Test failure: JIT/Methodical/explicit/coverage/expl_float_1_r/expl_float_1_r.dll

[BruceForstall]

Pipeline: runtime-coreclr jitstress-random
job: coreclr linux arm Checked jitstress_random_2 @ (Ubuntu.1804.Arm32.Open)Ubuntu.1804.Armarch.Open@mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-18.04-helix-arm32v7

https://dev.azure.com/dnceng-public/public/_build/results?buildId=413149&view=ms.vss-test-web.build-test-results-tab&runId=9015422&paneView=debug

export DOTNET_TieredCompilation=0
export DOTNET_JitStress=30e

18:12:48.889 Running test: JIT/Methodical/explicit/coverage/expl_float_1_r/expl_float_1_r.dll
System.DataMisalignedException: A datatype misalignment was detected in a load or store instruction.
   at AA.reset()
   at TestApp.RunAllTests()
   at Program.<<Main>$>g__TestExecutor70|0_71(StreamWriter tempLogSw, StreamWriter statsCsvSw, <>c__DisplayClass0_0&)
18:12:48.949 Failed test: JIT/Methodical/explicit/coverage/expl_float_1_r/expl_float_1_r.dll

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Pipeline: runtime-coreclr jitstress-random
job: coreclr linux arm Checked jitstress_random_2 @ (Ubuntu.1804.Arm32.Open)Ubuntu.1804.Armarch.Open@mcr.microsoft.com/dotnet-buildtools/prereqs:ubuntu-18.04-helix-arm32v7

https://dev.azure.com/dnceng-public/public/_build/results?buildId=413149&view=ms.vss-test-web.build-test-results-tab&runId=9015422&paneView=debug

export DOTNET_TieredCompilation=0
export DOTNET_JitStress=30e

18:12:48.889 Running test: JIT/Methodical/explicit/coverage/expl_float_1_r/expl_float_1_r.dll
System.DataMisalignedException: A datatype misalignment was detected in a load or store instruction.
   at AA.reset()
   at TestApp.RunAllTests()
   at Program.<<Main>$>g__TestExecutor70|0_71(StreamWriter tempLogSw, StreamWriter statsCsvSw, <>c__DisplayClass0_0&)
18:12:48.949 Failed test: JIT/Methodical/explicit/coverage/expl_float_1_r/expl_float_1_r.dll

Author:	BruceForstall
Assignees:	-
Labels:	arch-arm32, os-linux, JitStress, area-CodeGen-coreclr
Milestone:	9.0.0

[BruceForstall]

@TIHan Since you're recently been looking at a linux-arm32 jitstress failure, can you take this one?

[TIHan]

I'm able to reproduce it. Still investigating.

[EgorBo]

The test seems to be intentially doing unaligned reads:

[StructLayout(LayoutKind.Explicit)]
internal struct AA
{
    [FieldOffset(3)]
    public byte tmp1;

    [FieldOffset(8)]
    public float q;

    [FieldOffset(47)]
    public float tmp2;
...

Normally it's not an issue for regular ldr/str loads since OS fixes them up but it might be an issue for SIMD-related loads/stores so I bet jitstress triggered some SIMD load for tmp2 - those loads aren't fixable by OS and throw that exception.

[TIHan]

@EgorBo the simd loads appear to be the same with and without the stress mode.

