JIT: Bad codegen on arm64 with comparison involving division

[jakobbotsch]

// Generated by Fuzzlyn v2.4 on 2024-10-27 15:43:53
// Run on Arm64 MacOS
// Seed: 2607482317235207083-vectort,vector64,vector128,armadvsimd,armadvsimdarm64,armaes,armarmbase,armarmbasearm64,armcrc32,armcrc32arm64,armdp,armrdm,armrdmarm64,armsha1,armsha256
// Reduced from 220.5 KiB to 0.4 KiB in 00:00:39
// Debug: Prints 1 line(s)
// Release: Prints 0 line(s)
using System;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.Arm;

public class Program
{
    public static void Main()
    {
        var vr1 = Vector128.CreateScalar(2395292015U);
        if (((long)(18446744073709551614UL / (AdvSimd.Extract(vr1, 1) | 1)) < 0))
        {
            System.Console.WriteLine(0);
        }
    }
}

// Generated by Fuzzlyn v2.4 on 2024-10-27 16:58:11
// Run on X86 Windows
// Seed: 13886187988830061152-vectort,vector128,vector256,x86aes,x86avx,x86avx2,x86avx512bw,x86avx512bwvl,x86avx512cd,x86avx512cdvl,x86avx512dq,x86avx512dqvl,x86avx512f,x86avx512fvl,x86bmi1,x86bmi2,x86fma,x86lzcnt,x86pclmulqdq,x86popcnt,x86sse,x86sse2,x86sse3,x86sse41,x86sse42,x86ssse3,x86x86base
// Reduced from 241.5 KiB to 0.6 KiB in 00:05:21
// Debug: Prints 0 line(s)
// Release: Prints 1 line(s)
using System;
using System.Numerics;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;

public struct S0
{
    public ushort F2;
}

public class Program
{
    public static void Main()
    {
        var vr4 = new S0();
        var vr5 = M8(vr4);
    }

    public static float M8(S0 argThis)
    {
        Vector256<ushort> var1 = default(Vector256<ushort>);
        if ((long)(17731708739983220386UL / (ushort)(argThis.F2 | 1)) >= 0)
        {
            System.Console.WriteLine(var1);
        }

        return 0;
    }
}

I couldn't find an existing issue -- feel free to mark this as a dup if you've already opened one @amanasifkhalid.

cc @dotnet/jit-contrib

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[JulieLeeMSFT]

It is happening on both Arm and x86. Assigning to @amanasifkhalid.

[amanasifkhalid]

Here's a slight simplification of the second repro:

public static float M8(S0 argThis)
{
    if (((long)(17731708739983220386UL / (ushort)(argThis.F2 | 1))) >= 0)
    {
        Console.WriteLine("wrong");
    }

    return 0;
}

We have the following IL:

Importing BB01 (PC=000) of 'Program:M8(S0):float'
    [ 0]   0 (0x000) ldc.i8 0xf613af2703639ea2
    [ 1]   9 (0x009) ldarg.0
    [ 2]  10 (0x00a) ldfld 04000001
    [ 2]  15 (0x00f) ldc.i4.1 1
    [ 3]  16 (0x010) or
    [ 2]  17 (0x011) conv.u2
    [ 2]  18 (0x012) conv.u8
    [ 2]  19 (0x013) div.un
    [ 1]  20 (0x014) ldc.i4.0 0
    [ 2]  21 (0x015) conv.i8

Which is imported as the following IR:

STMT00000 ( 0x000[E-] ... ??? )
               [000013] ---X-------                         *  JTRUE     void  
               [000012] ---X-------                         \--*  LT        int   
               [000009] ---X-------                            +--*  UDIV      long  
               [000000] -----------                            |  +--*  CNS_INT   long   -0x9ec50d8fc9c615e
               [000008] ---------U-                            |  \--*  CAST      long <- ulong <- uint
               [000007] -----------                            |     \--*  CAST      int <- ushort <- int
               [000006] -----------                            |        \--*  OR        int   
               [000004] n----------                            |           +--*  IND       ushort
               [000003] -----------                            |           |  \--*  FIELD_ADDR byref  S0:F2
               [000002] -----------                            |           |     \--*  LCL_ADDR  byref  V00 arg0         [+0]
               [000005] -----------                            |           \--*  CNS_INT   int    1
               [000011] -----------                            \--*  CNS_INT   long   0

It seems odd that the result of the unsigned division isn't explicitly cast to a signed long before comparing it to zero. Without this cast, value numbering determines the GT_UDIV node can never produce a negative value, so the GT_LT's result is known; then, RBO optimizes the branch away altogether, hence why we enter the if statement's body. @jakobbotsch does it seem to you that the IL should be casting the division result?

[jakobbotsch]

Comparisons in IL and JIT IR are explicitly signed or unsigned, so no cast should be necessary.
The bug seems to be that IsVNNeverNegative thinks that the result of GT_UDIV cannot have its upper bit set -- that's incorrect as the example shows.