JIT: Block morphing does not handle that decomposed writes can affect the destination

[jakobbotsch]

[MethodImpl(MethodImplOptions.NoInlining)]
static int Test()
{
    S s;
    s.Me = &s;
    S s2;
    s2.Me = null;
    s2.F = 1234;
    *(S*)s.Me = s2;
    return s.F;
}

public unsafe struct S
{
    public void* Me;
    public int F;
}

Test returns 1234 in tier-0 but throws NullReferenceException in tier-1. Block morphing produces

MorphCopyBlock:
PrepareDst for [000021] have not found a local var.
block assignment to morph:
               [000022] -A-XG------                         ▌  ASG       struct (copy)
               [000021] ---XG+-N---                         ├──▌  BLK       struct<Program+S, 16>
               [000019] ----G+-----                         │  └──▌  LCL_VAR   long  (AX) V03 tmp1         
               [000020] -----+-----                         └──▌  LCL_VAR   struct<Program+S, 16>(P) V01 loc1         
                                                            └──▌    long   V01.Program+S:Me (offs=0x00) -> V05 tmp3          (last use)
                                                            └──▌    int    V01.Program+S:F (offs=0x08) -> V06 tmp4          (last use)
 (m_srcDoFldAsg=true) using field by field assignments.
dstAddr - Multiple Fields Clone created:
               [000033] ----G------                         ▌  LCL_VAR   long  (AX) V03 tmp1         
MorphCopyBlock (after):
               [000038] -A-XG+-----                         ▌  COMMA     void  
               [000031] -A-XG------                         ├──▌  ASG       long  
               [000030] ---XG--N---                         │  ├──▌  IND       long  
               [000019] ----G+-----                         │  │  └──▌  LCL_VAR   long  (AX) V03 tmp1         
               [000029] -----------                         │  └──▌  LCL_VAR   long   V05 tmp3         
               [000037] -A-XG------                         └──▌  ASG       int   
               [000036] ---XG--N---                            ├──▌  IND       int   
               [000035] ----G------                            │  └──▌  ADD       byref 
               [000033] ----G+-----                            │     ├──▌  LCL_VAR   long  (AX) V03 tmp1         
               [000034] -----------                            │     └──▌  CNS_INT   long   8
               [000032] -----------                            └──▌  LCL_VAR   int    V06 tmp4         

The first store overrides V03 that is also used in the second store.

[ghost]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

[MethodImpl(MethodImplOptions.NoInlining)]
static int Test()
{
    S s;
    s.Me = &s;
    S s2;
    s2.Me = null;
    s2.F = 1234;
    *(S*)s.Me = s2;
    return s.F;
}

public unsafe struct S
{
    public void* Me;
    public int F;
}

Test returns 1234 in tier-0 but throws NullReferenceException in tier-1. Block morphing produces

MorphCopyBlock:
PrepareDst for [000021] have not found a local var.
block assignment to morph:
               [000022] -A-XG------                         ▌  ASG       struct (copy)
               [000021] ---XG+-N---                         ├──▌  BLK       struct<Program+S, 16>
               [000019] ----G+-----                         │  └──▌  LCL_VAR   long  (AX) V03 tmp1         
               [000020] -----+-----                         └──▌  LCL_VAR   struct<Program+S, 16>(P) V01 loc1         
                                                            └──▌    long   V01.Program+S:Me (offs=0x00) -> V05 tmp3          (last use)
                                                            └──▌    int    V01.Program+S:F (offs=0x08) -> V06 tmp4          (last use)
 (m_srcDoFldAsg=true) using field by field assignments.
dstAddr - Multiple Fields Clone created:
               [000033] ----G------                         ▌  LCL_VAR   long  (AX) V03 tmp1         
MorphCopyBlock (after):
               [000038] -A-XG+-----                         ▌  COMMA     void  
               [000031] -A-XG------                         ├──▌  ASG       long  
               [000030] ---XG--N---                         │  ├──▌  IND       long  
               [000019] ----G+-----                         │  │  └──▌  LCL_VAR   long  (AX) V03 tmp1         
               [000029] -----------                         │  └──▌  LCL_VAR   long   V05 tmp3         
               [000037] -A-XG------                         └──▌  ASG       int   
               [000036] ---XG--N---                            ├──▌  IND       int   
               [000035] ----G------                            │  └──▌  ADD       byref 
               [000033] ----G+-----                            │     ├──▌  LCL_VAR   long  (AX) V03 tmp1         
               [000034] -----------                            │     └──▌  CNS_INT   long   8
               [000032] -----------                            └──▌  LCL_VAR   int    V06 tmp4         

The first store overrides V03 that is also used in the second store.

Author:	jakobbotsch
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-