No Stress

; Assembly listing for method AA:reset() (FullOpts)
; Emitting BLENDED_CODE for generic ARM - Unix
; FullOpts code
; optimized code
; r11 based frame
; partially interruptible
; No PGO data
; 0 inlinees with PGO data; 8 single block inlinees; 0 inlinees without PGO data
; Final local variable assignments
;
;  V00 OutArgs      [V00    ] (  1,  1   )  struct (52) [sp+0x00]  do-not-enreg[XS] addr-exposed "OutgoingArgSpace"
;* V01 tmp1         [V01    ] (  0,  0   )  struct (52) zero-ref    do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;* V02 tmp2         [V02    ] (  0,  0   )     ref  ->  zero-ref    class-hnd exact "impAppendStmt" <AA[]>
;* V03 tmp3         [V03    ] (  0,  0   )  struct (52) zero-ref    do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;* V04 tmp4         [V04    ] (  0,  0   )     ref  ->  zero-ref    class-hnd exact "impAppendStmt" <AA[]>
;  V05 tmp5         [V05,T05] (  3,  6   )  struct (52) [sp+0x6C]  do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;  V06 tmp6         [V06,T09] (  2,  4   )     ref  ->   r0         class-hnd exact single-def "impAppendStmt" <AA[,,]>
;  V07 tmp7         [V07,T11] (  2,  4   )  struct (52) [sp+0x38]  do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;  V08 tmp8         [V08,T10] (  2,  4   )     ref  ->   r0         class-hnd exact single-def "impAppendStmt" <AA[,,]>
;* V09 tmp9         [V09    ] (  0,  0   )  struct (52) zero-ref    do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;* V10 tmp10        [V10    ] (  0,  0   )  struct (52) zero-ref    do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;* V11 tmp11        [V11    ] (  0,  0   )  struct (52) zero-ref    do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;* V12 tmp12        [V12    ] (  0,  0   )  struct (52) zero-ref    do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;* V13 tmp13        [V13    ] (  0,  0   )   ubyte  ->  zero-ref    "V01.[003..004)"
;* V14 tmp14        [V14    ] (  0,  0   )   float  ->  zero-ref    "V01.[008..012)"
;* V15 tmp15        [V15    ] (  0,  0   )   float  ->  zero-ref    "V01.[047..051)"
;* V16 tmp16        [V16    ] (  0,  0   )   ubyte  ->  zero-ref    "V03.[003..004)"
;* V17 tmp17        [V17    ] (  0,  0   )   float  ->  zero-ref    "V03.[008..012)"
;* V18 tmp18        [V18    ] (  0,  0   )   float  ->  zero-ref    "V03.[047..051)"
;* V19 tmp19        [V19    ] (  0,  0   )   ubyte  ->  zero-ref    single-def "V09.[003..004)"
;* V20 tmp20        [V20    ] (  0,  0   )   float  ->  zero-ref    single-def "V09.[008..012)"
;* V21 tmp21        [V21,T12] (  0,  0   )   float  ->  zero-ref    single-def "V09.[047..051)"
;* V22 tmp22        [V22    ] (  0,  0   )   ubyte  ->  zero-ref    single-def "V10.[003..004)"
;* V23 tmp23        [V23,T13] (  0,  0   )   float  ->  zero-ref    single-def "V10.[008..012)"
;* V24 tmp24        [V24,T14] (  0,  0   )   float  ->  zero-ref    single-def "V10.[047..051)"
;* V25 tmp25        [V25    ] (  0,  0   )   ubyte  ->  zero-ref    single-def "V11.[003..004)"
;* V26 tmp26        [V26    ] (  0,  0   )   float  ->  zero-ref    single-def "V11.[008..012)"
;* V27 tmp27        [V27,T15] (  0,  0   )   float  ->  zero-ref    single-def "V11.[047..051)"
;* V28 tmp28        [V28    ] (  0,  0   )   ubyte  ->  zero-ref    single-def "V12.[003..004)"
;* V29 tmp29        [V29,T16] (  0,  0   )   float  ->  zero-ref    single-def "V12.[008..012)"
;* V30 tmp30        [V30,T17] (  0,  0   )   float  ->  zero-ref    single-def "V12.[047..051)"
;  V31 tmp31        [V31,T01] (  5, 10   )   byref  ->   r5         single-def "Spilling address for field-by-field copy"
;  V32 tmp32        [V32,T02] (  5, 10   )   byref  ->   r5         single-def "Spilling address for field-by-field copy"
;  V33 tmp33        [V33,T03] (  3,  6   )     ref  ->   r2         single-def "arr expr"
;  V34 tmp34        [V34,T04] (  3,  6   )     ref  ->   r2         single-def "arr expr"
;* V35 cse0         [V35,T18] (  0,  0   )     int  ->  zero-ref    "CSE - aggressive"
;* V36 cse1         [V36,T19] (  0,  0   )     int  ->  zero-ref    "CSE - aggressive"
;  V37 cse2         [V37,T00] (  4,  4   )   float  ->  f17         "CSE - aggressive"
;  V38 cse3         [V38,T06] (  5,  5   )   float  ->  f16         "CSE - aggressive"
;  V39 cse4         [V39,T07] (  5,  5   )     int  ->   r4         "CSE - aggressive"
;  V40 cse5         [V40,T08] (  5,  5   )     int  ->   r4         "CSE - aggressive"
;
; Lcl frame size = 160

