Repository navigation
Wasm / R2R: crossgen2 assert in genCodeForShift on long shift with non-INT shift amount #129263
Description
Compiling src\tests\JIT\Regression\CLR-x86-JIT\V1-M12-Beta2\b53884\b53884.il
for Wasm R2R hits an assert in genCodeForShift:
src\coreclr\jit\codegenwasm.cpp:1820
Assertion failed 'treeNode->gtGetOp2()->TypeIs(TYP_INT)' in
'ILGEN_0x3c109d11:Method_0x52483fac(short,double,byte,sbyte,double):int'
during 'Generate code' (IL size 493; hash 0xde5c0090; FullOpts)
The asserting code handles a TYP_LONG shift / rotate and expects its
second operand (shift amount) to already be TYP_INT:
// codegenwasm.cpp, CodeGen::genCodeForShift
if (treeNode->TypeIs(TYP_LONG))
{
assert(treeNode->gtGetOp2()->TypeIs(TYP_INT));
// Zero-extend the shift amount to 64 bits for long shifts/rotates.
GetEmitter()->emitIns(INS_i64_extend_u_i32);
}For this test (a generated stress test full of shr.un on int64
locals/arrays) some shift's op2 doesn't reach codegen as TYP_INT,
so the assert fires and crossgen2 exits with -2147483645
(STATUS_BREAKPOINT). The test source includes:
.locals (int8[] local_0x0, unsigned int64 local_0x1, ...)
...
shr.un ;; on unsigned int64 with various-typed shift amountsThis blocks the merged R2R image build for both Regression_6 (M11/M12
CLR-x86 tests) and Regression_7 (M09.5/M10 CLR-x86 tests). Because the
assert fires at R2R compile time, the runtime-side
DOTNET_ReadyToRunExcludeList workaround used in #128234 does not help.
Repro
.\build clr+libs -rc debug -c release -os browser
.\src\tests\build skipmanaged browser
;; put repo dotnet in path
set DOTNET_ROOT=<REPO_ROOT>\.dotnet
set PATH=<REPO_ROOT>\.dotnet;%PATH%
cd src\tests\JIT\Regression\CLR-x86-JIT\V1-M12-Beta2\b53884
dotnet msbuild /p:TargetArchitecture=wasm /p:TargetOS=browser /p:RuntimeFlavor=coreclr ^
/p:BuildAsStandalone=true b53884.ilproj
set CORE_ROOT=<REPO_ROOT>\artifacts\tests\coreclr\browser.wasm.Debug\Tests\Core_Root
set DLL=<REPO_ROOT>\artifacts\tests\coreclr\browser.wasm.Debug\JIT\Regression\CLR-x86-JIT\V1-M12-Beta2\b53884\b53884\b53884.dll
set CG2DIR=<REPO_ROOT>\artifacts\bin\crossgen2_inbuild\wasm\Debug
dotnet %CG2DIR%\crossgen2.dll ^
--targetos:windows --targetarch:wasm ^
--jitpath %CG2DIR%\clrjit_universal_wasm_x64.dll ^
--inputbubble ^
-r:%CORE_ROOT%\*.dll ^
-o:b53884.wasm ^
--parallelism 1 ^
%DLL%
Hit on wasm-eh-infra (and on any branch built on top of it, e.g. PR #129197).
Activity
dotnet-policy-service commentedon Jun 10, 2026
Tagging subscribers to 'arch-wasm': @lewing, @pavelsavara
See info in area-owners.md if you want to be subscribed.
dotnet-policy-service commentedon Jun 10, 2026
Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.
AndyAyersMS commentedon Jun 10, 2026
@adamperlin perhaps you can take this one?
I don't know if it repros in current main or requires some of the PRs in flight to land first.
adamperlin commentedon Jun 10, 2026
I am happy to take this one! If it doesn't repro in current main I'll wait for the PRs that are in-flight!
[RyuJIT Wasm]: Fix incorrect assert for shift amount type in codegenw…
[RyuJIT Wasm]: Fix incorrect assert for shift amount type in codegenw…
[RyuJIT Wasm]: Fix incorrect assert for shift amount type in codegenw…