From 5db155aa5d5932d95903b7c26d37f3f1e34e0870 Mon Sep 17 00:00:00 2001
From: Jakob Botsch Nielsen <jakob.botsch.nielsen@gmail.com>
Date: Tue, 5 Sep 2023 14:01:43 +0200
Subject: [PATCH 1/2] JIT: Compensate for mistyped commas in morph pre-order
 too

Morph has post-order logic to compensate for mistyped commas produced by
impStoreStruct. However, block morphing can optimize unused stores into
INDs; this interacts with the mistyped commas to produce illegal IR
shapes (e.g. `COMMA<simd12>(..., IND<ubyte>(...))`).

The ideal solution is to fix impStoreStruct (#91586 tracks this), but
this change has a more surgical fix for the problem that can be
backported to .NET 8.

Fix #91443
---
 src/coreclr/jit/morph.cpp                     |  6 +++++
 .../JitBlue/Runtime_91443/Runtime_91443.cs    | 23 +++++++++++++++++++
 .../Runtime_91443/Runtime_91443.csproj        |  8 +++++++
 3 files changed, 37 insertions(+)
 create mode 100644 src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.cs
 create mode 100644 src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.csproj

diff --git a/src/coreclr/jit/morph.cpp b/src/coreclr/jit/morph.cpp
index 7c2cb5bd0a2a6..5e3252ab97b5c 100644
--- a/src/coreclr/jit/morph.cpp
+++ b/src/coreclr/jit/morph.cpp
@@ -8909,6 +8909,12 @@ GenTree* Compiler::fgMorphSmpOp(GenTree* tree, MorphAddrContext* mac, bool* optA
             break;
 #endif
 
+        case GT_COMMA:
+            if (op2->OperIsStore() || (op2->OperGet() == GT_COMMA && op2->TypeGet() == TYP_VOID) || fgIsThrow(op2))
+            {
+                typ = tree->gtType = TYP_VOID;
+            }
+
         default:
             break;
     }
diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.cs b/src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.cs
new file mode 100644
index 0000000000000..d3844b77271dd
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.cs
@@ -0,0 +1,23 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Numerics;
+using System.Runtime.CompilerServices;
+using Xunit;
+
+public class Runtime_91443
+{
+    [Fact]
+    public static void TestEntryPoint()
+    {
+        new Runtime_91443().Method0();
+    }
+    
+    static Vector3 s;
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    private void Method0()
+    {
+        Vector3.Cross(s, s);
+    }
+}
diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.csproj b/src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.csproj
new file mode 100644
index 0000000000000..de6d5e08882e8
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.csproj
@@ -0,0 +1,8 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <Optimize>True</Optimize>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="$(MSBuildProjectName).cs" />
+  </ItemGroup>
+</Project>

From 4ebeb980c2370045f933acacd573a9d33a5e6571 Mon Sep 17 00:00:00 2001
From: Jakob Botsch Nielsen <jakob.botsch.nielsen@gmail.com>
Date: Tue, 5 Sep 2023 14:26:16 +0200
Subject: [PATCH 2/2] Fix build

---
 src/coreclr/jit/morph.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/coreclr/jit/morph.cpp b/src/coreclr/jit/morph.cpp
index 5e3252ab97b5c..99227ce03469f 100644
--- a/src/coreclr/jit/morph.cpp
+++ b/src/coreclr/jit/morph.cpp
@@ -8915,6 +8915,8 @@ GenTree* Compiler::fgMorphSmpOp(GenTree* tree, MorphAddrContext* mac, bool* optA
                 typ = tree->gtType = TYP_VOID;
             }
 
+            break;
+
         default:
             break;
     }