JIT Bug: Code Generation Error under inlining (Release only)

[LadislavLang]

Description

The provided C# code throws an unexpected System.Exception inside $Method2$ when compiled in the Release configuration using .NET 10.0.0.
The issue is a JIT code generation error related to the optimization path activated by the method attributes and repeated execution. The error specifically manifests during the comparison of int? types.

The input values are consistently $999$ and $999$, meaning the comparison $value1 != value2$ should always be $false$. However, the highly optimized JIT-compiled code erroneously evaluates this comparison as $true$, causing the exception.

Reproduction Steps

// 1. Compile the code below using .NET 10.0.0 in Release configuration.
// 2. Run the application.

using System;
using System.Runtime.CompilerServices;

class Program
{
    [MethodImpl(MethodImplOptions.NoOptimization)]
    static void Main()
    {
        var test = new Test();
        while (true)
        {
            test.Method1(0, 0, 0, 999, 999);
        }
    }
}

class Test
{
    [MethodImpl(MethodImplOptions.AggressiveInlining)]
    public void Method1(int a, int b, int c, int value1, int? value2)
    {
        Method2(1, 2, 3, value1, value2);
    }

    public void Method2(long a, int b, int c, int? value1, int? value2)
    {
        try
        {
            if (value1 != value2)
            {
                throw new Exception($"{value1} != {value2}");
            }
        }
        catch
        {
            throw;
        }
    }
}

Expected behavior

The program should run indefinitely without throwing an exception.

Actual behavior

The program throws $System.Exception$ shortly after startup, indicating the JIT incorrectly evaluated the comparison of two equal non-null $int?$ values in the optimized code.

Regression?

net9.0 in not affected

Known Workarounds

No response

Configuration

OS Name: Windows
OS Version: 10.0.22631
OS Platform: Windows
RID: win-x64
Base Path: C:\Program Files\dotnet\sdk\10.0.100\

Target framework: net10.0

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[huoyaoyuan]

Codegen is different for Method1.

9.0:

; Method Test:Method1(int,int,int,int,System.Nullable`1[int]):this (FullOpts)
G_M000_IG01:                ;; offset=0x0000
       sub      rsp, 56

G_M000_IG02:                ;; offset=0x0004
       mov      edx, dword ptr [rsp+0x60]
       mov      byte  ptr [rsp+0x30], 1
       mov      dword ptr [rsp+0x34], edx
       mov      rdx, qword ptr [rsp+0x68]
       mov      qword ptr [rsp+0x28], rdx
       mov      rdx, qword ptr [rsp+0x30]
       mov      qword ptr [rsp+0x20], rdx
       mov      edx, 1
       mov      r8d, 2
       mov      r9d, 3
       call     [Test:Method2(long,int,int,System.Nullable`1[int],System.Nullable`1[int]):this]
       nop      

G_M000_IG03:                ;; offset=0x003D
       add      rsp, 56
       ret      
; Total bytes of code: 66

10.0:

; Method Test:Method1(int,int,int,int,System.Nullable`1[int]):this (FullOpts)
G_M000_IG01:                ;; offset=0x0000

G_M000_IG02:                ;; offset=0x0000
       mov      edx, 1
       nop      

G_M000_IG03:                ;; offset=0x0006
       mov      byte  ptr [rsp+0x28], dl
       mov      r8d, dword ptr [rsp+0x28]
       mov      dword ptr [rsp+0x2C], r8d
       mov      rdx, qword ptr [rsp+0x30]
       mov      qword ptr [rsp+0x30], rdx
       mov      edx, 1
       mov      r8d, 2
       mov      r9d, 3
       mov      rax, 0x7FFEF6B056F8

G_M000_IG04:                ;; offset=0x0039
       tail.jmp [rax]Test:Method2(long,int,int,System.Nullable`1[int],System.Nullable`1[int]):this
; Total bytes of code: 60

[EgorBo]

@jakobbotsch @dotnet/jit-contrib smells like tail-call problem? probably incorrect setup of Nullable<> args for it

[jakobbotsch]

@jakobbotsch @dotnet/jit-contrib smells like tail-call problem? probably incorrect setup of Nullable<> args for it

Yes, looks like a case where we don't realize that a defensive copy is needed because arg setup is going to override a parameter.

[LadislavLang]

Huh, milestone 11.0.0?
So we should wait one year to dotnet 11, because in dotnet 10 (LTS) will be unfixed critical bug?

[jakobbotsch]

Huh, milestone 11.0.0? So we should wait one year to dotnet 11, because in dotnet 10 (LTS) will be unfixed critical bug?

Hey, sorry for the confusion. Milestone 11.0 is just the default milestone we place any new issue in. I can certainly backport the fix for this issue to .NET 10.

[jakobbotsch]

#122147 will fix this issue. I will submit a backport to .NET 10 once we have merged that into main. Thanks a lot for the report with the simple repro case!