Assertion failed 'm_stacks != nullptr' during 'SSA: insert phis'

[AndyAyersMS]

From https://dev.azure.com/dnceng-public/public/_build/results?buildId=757828&view=ms.vss-test-web.build-test-results-tab

x86 windows System.Numerics.Vectors.Tests

DOTNET_JitStress=2e
DOTNET_TieredCompilation=0

Assert failure(PID 5936 [0x00001730], Thread: 3776 [0x0ec0]): Assertion failed 'm_stacks != nullptr' in 'System.Numerics.Tests.Matrix4x4Tests+<>c:<Matrix4x4CreatePerspectiveTest2>b__51_0():this' during 'SSA: insert phis' (IL size 27; hash 0x2b3351fc; FullOpts)

    File: D:\a\_work\1\s\src\coreclr\jit\ssarenamestate.cpp:50
    Image: C:\h\w\BEB10A43\p\dotnet.exe

Also fails on x86 with

DOTNET_JitStress=106
DOTNET_TieredCompilation=0

Also fails on x64 with

set DOTNET_TieredCompilation=0
set DOTNET_JitStress=22c

Also (same method, ssa, but different assert)
x86 windows

DOTNET_JitStress=387
DOTNET_TieredCompilation=0
  Starting:    System.Numerics.Vectors.Tests (parallel test collections = on [4 threads], stop on fail = off)

Assert failure(PID 6940 [0x00001b1c], Thread: 5136 [0x1410]): Assertion failed 'top != nullptr' in 'System.Numerics.Tests.Matrix4x4Tests+<>c:<Matrix4x4CreatePerspectiveFieldOfViewTest3>b__58_0():this' during 'SSA: insert phis' (IL size 27; hash 0x152f20d2; FullOpts)

    File: D:\a\_work\1\s\src\coreclr\jit\ssarenamestate.cpp:52

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[JulieLeeMSFT]

@AndyAyersMS, PTAL.

[AndyAyersMS]

Looking at the x64 failure: we have a call with a 64 byte return buffer, we decide not to promote the buffer based on stress, and we have 16 byte write. SSA sees this as a partial def and gets upset there is no upstream def.

***** BB01 [0000]
STMT00025 ( INL02 @ 0x0CC[E-] ... ??? ) <- INL01 @ 0x000[E-] <- INLRT @ 0x000[E-]
N006 ( 26, 20) [000102] SACXG------                         *  CALL      void   System.Numerics.Vector4:Create(float,float,float,float):System.Numerics.Vector4
N001 (  1,  2) [000101] ----------- arg4 out+20             +--*  CNS_DBL   float  0.0000000000000000
N002 (  3,  3) [000104] U---------- retbuf in rcx           +--*  LCL_ADDR  long   V08 tmp7         [+48]
N003 (  3,  2) [000100] ----------- arg3 in mm3             +--*  CNS_DBL   float  0.90909093618392944
N004 (  1,  2) [000097] ----------- arg2 in mm2             +--*  CNS_DBL   float  0.0000000000000000
N005 (  1,  2) [000096] ----------- arg1 in mm1             \--*  CNS_DBL   float  0.0000000000000000

Here V08 is

struct<System.Numerics.Matrix4x4+Impl, 64> V08 tmp7

Seems like the issue is in liveness? If the "first use" of a local is GTF_VAR_USEASG we treat it as a def and not a use followed by def. Based on (lack of liveness) SSA doesn't push an entry def for the local and then asserts later that it expected to see one.

FYI @jakobbotsch

[AndyAyersMS]

Early liveness is being too aggressive. We have a local that is initialized in 16 byte chunks by 3 intrinsics and then the last slice is used as the retbuff as above. Early liveness removes the 3 initial stores.

With proposed the fix all these stay around.

[AndyAyersMS]

The fix to "enhance" liveness has the drawback that if all uses are USEASG then we keep all the stores live when there are no "true" uses (see #105887).

Looking at an alternative where SSA pushes initial value SSA defs for all locals (that fixes this assert), and VN gives them all suitable initial VNs (since it has "matching logic"), even if the initial SSA def ends up unused (since vn dead store might go looking at the value).