Fix null `vnStore` dereference in `optAssertionProp_HWIntrinsic` by Copilot · Pull Request #134441 · dotnet/runtime

Copilot · 2026-09-22T17:41:50Z

Confirm the assertion-propagation precondition and build a clean baseline.
Guard the hardware-intrinsic optimization and add focused regression coverage.
Run targeted builds/tests, formatting, and code/security review.
Finalize the minimal fix. Resolves JIT: null vnStore dereference in optAssertionProp_HWIntrinsic during local assertion prop (arm64) #134435

Fixes JIT: null vnStore dereference in optAssertionProp_HWIntrinsic during local assertion prop (arm64) #134435

azure-pipelines · 2026-09-22T17:42:07Z

Azure Pipelines: Successfully started running 5 pipeline(s). 11 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-09-22T17:43:29Z

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/202c3ee7-28cd-4f3a-8f1b-8abc368ed682 Co-authored-by: EgorBo <523221+EgorBo@users.noreply.github.com>

EgorBo · 2026-09-22T18:05:07Z

@copilot fix the bug

Co-authored-by: EgorBo <523221+EgorBo@users.noreply.github.com>

Copilot · 2026-09-22T18:45:19Z

@copilot fix the bug

Fixed in ef7978d (comment tweak in 4ec109c).

optAssertionProp dispatched GT_HWINTRINSIC unconditionally, but optAssertionProp_HWIntrinsic reads comp->vnStore, which is still nullptr during local assertion prop in morph. Guarded with !optLocalAssertionProp, matching the neighbouring GT_ARR_LENGTH case, plus a precondition assert in the helper.

Reproduced on x64 rather than arm64 — for short/ushort base types without EVEX the importer leaves the node as NI_Vector_ExtractMostSignificantBits. With a temporary assert(comp->vnStore != nullptr) on a checked JIT:

Assertion failed 'comp->vnStore != nullptr' in 'Repro:Guarded(...)' during 'Morph - Global'

After the fix it's clean, and inverting the assert confirms the helper is still reached during the real Assertion prop phase — so the optimization itself is preserved. All 22 JIT/opt/InstructionCombining tests pass in default and DOTNET_EnableAVX512=0 configs.

I also audited the rest of that switch: every other helper already bails before touching vnStore during local AP, so GT_HWINTRINSIC was the only unguarded case.

I dropped the speculative test the previous session had added and did not add a regression test, per your standing preference — say the word if you'd like one.

Copilot

Copilot review overview

🔵 Needs a closer look

Add focused regression coverage for the local assertion-propagation case.

Review effort: Lite
Findings: None

What changed in this PR

Fixes a JIT null vnStore dereference by guarding hardware-intrinsic assertion propagation during local propagation.

Changes:

Adds a vnStore precondition assertion.
Skips the VN-dependent optimization during local assertion propagation.

File	Summary
`src/coreclr/jit/assertionprop.cpp`	Guards VN-dependent hardware-intrinsic handling; focused regression coverage is still needed.

EgorBo · 2026-09-22T19:20:22Z

PTAL @tannergooding @dotnet/jit-contrib a quick fix to unblock the perf team

EgorBo · 2026-09-22T22:32:45Z

/ba-g unrelated LA64 build failure

LoopedBard3 · 2026-09-22T22:52:14Z

Should this also be backported to release 11? I think we are currently using 11 feeds for opt so I will see if we can update to 12 to get this fix once it flows to VMR.

LoopedBard3 · 2026-09-23T06:17:25Z

After some more looking, I think this should also be backported to release/11.0 as the net12 feeds don't seem to have everything we will need before move optimization over yet, and based on last year, it was not until December that we did the first steps toward moving to running with net11's feeds.

LoopedBard3 · 2026-09-25T17:29:25Z

/backport to release/11.0

github-actions · 2026-09-25T17:29:34Z

Started backporting to release/11.0 (link to workflow run)

@LoopedBard3

…Intrinsic` (#134665) Backport of #134441 to release/11.0 /cc @LoopedBard3 @Copilot ## Customer Impact - [ ] Customer reported - [x] Found internally The JIT can crash while compiling SIMD `ExtractMostSignificantBits` operations because local assertion propagation invokes an optimization before its value-number store exists. This blocks Linux arm64 JIT PGO training for .NET 11, preventing collection of fresh profiles for the shipped arm64 JIT. The reported repro passes with the ordinary shipping JIT. See #134435. ## Regression - [x] Yes - [ ] No Introduced during .NET 11 development by #129688, which added the hardware-intrinsic assertion-propagation helper and its unguarded call during local assertion propagation. ## Testing In the original PR, the failure was reproduced with a Checked x64 JIT using a temporary `vnStore != nullptr` assertion, then verified fixed. All 22 `JIT/opt/InstructionCombining` tests passed with default settings and with `DOTNET_EnableAVX512=0`. Validation also confirmed that the optimization still runs during global assertion propagation. No dedicated regression test was added. The issue was missed because the PGO pipeline had been pinned to an SDK predating the regression, and the ordinary shipping JIT did not expose the crash. ## Risk Low. The change only adds a phase guard and a precondition assertion. It skips the value-number-dependent optimization during local assertion propagation, where value numbers are unavailable, matching the neighboring array-length case. Global assertion propagation and its optimization are unchanged. Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: EgorBo <523221+EgorBo@users.noreply.github.com>