G_M27028_IG01:  ;; offset=0x0000
000000      push    {r4,r5,r6,r10,r11,lr}
000004      vpush   {d8-d8}
000008      sub     sp, 160
00000A      add     r11, sp, 184
                                                ;; size=14 bbWeight=1 PerfScore 4.00
G_M27028_IG02:  ;; offset=0x000E
00000E      movw    r2, 0xcc1
000012      movt    r2, 0xefff
000016      ldr     r2, [r2]
000018      and     r2, r2, 1
00001C      cmp     r2, 1
00001E      bne     G_M27028_IG10
                                                ;; size=20 bbWeight=1 PerfScore 6.00
G_M27028_IG03:  ;; offset=0x0022
000022      movw    r4, 0x1e70
000026      movt    r4, 0xeee0
00002A      ldr     r2, [r4]
00002C      movs    r1, 100
00002E      ldr     r0, [r2+0x04]
000030      cmp     r1, r0
000032      bhs     G_M27028_IG12
000036      movw    r1, 0x1458
00003A      adds    r5, r2, r1
00003C      movs    r1, 0
00003E      mov     r0, r5
000040      movs    r2, 52
000042      movw    r12, 0x38c9
000046      movt    r12, 0xf2a3
00004A      blx     r12         // CORINFO_HELP_MEMSET
00004C      movs    r2, 0
00004E      strb    r2, [r5+0x03]
000050      movw    r2, 0x00
000054      movt    r2, 0x42c8
000058      vmov.i2f s16, r2
00005C      vstr    s16, [r5+0x08]
000060      add     r2, r5, 47
000064      movs    r1, 0
000066      vmov.i2f s17, r1
00006A      vmov.f2i r1, s17
00006E      str     r1, [r2]
000070      ldr     r2, [r4+0x04]
000072      movs    r1, 100
000074      ldr     r0, [r2+0x04]
000076      cmp     r1, r0
000078      bhs     G_M27028_IG12
00007C      movw    r1, 0x1458
000080      adds    r5, r2, r1
000082      movs    r1, 0
000084      mov     r0, r5
000086      movs    r2, 52
000088      movw    r12, 0x38c9
00008C      movt    r12, 0xf2a3
000090      blx     r12         // CORINFO_HELP_MEMSET
000092      movs    r2, 0
000094      strb    r2, [r5+0x03]
000096      vstr    s17, [r5+0x08]
00009A      add     r2, r5, 47
00009E      vmov.f2i r1, s17
0000A2      str     r1, [r2]
0000A4      movs    r1, 0
0000A6      add     r0, sp, 108
0000A8      movs    r2, 52
0000AA      movw    r12, 0x38c9
0000AE      movt    r12, 0xf2a3
0000B2      blx     r12         // CORINFO_HELP_MEMSET
0000B4      ldr     r0, [r4+0x08]
0000B6      vstr    s16, [sp+0x74]
0000BA      ldr     r1, [sp+0x6C]
0000BC      str     r1, [sp]
0000BE      ldr     r1, [sp+0x70]
0000C0      str     r1, [sp+0x04]
0000C2      ldr     r1, [sp+0x74]
0000C4      str     r1, [sp+0x08]
0000C6      ldr     r1, [sp+0x78]
0000C8      str     r1, [sp+0x0C]
0000CA      ldr     r1, [sp+0x7C]
0000CC      str     r1, [sp+0x10]
0000CE      ldr     r1, [sp+0x80]
0000D0      str     r1, [sp+0x14]
0000D2      ldr     r1, [sp+0x84]
0000D4      str     r1, [sp+0x18]
0000D6      ldr     r1, [sp+0x88]
0000D8      str     r1, [sp+0x1C]
0000DA      ldr     r1, [sp+0x8C]
0000DC      str     r1, [sp+0x20]
0000DE      ldr     r1, [sp+0x90]
0000E0      str     r1, [sp+0x24]
0000E2      ldr     r1, [sp+0x94]
