JIT: fix loop cloning type assumptions by AndyAyersMS · Pull Request #128729 · dotnet/runtime

AndyAyersMS · 2026-05-28T21:41:35Z

References to arrays may now be TYP_I_IMPL or TYP_BYREF when the referred-to arrays are / may be stack allocated. Loop cloning was always assuming them to be TYP_REF.

Update loop cloning to use the actual array referent type for the new array references it creates.

Fixes #115663.

Loop cloning captured array/index locals at identification time but re-read their types from lvaTable when synthesizing guard trees. If a local's tracked type no longer matches its tree-node type (e.g. TYP_REF → TYP_LONG after global morph), the generated guards have mismatched operand types and VN folds null checks incorrectly. Preserve the array ref type at identification time and use it when materializing guard comparisons. Also fix the null sentinel (always TYP_REF) to match the operand type for non-GC locals. Fixes dotnet#115663. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

dotnet-policy-service · 2026-05-28T21:42:58Z

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR updates CoreCLR JIT loop cloning to stop assuming array references are always TYP_REF, by carrying forward the actual referent/local types observed during extraction and using those when synthesizing new IR for cloning conditions.

Changes:

Track and propagate array base type (ArrIndex::arrType) and local type (LC_Ident::lclType) through loop cloning’s symbolic condition representation.
Use the captured types when materializing new GenTree nodes (e.g., gtNewLclvNode) so cloned conditions remain well-typed after earlier phases rewrite local types.
Record arrType during array index extraction and in NaturalLoopIterInfo::ArrLenLimit.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/coreclr/jit/loopcloning.h	Adds type fields to loop cloning’s symbolic representations and tightens equality comparisons accordingly.
src/coreclr/jit/loopcloning.cpp	Uses captured types when building IR; adds logic intended to prevent mixed-type null comparisons.
src/coreclr/jit/flowgraph.cpp	Captures array ref type for `a.Length` limits in loop iteration info extraction.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The lclvars.cpp assertion requires GT_LCL_VAR node types to match lvaTable. Only IndirOfLocal needs the captured type (fixing the hardcoded TYP_REF); the null-type fixup handles the resulting mismatch in null guard comparisons. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

For jagged arrays, optExtractArrIndex is called once per dimension. The second-dimension call has a different array operand (the temp holding a[i], typed ref) not the original stack-allocated array (typed long). Setting arrType unconditionally overwrote the correct long type with ref, creating a type mismatch in the null guard. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The type compatibility checks for iter/limit vars must use lvaTable types, not tree-node types. A long local cast to int has TYP_INT in the tree but TYP_LONG in lvaTable; using the tree type bypasses the rejection and creates a TYP_LONG guard compared against a TYP_INT constant -- size mismatch assertion. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

The captured tree-node type can mismatch lvaTable after object stack allocation retypes locals. Use lvaTable for both Var and IndirOfLocal; the null-type fixup in LC_Condition::ToGenTree handles the resulting TYP_LONG-vs-TYP_REF null comparison. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

AndyAyersMS · 2026-05-30T01:25:26Z

diffs

Enables some optimizations previously inhibited by oddly-type compares created during cloning of loops with references to stack allocated arrays. Turns out we did not need any VN fixes.

@jakobbotsch PTAL
fyi @dotnet/jit-contrib

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

src/coreclr/jit/loopcloning.cpp:183

LC_Ident::ToGenTree now builds addr using the local’s current lvType, which can be TYP_BYREF/TYP_I_IMPL/TYP_LONG for stack-allocated objects. The indirOffs == 0 path then calls gtNewMethodTableLookup(addr) with onStack=false, but gtNewMethodTableLookup asserts onStack || object->TypeIs(TYP_REF) (compiler.hpp:1887). This will trip in DEBUG builds for non-TYP_REF locals and is likely the scenario this PR is enabling.

            GenTree* addr = comp->gtNewLclvNode(lclNum, comp->lvaTable[lclNum].lvType);
            if (indirOffs == 0)
            {
                return comp->gtNewMethodTableLookup(addr);
            }

Instead of creating TYP_REF null constants and fixing them up later in LC_Condition::ToGenTree, pass the correct type to CreateNull() so the cloner creates well-typed IR from the start. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

AndyAyersMS · 2026-06-03T02:44:16Z

CI test failure could be related (arm32) or maybe a different manifestation of #128595. Suspect it is unrelated.

