool s_3;
    public static void Main()
    {
        var vr6 = M3(s_3);
        if (M3(vr6))
        {
            System.Console.WriteLine(0);
        }
    }

    public static bool M3(bool arg0)
    {
        arg0 = !arg0;
        return arg0;
    }
}

Expected behavior

Same behavior.

Actual behavior

Different behavior.

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

Does not repro on x64.

Author:	jakobbotsch
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[jakobbotsch]

cc @dotnet/jit-contrib

[jakobbotsch]

Looks like this is not ARM64 related after all, I can repro in x64 as well, but not in .NET 6. So this seems to be a recent regression.

[jakobbotsch]

This seems to be related to the new forward subst in redundant branch opts, we go from

***** BB01
STMT00006 ( 0x000[E-] ... ??? )
N003 (  4,  5) [000021] -A--G---R---              ▌  ASG       bool  
N002 (  1,  1) [000020] D------N----              ├──▌  LCL_VAR   int    V01 tmp1         d:1
N001 (  4,  5) [000000] ----G-------              └──▌  CLS_VAR   bool   Hnd=0xa5be4bc0 Fseq[s_3]

***** BB01
STMT00005 ( INL01 @ 0x000[E-] ... ??? ) <- INLRT @ 0x000[E-]
N005 (  6,  3) [000017] -A------R---              ▌  ASG       int   
N004 (  1,  1) [000016] D------N----              ├──▌  LCL_VAR   int    V01 tmp1         d:2
N003 (  6,  3) [000014] ------------              └──▌  EQ        int   
N001 (  1,  1) [000012] ------------                 ├──▌  LCL_VAR   int    V01 tmp1         u:1 (last use)
N002 (  1,  1) [000013] ------------                 └──▌  CNS_INT   int    0

***** BB01
STMT00007 ( INL02 @ 0x000[E-] ... ??? ) <- INLRT @ 0x000[E-]
N005 (  6,  3) [000029] -A------R---              ▌  ASG       int   
N004 (  1,  1) [000028] D------N----              ├──▌  LCL_VAR   int    V02 tmp2         d:1
N003 (  6,  3) [000026] ------------              └──▌  EQ        int   
N001 (  1,  1) [000024] ------------                 ├──▌  LCL_VAR   int    V01 tmp1         u:2 (last use)
N002 (  1,  1) [000025] ------------                 └──▌  CNS_INT   int    0

***** BB01
STMT00002 ( 0x000[E-] ... ??? )
N004 (  5,  5) [000008] ------------              ▌  JTRUE     void  
N003 (  3,  3) [000007] J------N----              └──▌  EQ        int   
N001 (  1,  1) [000030] ------------                 ├──▌  LCL_VAR   int    V02 tmp2         u:1 (last use)
N002 (  1,  1) [000006] ------------                 └──▌  CNS_INT   int    0

to

***** BB01
STMT00006 ( 0x000[E-] ... ??? )
N003 (  4,  5) [000021] -A--G---R---              ▌  ASG       bool   <l:$182, c:$183>
N002 (  1,  1) [000020] D------N----              ├──▌  LCL_VAR   int    V01 tmp1         d:1 <l:$182, c:$183>
N001 (  4,  5) [000000] ----G-------              └──▌  CLS_VAR   bool   Hnd=0xa5be4bc0 Fseq[s_3] <l:$180, c:$181>

***** BB01
STMT00005 ( INL01 @ 0x000[E-] ... ??? ) <- INLRT @ 0x000[E-]
N005 (  6,  3) [000017] -A------R---              ▌  ASG       int    <l:$185, c:$184>
N004 (  1,  1) [000016] D------N----              ├──▌  LCL_VAR   int    V01 tmp1         d:2 <l:$185, c:$184>
N003 (  6,  3) [000014] ------------              └──▌  EQ        int    <l:$185, c:$184>
N001 (  1,  1) [000012] ------------                 ├──▌  LCL_VAR   int    V01 tmp1         u:1 (last use) <l:$182, c:$183>
N002 (  1,  1) [000013] ------------                 └──▌  CNS_INT   int    0 $43