0000E4      str     r1, [sp+0x28]
0000E6      ldr     r1, [sp+0x98]
0000E8      str     r1, [sp+0x2C]
0000EA      ldr     r1, [sp+0x9C]
0000EC      str     r1, [sp+0x30]
0000EE      movs    r1, 0
0000F0      movs    r2, 99
0000F2      movs    r3, 1
0000F4      movw    lr, 0x3bad
0000F8      movt    lr, 0xec5e
0000FC      blx     lr          // AA[,,]:Set(int,int,int,AA):this
0000FE      movs    r1, 0
000100      add     r0, sp, 56
000102      movs    r2, 52
000104      movw    r12, 0x38c9
000108      movt    r12, 0xf2a3
00010C      blx     r12         // CORINFO_HELP_MEMSET
00010E      ldr     r0, [r4+0x0C]
000110      ldr     r1, [sp+0x38]
000112      str     r1, [sp]
000114      ldr     r1, [sp+0x3C]
000116      str     r1, [sp+0x04]
000118      ldr     r1, [sp+0x40]
00011A      str     r1, [sp+0x08]
00011C      ldr     r1, [sp+0x44]
00011E      str     r1, [sp+0x0C]
000120      ldr     r1, [sp+0x48]
000122      str     r1, [sp+0x10]
000124      ldr     r1, [sp+0x4C]
000126      str     r1, [sp+0x14]
000128      ldr     r1, [sp+0x50]
00012A      str     r1, [sp+0x18]
00012C      ldr     r1, [sp+0x54]
00012E      str     r1, [sp+0x1C]
000130      ldr     r1, [sp+0x58]
000132      str     r1, [sp+0x20]
000134      ldr     r1, [sp+0x5C]
000136      str     r1, [sp+0x24]
000138      ldr     r1, [sp+0x60]
00013A      str     r1, [sp+0x28]
00013C      ldr     r1, [sp+0x64]
00013E      str     r1, [sp+0x2C]
000140      ldr     r1, [sp+0x68]
000142      str     r1, [sp+0x30]
000144      movs    r1, 0
000146      movs    r2, 99
000148      movs    r3, 1
00014A      movw    lr, 0x3bad
00014E      movt    lr, 0xec5e
000152      blx     lr          // AA[,,]:Set(int,int,int,AA):this
000154      movw    r4, 0xb1d8
000158      movt    r4, 0xe9ae
00015C      movs    r1, 0
00015E      mov     r0, r4
000160      movs    r2, 52
000162      movw    r12, 0x38c9
000166      movt    r12, 0xf2a3
00016A      blx     r12         // CORINFO_HELP_MEMSET
00016C      movs    r2, 0
00016E      movw    r1, 0xb1db
000172      movt    r1, 0xe9ae
000176      strb    r2, [r1]
000178      movw    r2, 0xb1e0
00017C      movt    r2, 0xe9ae
000180      vstr    s16, [r2]
000184      movs    r2, 0
000186      movw    r1, 0xb207
00018A      movt    r1, 0xe9ae
00018E      str     r2, [r1]
000190      add     r0, r4, 60
000194      movs    r1, 0
000196      movs    r2, 52
000198      movw    r12, 0x38c9
00019C      movt    r12, 0xf2a3
0001A0      blx     r12         // CORINFO_HELP_MEMSET
0001A2      movs    r2, 0
0001A4      movw    r1, 0xb217
0001A8      movt    r1, 0xe9ae
0001AC      strb    r2, [r1]
                                                ;; size=396 bbWeight=1 PerfScore 153.00
G_M27028_IG04:  ;; offset=0x01AE
0001AE      movw    r1, 0xb21c
0001B2      movt    r1, 0xe9ae
0001B6      str     r2, [r1]
                                                ;; size=10 bbWeight=1 PerfScore 3.00
G_M27028_IG05:  ;; offset=0x01B8
0001B8      movw    r1, 0xb243
