Test failure: System.Memory.Tests

[BruceForstall]

Also, System.Text.RegularExpressions.Tests, System.Threading.Tasks.Parallel.Tests, System.Threading.Tasks.Tests.

net9.0-windows-Release-x86-CoreCLR_checked-jitstress_random_2-Windows.10.Amd64.Open

Example:

C:\h\w\AB8A0917\w\BC7D0A32\e>set DOTNET 
DOTNET_JitStress=d6
DOTNET_TieredCompilation=0

C:\h\w\AB8A0917\w\BC7D0A32\e>call RunTests.cmd --runtime-path C:\h\w\AB8A0917\p 
----- start Tue 09/12/2023 20:25:21.15 ===============  To repro directly: =====================================================
pushd C:\h\w\AB8A0917\w\BC7D0A32\e\
"C:\h\w\AB8A0917\p\dotnet.exe" exec --runtimeconfig System.Memory.Tests.runtimeconfig.json --depsfile System.Memory.Tests.deps.json xunit.console.dll System.Memory.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing 
popd
===========================================================================================================

C:\h\w\AB8A0917\w\BC7D0A32\e>"C:\h\w\AB8A0917\p\dotnet.exe" exec --runtimeconfig System.Memory.Tests.runtimeconfig.json --depsfile System.Memory.Tests.deps.json xunit.console.dll System.Memory.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing  
  Discovering: System.Memory.Tests (method display = ClassAndMethod, method display options = None)
  Discovered:  System.Memory.Tests (found 2700 of 2728 test cases)
  Starting:    System.Memory.Tests (parallel test collections = on, max threads = 4)
----- end Tue 09/12/2023 20:26:23.44 ----- exit code 3 ----------------------------------------------------------

The failure is a CRT assert in an sprintf added in #91854: "Buffer too small".

clrjit!common_vsprintf_s<char>(unsigned int64 options = 0x24, char * buffer = 0x1119b518 "", unsigned int buffer_count = 0x32, char * format = 0x79851dbc "loop block BB%02u appears before top of loop", class __crt_cached_ptd_host * ptd = 0x1119b370, char * arglist = 0x1119b3f0 "O???")+0x204
clrjit!__stdio_common_vsprintf_s(unsigned int64 options = 0x24, char * buffer = 0x1119b518 "", unsigned int buffer_count = 0x32, char * format = 0x79851dbc "loop block BB%02u appears before top of loop", struct __crt_locale_pointers * locale = 0x00000000, char * arglist = 0x1119b3f0 "O???")+0x35
clrjit!_vsprintf_s_l(char * _Buffer = 0x1119b518 "", unsigned int _BufferCount = 0x32, char * _Format = 0x79851dbc "loop block BB%02u appears before top of loop", struct __crt_locale_pointers * _Locale = 0x00000000, char * _ArgList = 0x1119b3f0 "O???")+0x21
clrjit!sprintf_s(char * _Buffer = 0x1119b518 "", unsigned int _BufferCount = 0x32, char * _Format = 0x79851dbc "loop block BB%02u appears before top of loop")+0x17
clrjit!Compiler::placeLoopAlignInstructions(void)+0x1e5
clrjit!CompilerPhaseWithStatus::DoPhase(void)+0x14

The source:

            else if (visitedLoopNum[loopTop->bbNatLoopNum])
            {
#ifdef DEBUG
                char buffer[50];
                sprintf_s(buffer, 50, "loop block " FMT_BB " appears before top of loop",
                          visitedBlockForLoopNum[loopTop->bbNatLoopNum]);
#endif

It appears that loopTop->bbNatLoopNum is 0xff (NOT_IN_LOOP) which is outside the bounds of the visitedLoopNum and visitedBlockForLoopNum arrays, and it's probably hitting the assert because 50 is actually too small a buffer size for some garbage input block number.