Initial plan

308cfd0

Copilot AI assigned Copilot and EgorBo Sep 22, 2026

Copilot AI linked an issue Sep 22, 2026 that may be closed by this pull request

JIT: null vnStore dereference in optAssertionProp_HWIntrinsic during local assertion prop (arm64) #134435

Closed

Copilot started work on behalf of EgorBo September 22, 2026 17:42 View session

EgorBo added the area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI label Sep 22, 2026

Changes before error encountered

325b9f2

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/202c3ee7-28cd-4f3a-8f1b-8abc368ed682 Co-authored-by: EgorBo <523221+EgorBo@users.noreply.github.com>

Copilot stopped work on behalf of EgorBo due to an error September 22, 2026 18:00
Execution failed: CAPIError: 422 This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Acces...

Copilot AI requested a review from EgorBo September 22, 2026 18:00

Copilot started work on behalf of EgorBo September 22, 2026 18:05 View session

Copilot AI and others added 3 commits September 22, 2026 18:10

Revert speculative test; prepare minimal JIT fix

8f8a417

Co-authored-by: EgorBo <523221+EgorBo@users.noreply.github.com>

Skip optAssertionProp_HWIntrinsic during local assertion prop

ef7978d

Co-authored-by: EgorBo <523221+EgorBo@users.noreply.github.com>

Tighten precondition comment in optAssertionProp_HWIntrinsic

4ec109c

Co-authored-by: EgorBo <523221+EgorBo@users.noreply.github.com>

Copilot finished work on behalf of EgorBo September 22, 2026 18:46

EgorBo marked this pull request as ready for review September 22, 2026 19:07

Copilot AI lite review requested due to automatic review settings September 22, 2026 19:07

EgorBo changed the title ~~[WIP] Fix null vnStore dereference in optAssertionProp_HWIntrinsic~~ Fix null vnStore dereference in optAssertionProp_HWIntrinsic Sep 22, 2026

Copilot started reviewing on behalf of EgorBo September 22, 2026 19:08 View session

Copilot AI reviewed Sep 22, 2026

View reviewed changes

EgorBo requested a review from tannergooding September 22, 2026 19:20

tannergooding approved these changes Sep 22, 2026

View reviewed changes

build-analysis Bot mentioned this pull request Sep 22, 2026

slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883

Open

3 tasks

EgorBo enabled auto-merge (squash) September 22, 2026 22:32

EgorBo merged commit 39af7c7 into main Sep 22, 2026
134 of 139 checks passed

EgorBo deleted the copilot/fix-null-vnstore-dereference branch September 22, 2026 22:33

dotnet-maestro Bot mentioned this pull request Sep 23, 2026

[main] Source code updates from dotnet/runtime dotnet/dotnet#9662

Merged

dotnet-milestone-bot Bot added this to the 12.0-preview1 milestone Sep 23, 2026

github-actions Bot mentioned this pull request Sep 25, 2026

[release/11.0] Fix null vnStore dereference in optAssertionProp_HWIntrinsic #134665

Merged

2 of 4 tasks

Navigation Menu

Fix null `vnStore` dereference in `optAssertionProp_HWIntrinsic` - #134441

Fix null `vnStore` dereference in `optAssertionProp_HWIntrinsic`#134441
EgorBo merged 5 commits into
mainfrom
copilot/fix-null-vnstore-dereference

Copilot AI commented Sep 22, 2026 •

edited by EgorBo

Loading

Uh oh!

azure-pipelines Bot commented Sep 22, 2026 •

edited

Loading

Uh oh!

dotnet-policy-service Bot commented Sep 22, 2026

Uh oh!

EgorBo commented Sep 22, 2026

Uh oh!

Copilot AI commented Sep 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

EgorBo commented Sep 22, 2026

Uh oh!

EgorBo commented Sep 22, 2026

Uh oh!

Uh oh!

LoopedBard3 commented Sep 22, 2026

Uh oh!

LoopedBard3 commented Sep 23, 2026

Uh oh!

LoopedBard3 commented Sep 25, 2026

Uh oh!

github-actions Bot commented Sep 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

Copilot AI commented Sep 22, 2026 • edited by EgorBo Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

azure-pipelines Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dotnet-policy-service Bot commented Sep 22, 2026

Uh oh!

EgorBo commented Sep 22, 2026

Uh oh!

Copilot AI commented Sep 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

EgorBo commented Sep 22, 2026

Uh oh!

EgorBo commented Sep 22, 2026

Uh oh!

Uh oh!

LoopedBard3 commented Sep 22, 2026

Uh oh!

LoopedBard3 commented Sep 23, 2026

Uh oh!

LoopedBard3 commented Sep 25, 2026

Uh oh!

github-actions Bot commented Sep 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Sep 22, 2026 •

edited by EgorBo

Loading

azure-pipelines Bot commented Sep 22, 2026 •

edited

Loading