0001BC      movt    r1, 0xe9ae
0001C0      str     r2, [r1]
0001C2      movw    r2, 0xcc2
0001C6      movt    r2, 0xefff
0001CA      ldr     r2, [r2]
0001CC      and     r2, r2, 1
0001D0      cmp     r2, 1
0001D2      bne     SHORT G_M27028_IG11
                                                ;; size=28 bbWeight=1 PerfScore 9.00
G_M27028_IG06:  ;; offset=0x01D4
0001D4      add     r0, r4, 120
0001D8      movs    r1, 0
0001DA      movs    r2, 52
0001DC      movw    r12, 0x38c9
0001E0      movt    r12, 0xf2a3
0001E4      blx     r12         // CORINFO_HELP_MEMSET
0001E6      movs    r2, 0
0001E8      movw    r1, 0xb253
0001EC      movt    r1, 0xe9ae
0001F0      strb    r2, [r1]
0001F2      movw    r2, 0xb258
0001F6      movt    r2, 0xe9ae
0001FA      vstr    s16, [r2]
0001FE      movs    r2, 0
000200      movw    r1, 0xb27f
000204      movt    r1, 0xe9ae
000208      str     r2, [r1]
00020A      add     r0, r4, 180
00020E      movs    r1, 0
000210      movs    r2, 52
000212      movw    r12, 0x38c9
000216      movt    r12, 0xf2a3
00021A      blx     r12         // CORINFO_HELP_MEMSET
00021C      movs    r0, 0
00021E      movw    r1, 0xb28f
000222      movt    r1, 0xe9ae
000226      strb    r0, [r1]
                                                ;; size=84 bbWeight=1 PerfScore 27.00
G_M27028_IG07:  ;; offset=0x0228
000228      movw    r1, 0xb294
00022C      movt    r1, 0xe9ae
000230      str     r0, [r1]
                                                ;; size=10 bbWeight=1 PerfScore 3.00
G_M27028_IG08:  ;; offset=0x0232
000232      movw    r1, 0xb2bb
000236      movt    r1, 0xe9ae
00023A      str     r0, [r1]
                                                ;; size=10 bbWeight=1 PerfScore 3.00
G_M27028_IG09:  ;; offset=0x023C
00023C      add     sp, 160
00023E      vpop    {d8-d8}
000242      pop     {r4,r5,r6,r10,r11,pc}
                                                ;; size=10 bbWeight=1 PerfScore 3.00
G_M27028_IG10:  ;; offset=0x0246
000246      movw    r0, 0xca8
00024A      movt    r0, 0xefff
00024E      movs    r1, 1
000250      movw    r3, 0x324b
000254      movt    r3, 0xf2a3
000258      blx     r3          // CORINFO_HELP_GETSHARED_NONGCSTATIC_BASE
00025A      b       SHORT G_M27028_IG03
                                                ;; size=22 bbWeight=0 PerfScore 0.00
G_M27028_IG11:  ;; offset=0x025C
00025C      movw    r0, 0xca8
000260      movt    r0, 0xefff
000264      movs    r1, 2
000266      movw    r3, 0x324b
00026A      movt    r3, 0xf2a3
00026E      blx     r3          // CORINFO_HELP_GETSHARED_NONGCSTATIC_BASE
000270      b       SHORT G_M27028_IG06
                                                ;; size=22 bbWeight=0 PerfScore 0.00
G_M27028_IG12:  ;; offset=0x0272
000272      movw    r3, 0x2135
000276      movt    r3, 0xf291
00027A      blx     r3          // CORINFO_HELP_RNGCHKFAIL
00027C      bkpt    
                                                ;; size=12 bbWeight=0 PerfScore 0.00