  Starting:    ComInterfaceGenerator.Unit.Tests (parallel test collections = on [2 threads], stop on fail = off)
[createdump] Gathering state for process 17 dotnet
[createdump] Crashing thread 0026 signal 11 (000b)

CI build failure is #128905 / #128372 / dotnet/sdk#54350

AndyAyersMS · 2026-06-04T17:31:49Z

@jakobbotsch ping

jakobbotsch

This looks better to me now.

AndyAyersMS · 2026-06-04T19:58:01Z

diffs

Unblocks some loop optimizations.

AndyAyersMS · 2026-06-04T19:58:53Z

/ba-g unrelated failure and analyzer issue

Copilot AI review requested due to automatic review settings May 28, 2026 21:41

Copilot started reviewing on behalf of AndyAyersMS May 28, 2026 21:41 View session

github-actions Bot added the area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI label May 28, 2026

dotnet-policy-service Bot assigned AndyAyersMS May 28, 2026

Copilot AI reviewed May 28, 2026

View reviewed changes

Comment thread src/coreclr/jit/loopcloning.cpp Outdated

AndyAyersMS and others added 2 commits May 28, 2026 15:17

Fix formatting

fa2125b

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 29, 2026 02:07

Copilot started reviewing on behalf of AndyAyersMS May 29, 2026 02:07 View session

Copilot AI reviewed May 29, 2026

View reviewed changes

Comment thread src/coreclr/jit/loopcloning.cpp Outdated

Comment thread src/coreclr/jit/loopcloning.cpp Outdated

Copilot AI review requested due to automatic review settings May 29, 2026 14:26

Copilot started reviewing on behalf of AndyAyersMS May 29, 2026 14:26 View session

Fix formatting

ec2a8e4

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI reviewed May 29, 2026

View reviewed changes

AndyAyersMS marked this pull request as ready for review May 30, 2026 01:21

Copilot AI review requested due to automatic review settings May 30, 2026 01:21

Copilot started reviewing on behalf of AndyAyersMS May 30, 2026 01:22 View session

Copilot AI reviewed May 30, 2026

View reviewed changes

Comment thread src/coreclr/jit/loopcloning.h

Comment thread src/coreclr/jit/loopcloning.cpp Outdated

Set arrType in MD array GetArrIndexForDim

070220e

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

build-analysis Bot mentioned this pull request Jun 2, 2026

System.IO.Tests.File_GetSetTimes_SafeFileHandle.WritingShouldUpdateWriteTime_After_SetLastAccessTime failing #97020

Open

Merge remote-tracking branch 'upstream/main' into fix-loop-cloning-types

515bd4a

Copilot AI review requested due to automatic review settings June 2, 2026 15:03

Copilot started reviewing on behalf of AndyAyersMS June 2, 2026 15:03 View session

Copilot AI reviewed Jun 2, 2026

View reviewed changes

jakobbotsch reviewed Jun 2, 2026

View reviewed changes

Comment thread src/coreclr/jit/loopcloning.cpp Outdated

jakobbotsch approved these changes Jun 4, 2026

View reviewed changes

AndyAyersMS merged commit e0471a1 into dotnet:main Jun 4, 2026
136 of 139 checks passed

dotnet-maestro Bot mentioned this pull request Jun 5, 2026

[main] Source code updates from dotnet/runtime dotnet/dotnet#7066

Merged

dotnet-milestone-bot Bot added this to the 11.0-preview6 milestone Jun 5, 2026

Conversation

AndyAyersMS commented May 28, 2026

Uh oh!

dotnet-policy-service Bot commented May 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

AndyAyersMS commented May 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

AndyAyersMS commented Jun 3, 2026

Uh oh!

AndyAyersMS commented Jun 4, 2026

Uh oh!

jakobbotsch left a comment

Choose a reason for hiding this comment

Uh oh!

AndyAyersMS commented Jun 4, 2026

Uh oh!

AndyAyersMS commented Jun 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants