Repository navigation
[release/9.0-staging] JIT: Fix invalid removal of explicit zeroing in methods without .localsinit - #115568
Conversation
Sorry, something went wrong.
There was a problem hiding this comment.
Pull Request Overview
This PR backports a fix to the JIT to address an issue where explicit zeroing of struct fields gets mistakenly removed in methods without .localsinit (when the SkipLocalsInit attribute is applied).
- Ensures explicit field zeroing is preserved by killing dependent assertions for dead fields.
- Adds a dedicated test case to validate the fix.
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| src/tests/JIT/Regression/JitBlue/Runtime_113658/Runtime_113658.csproj | New test project configuration for JIT regression. |
| src/tests/JIT/Regression/JitBlue/Runtime_113658/Runtime_113658.cs | New test validating correct zeroing behavior. |
| src/coreclr/jit/morphblock.cpp | Introduces calls to kill dependent assertions in field-by-field initialization and copy paths to prevent incorrect removal of zeroing. |
src/coreclr/jit/morphblock.cpp:409
- Double-check that killing dependent assertions here correctly targets only fields that are truly dead, ensuring that no valid assertions are unintentionally removed.
m_comp->fgKillDependentAssertionsSingle(m_dstLclNum DEBUGARG(m_store));
src/coreclr/jit/morphblock.cpp:1238
- Verify that the use of fgKillDependentAssertionsSingle in the field-by-field copy logic is consistent with its use in the initialization routine and does not remove assertions that should be preserved.
m_comp->fgKillDependentAssertionsSingle(m_dstLclNum DEBUGARG(m_store));
Sorry, something went wrong.
jeffschwMSFT
left a comment
There was a problem hiding this comment.
lgtm. please get a code review. we will take for consideration in 9.0.x
Sorry, something went wrong.
|
Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch |
Sorry, something went wrong.
Backport of #115556 to release/9.0-staging
Customer Impact
The JIT may mistakenly remove explicit field zeroing for some struct fields in methods without .localsinit (e.g. by having the SkipLocalsInit attribute applied in C#). This can happen when the IL first zero-initializes the full struct local using e.g. initobj, and then later zeroes a particular field of the struct local using stfld. Under certain circumstances, the JIT mistakenly eliminates both explicit zeroings of the field, leaving no zero initialization present, resulting in the field containing stack garbage.
Reported by customer in #113658.
Regression
This was exposed by support for cross-block assertion prop enabled in #94689.
Testing
Unit test added, and tested manually on user's test case.
Risk
Low