; Total bytes of code 638, prolog size 14, PerfScore 274.80, instruction count 229, allocated bytes for code 638 (MethodHash=b512966b) for method AA:reset() (FullOpts)
; ============================================================

Stress Mode 30e

; Assembly listing for method AA:reset() (FullOpts)
; Emitting BLENDED_CODE for generic ARM - Unix
; FullOpts code
; optimized code
; r11 based frame
; partially interruptible
; No PGO data
; 0 inlinees with PGO data; 8 single block inlinees; 0 inlinees without PGO data
; Final local variable assignments
;
;  V00 tmp0         [V00,T12] (  1,  1   )     int  ->  [sp+0xA0]  do-not-enreg[V] "GSCookie dummy"
;  V01 OutArgs      [V01    ] (  1,  1   )  struct (52) [sp+0x00]  do-not-enreg[XS] addr-exposed "OutgoingArgSpace"
;* V02 tmp2         [V02    ] (  0,  0   )  struct (52) zero-ref    do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;* V03 tmp3         [V03    ] (  0,  0   )     ref  ->  zero-ref    class-hnd exact "impAppendStmt" <AA[]>
;* V04 tmp4         [V04    ] (  0,  0   )  struct (52) zero-ref    do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;* V05 tmp5         [V05    ] (  0,  0   )     ref  ->  zero-ref    class-hnd exact "impAppendStmt" <AA[]>
;  V06 tmp6         [V06,T05] (  3,  6   )  struct (52) [sp+0x6C]  do-not-enreg[SF] ld-addr-op ptr "NewObj constructor temp" <AA>
;  V07 tmp7         [V07,T09] (  2,  4   )     ref  ->   r0         class-hnd exact single-def "impAppendStmt" <AA[,,]>
;  V08 tmp8         [V08,T11] (  2,  4   )  struct (52) [sp+0x38]  do-not-enreg[SF] ld-addr-op ptr "NewObj constructor temp" <AA>
;  V09 tmp9         [V09,T10] (  2,  4   )     ref  ->   r0         class-hnd exact single-def "impAppendStmt" <AA[,,]>
;* V10 tmp10        [V10    ] (  0,  0   )  struct (52) zero-ref    do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;* V11 tmp11        [V11    ] (  0,  0   )  struct (52) zero-ref    do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;* V12 tmp12        [V12    ] (  0,  0   )  struct (52) zero-ref    do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;* V13 tmp13        [V13    ] (  0,  0   )  struct (52) zero-ref    do-not-enreg[SF] ld-addr-op "NewObj constructor temp" <AA>
;* V14 tmp14        [V14    ] (  0,  0   )   ubyte  ->  zero-ref    "V02.[003..004)"
;* V15 tmp15        [V15    ] (  0,  0   )   float  ->  zero-ref    "V02.[008..012)"
;* V16 tmp16        [V16    ] (  0,  0   )   float  ->  zero-ref    "V02.[047..051)"
;* V17 tmp17        [V17    ] (  0,  0   )   ubyte  ->  zero-ref    "V04.[003..004)"
;* V18 tmp18        [V18    ] (  0,  0   )   float  ->  zero-ref    "V04.[008..012)"
;* V19 tmp19        [V19    ] (  0,  0   )   float  ->  zero-ref    "V04.[047..051)"
;* V20 tmp20        [V20    ] (  0,  0   )   ubyte  ->  zero-ref    "V10.[003..004)"
;* V21 tmp21        [V21    ] (  0,  0   )   float  ->  zero-ref    "V10.[008..012)"
;* V22 tmp22        [V22    ] (  0,  0   )   float  ->  zero-ref    "V10.[047..051)"
;* V23 tmp23        [V23    ] (  0,  0   )   ubyte  ->  zero-ref    "V11.[003..004)"
;* V24 tmp24        [V24    ] (  0,  0   )   float  ->  zero-ref    "V11.[008..012)"
;* V25 tmp25        [V25    ] (  0,  0   )   float  ->  zero-ref    "V11.[047..051)"
;* V26 tmp26        [V26    ] (  0,  0   )   ubyte  ->  zero-ref    "V12.[003..004)"
;* V27 tmp27        [V27    ] (  0,  0   )   float  ->  zero-ref    "V12.[008..012)"
;* V28 tmp28        [V28    ] (  0,  0   )   float  ->  zero-ref    "V12.[047..051)"
;* V29 tmp29        [V29    ] (  0,  0   )   ubyte  ->  zero-ref    "V13.[003..004)"
;* V30 tmp30        [V30    ] (  0,  0   )   float  ->  zero-ref    "V13.[008..012)"
;* V31 tmp31        [V31    ] (  0,  0   )   float  ->  zero-ref    "V13.[047..051)"
;  V32 tmp32        [V32,T01] (  5, 10   )   byref  ->   r5         single-def "Spilling address for field-by-field copy"
;  V33 tmp33        [V33,T02] (  5, 10   )   byref  ->   r5         single-def "Spilling address for field-by-field copy"
;  V34 tmp34        [V34,T03] (  3,  6   )     ref  ->   r2         single-def "arr expr"
;  V35 tmp35        [V35,T04] (  3,  6   )     ref  ->   r2         single-def "arr expr"
;  V36 GsCookie     [V36    ] (  1,  1   )     int  ->  [sp+0xA4]  do-not-enreg[X] addr-exposed "GSSecurityCookie"
;  V37 cse0         [V37,T00] ( 10, 10   )   float  ->  f17         "CSE - aggressive"
;  V38 cse1         [V38,T06] (  5,  5   )   float  ->  f16         "CSE - aggressive"
;  V39 cse2         [V39,T07] (  5,  5   )     int  ->   r4         "CSE - aggressive"
;  V40 cse3         [V40,T08] (  5,  5   )     int  ->   r4         "CSE - aggressive"
;
; Lcl frame size = 168