[ghost]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Also, System.Text.RegularExpressions.Tests, System.Threading.Tasks.Parallel.Tests, System.Threading.Tasks.Tests.

net9.0-windows-Release-x86-CoreCLR_checked-jitstress_random_2-Windows.10.Amd64.Open

Example:

C:\h\w\AB8A0917\w\BC7D0A32\e>set DOTNET 
DOTNET_JitStress=d6
DOTNET_TieredCompilation=0

C:\h\w\AB8A0917\w\BC7D0A32\e>call RunTests.cmd --runtime-path C:\h\w\AB8A0917\p 
----- start Tue 09/12/2023 20:25:21.15 ===============  To repro directly: =====================================================
pushd C:\h\w\AB8A0917\w\BC7D0A32\e\
"C:\h\w\AB8A0917\p\dotnet.exe" exec --runtimeconfig System.Memory.Tests.runtimeconfig.json --depsfile System.Memory.Tests.deps.json xunit.console.dll System.Memory.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing 
popd
===========================================================================================================

C:\h\w\AB8A0917\w\BC7D0A32\e>"C:\h\w\AB8A0917\p\dotnet.exe" exec --runtimeconfig System.Memory.Tests.runtimeconfig.json --depsfile System.Memory.Tests.deps.json xunit.console.dll System.Memory.Tests.dll -xml testResults.xml -nologo -nocolor -notrait category=IgnoreForCI -notrait category=OuterLoop -notrait category=failing  
  Discovering: System.Memory.Tests (method display = ClassAndMethod, method display options = None)
  Discovered:  System.Memory.Tests (found 2700 of 2728 test cases)
  Starting:    System.Memory.Tests (parallel test collections = on, max threads = 4)
----- end Tue 09/12/2023 20:26:23.44 ----- exit code 3 ----------------------------------------------------------

The failure is a CRT assert in an sprintf added in #91854: "Buffer too small".

clrjit!common_vsprintf_s<char>(unsigned int64 options = 0x24, char * buffer = 0x1119b518 "", unsigned int buffer_count = 0x32, char * format = 0x79851dbc "loop block BB%02u appears before top of loop", class __crt_cached_ptd_host * ptd = 0x1119b370, char * arglist = 0x1119b3f0 "O???")+0x204
clrjit!__stdio_common_vsprintf_s(unsigned int64 options = 0x24, char * buffer = 0x1119b518 "", unsigned int buffer_count = 0x32, char * format = 0x79851dbc "loop block BB%02u appears before top of loop", struct __crt_locale_pointers * locale = 0x00000000, char * arglist = 0x1119b3f0 "O???")+0x35
clrjit!_vsprintf_s_l(char * _Buffer = 0x1119b518 "", unsigned int _BufferCount = 0x32, char * _Format = 0x79851dbc "loop block BB%02u appears before top of loop", struct __crt_locale_pointers * _Locale = 0x00000000, char * _ArgList = 0x1119b3f0 "O???")+0x21
clrjit!sprintf_s(char * _Buffer = 0x1119b518 "", unsigned int _BufferCount = 0x32, char * _Format = 0x79851dbc "loop block BB%02u appears before top of loop")+0x17
clrjit!Compiler::placeLoopAlignInstructions(void)+0x1e5
clrjit!CompilerPhaseWithStatus::DoPhase(void)+0x14

The source:

            else if (visitedLoopNum[loopTop->bbNatLoopNum])
            {
#ifdef DEBUG
                char buffer[50];
                sprintf_s(buffer, 50, "loop block " FMT_BB " appears before top of loop",
                          visitedBlockForLoopNum[loopTop->bbNatLoopNum]);
#endif

It appears that loopTop->bbNatLoopNum is 0xff (NOT_IN_LOOP) which is outside the bounds of the visitedLoopNum and visitedBlockForLoopNum arrays, and it's probably hitting the assert because 50 is actually too small a buffer size for some garbage input block number.

Author:	BruceForstall
Assignees:	kunalspathak
Labels:	area-CodeGen-coreclr, blocking-clean-ci-optional
Milestone:	9.0.0