[release/10.0] JIT: don't propagate promoted struct LCL_VAR into FIELD_LIST uses

[github-actions]

Backport of #128375 to release/10.0

/cc @EgorBo

Customer Impact

• Customer reported
• Found internally

Crash. A [StructLayout(LayoutKind.Explicit)] struct that aliases SIMD (Numerics/Vector*) fields with regular fields could make the JIT propagate a promoted struct LCL_VAR into a FIELD_LIST use, causing a segfault in LinearScan::processBlockStartLocations under Release/optimized codegen (#128373).

Regression

• Yes
• No

Does not reproduce on .NET 8.

Testing

Added regression test Runtime_128373 (segfaults without the fix, passes with it). Very few SPMI diffs.

Risk

Low, quite a niche scenario.

Note

This PR description was generated with the help of GitHub Copilot.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[JulieLeeMSFT]

LGTM.

[tannergooding]

@JulieLeeMSFT, @EgorBo is this missing servicing-consider/approved?

[JulieLeeMSFT]

Egor will submit an approval request.

[github-actions]

Workflow state for the Holistic Review Orchestrator.

{
  "version": 5,
  "last_dispatched_commit": "5f6ab3326cbadc757c0cad917252464e2f851c86",
  "last_dispatched_base_ref": "release/10.0",
  "last_dispatched_base_sha": "aced99138b1efad4a5361ff68ea1951c860dcbda",
  "last_reviewed_commit": "5f6ab3326cbadc757c0cad917252464e2f851c86",
  "last_reviewed_base_ref": "release/10.0",
  "last_reviewed_base_sha": "aced99138b1efad4a5361ff68ea1951c860dcbda",
  "last_recorded_worker_run_id": "29687176221",
  "review_attempt_commit": "",
  "review_attempt_base_ref": "",
  "review_attempt_count": 0,
  "max_review_attempts": 5,
  "review_history_format": "holistic-review-disclosure-v1",
  "review_history": [
    {
      "commit": "5f6ab3326cbadc757c0cad917252464e2f851c86",
      "review_id": 4730767536
    }
  ]
}

[github-actions]

Holistic Review

Motivation: Backport of #128375 to release/10.0. Fixes a crash (#128373) where a [StructLayout(LayoutKind.Explicit)] struct aliasing SIMD (Vector*/Numerics) fields with regular fields could make the JIT propagate a promoted (non-DNER) SIMD struct LCL_VAR into a GT_FIELD_LIST use of a multi-reg return. That IR is illegal and segfaults LinearScan::processBlockStartLocations in Release codegen (and asserts in Lowering::CheckNode in Checked builds). Customer-reported regression that does not repro on .NET 8, so it is appropriate release-branch material.

Approach: Guards are added at the two phases that could introduce the bad IR: copy-assertion propagation (optCopyAssertionProp) and forward substitution (fgForwardSubStatement) now bail out when the source is a promoted, non-DNER SIMD local. Additionally, fgMorphTree's GT_FIELD_LIST handling marks any whole promoted SIMD LCL_VAR operand as do-not-enregister (dependent promotion, DoNotEnregisterReason::SimdUserForcesDep) to preserve the post-morph promoted-struct invariant. Restricting the guards to SIMD locals keeps them narrow enough to avoid measurable codegen impact per the SPMI collections cited in the original PR. A targeted Runtime_128373 regression test reproduces under TieredCompilation + TieredPGO.

Summary: LGTM. The three JIT source hunks are byte-for-byte identical to the added lines of the original merged commit 03389cb, and the regression test and csproj match the original as well. The change is minimal, well-scoped, and low risk. The reasoning correctly targets both propagation sites plus the morph-time invariant repair. The regression test uses DebugType=None/Optimize=True with the tiered-PGO env vars needed to exercise the optimized path, and asserts a non-NaN result across 300 iterations, which is a reasonable proxy given the crash cannot be asserted directly. No actionable findings.

Note

This review was generated by this repository's Holistic Review agentic workflow to complement the built-in Copilot review.

Generated by Holistic Review · 47 AIC · ⌖ 14.5 AIC · ⊞ 10K