G_M27028_IG01:  ;; offset=0x0000
000000      push    {r4,r5,r6,r10,r11,lr}
000004      vpush   {d8-d8}
000008      sub     sp, 168
00000A      add     r11, sp, 192
00000E      movw    r0, 0x5678
000012      movt    r0, 0x1234
000016      str     r0, [sp+0xA4]
                                                ;; size=24 bbWeight=1 PerfScore 7.00
G_M27028_IG02:  ;; offset=0x0018
000018      movw    r4, 0x1e70
00001C      movt    r4, 0xf110
000020      ldr     r2, [r4]
000022      movs    r1, 100
000024      ldr     r0, [r2+0x04]
000026      cmp     r1, r0
000028      bhs     G_M27028_IG04
00002C      movw    r1, 0x1458
000030      adds    r5, r2, r1
000032      movs    r1, 0
000034      mov     r0, r5
000036      movs    r2, 52
000038      movw    r12, 0x88c9
00003C      movt    r12, 0xf4cb
000040      blx     r12         // CORINFO_HELP_MEMSET
000042      movs    r2, 0
000044      strb    r2, [r5+0x03]
000046      movw    r2, 0x00
00004A      movt    r2, 0x42c8
00004E      vmov.i2f s16, r2
000052      vstr    s16, [r5+0x08]
000056      add     r2, r5, 47
00005A      movs    r1, 0
00005C      vmov.i2f s17, r1
000060      vmov.f2i r1, s17
000064      str     r1, [r2]
000066      ldr     r2, [r4+0x04]
000068      movs    r1, 100
00006A      ldr     r0, [r2+0x04]
00006C      cmp     r1, r0
00006E      bhs     G_M27028_IG04
000072      movw    r1, 0x1458
000076      adds    r5, r2, r1
000078      movs    r1, 0
00007A      mov     r0, r5
00007C      movs    r2, 52
00007E      movw    r12, 0x88c9
000082      movt    r12, 0xf4cb
000086      blx     r12         // CORINFO_HELP_MEMSET
000088      movs    r2, 0
00008A      strb    r2, [r5+0x03]
00008C      vstr    s17, [r5+0x08]
000090      add     r2, r5, 47
000094      vmov.f2i r1, s17
000098      str     r1, [r2]
00009A      movs    r1, 0
00009C      add     r0, sp, 108
00009E      movs    r2, 52
0000A0      movw    r12, 0x88c9
0000A4      movt    r12, 0xf4cb
0000A8      blx     r12         // CORINFO_HELP_MEMSET
0000AA      ldr     r0, [r4+0x08]
0000AC      vstr    s16, [sp+0x74]
0000B0      ldr     r1, [sp+0x6C]
0000B2      str     r1, [sp]
0000B4      ldr     r1, [sp+0x70]
0000B6      str     r1, [sp+0x04]
0000B8      ldr     r1, [sp+0x74]
0000BA      str     r1, [sp+0x08]
0000BC      ldr     r1, [sp+0x78]
0000BE      str     r1, [sp+0x0C]
0000C0      ldr     r1, [sp+0x7C]
0000C2      str     r1, [sp+0x10]
0000C4      ldr     r1, [sp+0x80]
0000C6      str     r1, [sp+0x14]
0000C8      ldr     r1, [sp+0x84]
0000CA      str     r1, [sp+0x18]
0000CC      ldr     r1, [sp+0x88]
0000CE      str     r1, [sp+0x1C]
0000D0      ldr     r1, [sp+0x8C]
0000D2      str     r1, [sp+0x20]
0000D4      ldr     r1, [sp+0x90]
0000D6      str     r1, [sp+0x24]
0000D8      ldr     r1, [sp+0x94]
0000DA      str     r1, [sp+0x28]
0000DC      ldr     r1, [sp+0x98]
0000DE      str     r1, [sp+0x2C]
0000E0      ldr     r1, [sp+0x9C]
0000E2      str     r1, [sp+0x30]
0000E4      movs    r1, 0
0000E6      movs    r2, 99
0000E8      movs    r3, 1
0000EA      movw    lr, 0x3bad
0000EE      movt    lr, 0xee87
0000F2      blx     lr          // AA[,,]:Set(int,int,int,AA):this
0000F4      movs    r1, 0
0000F6      add     r0, sp, 56
0000F8      movs    r2, 52
0000FA      movw    r12, 0x88c9
0000FE      movt    r12, 0xf4cb
000102      blx     r12         // CORINFO_HELP_MEMSET
000104      ldr     r0, [r4+0x0C]
000106      ldr     r1, [sp+0x38]
000108      str     r1, [sp]
00010A      ldr     r1, [sp+0x3C]
00010C      str     r1, [sp+0x04]
00010E      ldr     r1, [sp+0x40]
000110      str     r1, [sp+0x08]
000112      ldr     r1, [sp+0x44]
000114      str     r1, [sp+0x0C]
000116      ldr     r1, [sp+0x48]
000118      str     r1, [sp+0x10]
00011A      ldr     r1, [sp+0x4C]
00011C      str     r1, [sp+0x14]
00011E      ldr     r1, [sp+0x50]
000120      str     r1, [sp+0x18]
000122      ldr     r1, [sp+0x54]
000124      str     r1, [sp+0x1C]
000126      ldr     r1, [sp+0x58]
000128      str     r1, [sp+0x20]
00012A      ldr     r1, [sp+0x5C]
00012C      str     r1, [sp+0x24]
00012E      ldr     r1, [sp+0x60]
000130      str     r1, [sp+0x28]
000132      ldr     r1, [sp+0x64]
000134      str     r1, [sp+0x2C]
000136      ldr     r1, [sp+0x68]