***** BB01
STMT00002 ( 0x000[E-] ... ??? )
N004 (  5,  5) [000008] ------------              ▌  JTRUE     void  
N003 (  6,  3) [000026] J------N----              └──▌  EQ        int    <l:$187, c:$186>
N001 (  1,  1) [000024] ------------                 ├──▌  LCL_VAR   int    V01 tmp1         u:2 (last use) <l:$185, c:$184>
N002 (  1,  1) [000025] ------------                 └──▌  CNS_INT   int    0 $43

the dump from redundant branch opts being

optRedundantRelop in BB01; jump tree is
N004 (  5,  5) [000008] ------------              ▌  JTRUE     void  
N003 (  3,  3) [000007] J------N----              └──▌  EQ        int    <l:$185, c:$184>
N001 (  1,  1) [000030] ------------                 ├──▌  LCL_VAR   int    V02 tmp2         u:1 (last use) <l:$187, c:$186>
N002 (  1,  1) [000006] ------------                 └──▌  CNS_INT   int    0 $43
 ... checking previous tree
N005 (  6,  3) [000029] -A------R---              ▌  ASG       int    <l:$187, c:$186>
N004 (  1,  1) [000028] D------N----              ├──▌  LCL_VAR   int    V02 tmp2         d:1 <l:$187, c:$186>
N003 (  6,  3) [000026] ------------              └──▌  EQ        int    <l:$187, c:$186>
N001 (  1,  1) [000024] ------------                 ├──▌  LCL_VAR   int    V01 tmp1         u:2 (last use) <l:$185, c:$184>
N002 (  1,  1) [000025] ------------                 └──▌  CNS_INT   int    0 $43
  -- prev tree has relop with reversed liberal VN
 -- prev tree is viable candidate for relop fwd sub!
 ... checking previous tree
N005 (  6,  3) [000017] -A------R---              ▌  ASG       int    <l:$185, c:$184>
N004 (  1,  1) [000016] D------N----              ├──▌  LCL_VAR   int    V01 tmp1         d:2 <l:$185, c:$184>
N003 (  6,  3) [000014] ------------              └──▌  EQ        int    <l:$185, c:$184>
N001 (  1,  1) [000012] ------------                 ├──▌  LCL_VAR   int    V01 tmp1         u:1 (last use) <l:$182, c:$183>
N002 (  1,  1) [000013] ------------                 └──▌  CNS_INT   int    0 $43
  -- prev tree has relop with same liberal VN
 -- prev tree ref to V01 interferes

removing useless STMT00007 ( INL02 @ 0x000[E-] ... ??? ) <- INLRT @ 0x000[E-]
N005 (  6,  3) [000029] -A------R---              ▌  ASG       int    <l:$187, c:$186>
N004 (  1,  1) [000028] D------N----              ├──▌  LCL_VAR   int    V02 tmp2         d:1 <l:$187, c:$186>
N003 (  6,  3) [000026] J------N----              └──▌  EQ        int    <l:$187, c:$186>
N001 (  1,  1) [000024] ------------                 ├──▌  LCL_VAR   int    V01 tmp1         u:2 (last use) <l:$185, c:$184>
N002 (  1,  1) [000025] ------------                 └──▌  CNS_INT   int    0 $43
 from BB01
 -- done! new jump tree is
N004 (  5,  5) [000008] ------------              ▌  JTRUE     void  
N003 (  6,  3) [000026] J------N----              └──▌  EQ        int    <l:$187, c:$186>
N001 (  1,  1) [000024] ------------                 ├──▌  LCL_VAR   int    V01 tmp1         u:2 (last use) <l:$185, c:$184>
N002 (  1,  1) [000025] ------------                 └──▌  CNS_INT   int    0 $43

cc @AndyAyersMS