000138      str     r1, [sp+0x30]
00013A      movs    r1, 0
00013C      movs    r2, 99
00013E      movs    r3, 1
000140      movw    lr, 0x3bad
000144      movt    lr, 0xee87
000148      blx     lr          // AA[,,]:Set(int,int,int,AA):this
00014A      movw    r4, 0xb1d8
00014E      movt    r4, 0xebde
000152      movs    r1, 0
000154      mov     r0, r4
000156      movs    r2, 52
000158      movw    r12, 0x88c9
00015C      movt    r12, 0xf4cb
000160      blx     r12         // CORINFO_HELP_MEMSET
000162      movs    r2, 0
000164      movw    r1, 0xb1db
000168      movt    r1, 0xebde
00016C      strb    r2, [r1]
00016E      movw    r2, 0xb1e0
000172      movt    r2, 0xebde
000176      vstr    s16, [r2]
00017A      movw    r2, 0xb207
00017E      movt    r2, 0xebde
000182      vstr    s17, [r2]
000186      add     r0, r4, 60
00018A      movs    r1, 0
00018C      movs    r2, 52
00018E      movw    r12, 0x88c9
000192      movt    r12, 0xf4cb
000196      blx     r12         // CORINFO_HELP_MEMSET
000198      movs    r2, 0
00019A      movw    r1, 0xb217
00019E      movt    r1, 0xebde
0001A2      strb    r2, [r1]
0001A4      movw    r2, 0xb21c
0001A8      movt    r2, 0xebde
0001AC      vstr    s17, [r2]
0001B0      movw    r2, 0xb243
0001B4      movt    r2, 0xebde
0001B8      vstr    s17, [r2]
0001BC      add     r0, r4, 120
0001C0      movs    r1, 0
0001C2      movs    r2, 52
0001C4      movw    r12, 0x88c9
0001C8      movt    r12, 0xf4cb
0001CC      blx     r12         // CORINFO_HELP_MEMSET
0001CE      movs    r2, 0
0001D0      movw    r1, 0xb253
0001D4      movt    r1, 0xebde
0001D8      strb    r2, [r1]
0001DA      movw    r2, 0xb258
0001DE      movt    r2, 0xebde
0001E2      vstr    s16, [r2]
0001E6      movw    r2, 0xb27f
0001EA      movt    r2, 0xebde
0001EE      vstr    s17, [r2]
0001F2      add     r0, r4, 180
0001F6      movs    r1, 0
0001F8      movs    r2, 52
0001FA      movw    r12, 0x88c9
0001FE      movt    r12, 0xf4cb
000202      blx     r12         // CORINFO_HELP_MEMSET
000204      movs    r3, 0
000206      movw    r2, 0xb28f
00020A      movt    r2, 0xebde
00020E      strb    r3, [r2]
000210      movw    r3, 0xb294
000214      movt    r3, 0xebde
000218      vstr    s17, [r3]
00021C      movw    r3, 0xb2bb
000220      movt    r3, 0xebde
000224      vstr    s17, [r3]
000228      movw    r12, 0x5678
00022C      movt    r12, 0x1234
000230      ldr     lr, [sp+0xA4]
000234      cmp     r12, lr
000236      beq     SHORT G_M27028_IG03
000238      movw    r12, 0x8cfd
00023C      movt    r12, 0xf4b9
000240      blx     r12         // CORINFO_HELP_FAIL_FAST
                                                ;; size=554 bbWeight=1 PerfScore 198.00
G_M27028_IG03:  ;; offset=0x0242
000242      add     sp, 168
000244      vpop    {d8-d8}
000248      pop     {r4,r5,r6,r10,r11,pc}
                                                ;; size=10 bbWeight=1 PerfScore 3.00
G_M27028_IG04:  ;; offset=0x024C
00024C      movw    r3, 0x7135
000250      movt    r3, 0xf4b9
000254      blx     r3          // CORINFO_HELP_RNGCHKFAIL
000256      bkpt    
                                                ;; size=12 bbWeight=0 PerfScore 0.00

; Total bytes of code 600, prolog size 24, PerfScore 268.00, instruction count 212, allocated bytes for code 600 (MethodHash=b512966b) for method AA:reset() (FullOpts)
; ============================================================

I see the GSCookie in the stress mode, don't know if that changes things.

[TIHan]

There are more vstr in the stressmode, so maybe that is where the problem is. vmov are the same.

[TIHan]

@dotnet/jit-contrib I may need some help with this. See my findings above.

[EgorBo]

@TIHan were you able to debug the exception with lldb/gdb/windbg? it should tell you exactly which instruction caused that. vstr indeed could be the one.

[jakobbotsch]

Note that the backend knows how to generate unaligned float reads (by generating them as integer loads instead), so the problem might be that GTF_IND_UNALIGNED was dropped/not set (it's usually set by morph). It looks like it could be physical promotion related given the number of promoted locals -- does setting DOTNET_JitEnablePhysicalPromotion=0 fix it?