Mono LLVM-AOT: abcremoval.c crashes on valid IL that reads a maybe-unassigned local through a bounds check

Description

The Mono AOT compiler (mono-aot-cross, LLVM backend) crashes in the
array-bounds-check removal pass on a valid method. If a local is assigned on
only one arm of a branch, then later read through an array access (so the pass
runs), SSA leaves the PHI argument for the not-assigned edge at its sentinel
-1, and abcremoval indexes its per-vreg tables with that -1. The out-of-
bounds read yields a garbage relation type and trips g_assert_not_reached:

* Assertion: should not be reached at .../mono/mini/abcremoval.c:870

The process aborts with exit code 0xC0000409 (verified on a Windows x64 host).
It is fully deterministic — same assembly, same crash every run.

The IL is well-formed: with .locals init, reading a local that was not stored
on some path is defined behaviour (the local is null/zero), so the compiler must
accept it. Roslyn never emits such a read, which is why ordinary C# never hits
this — but IL rewriters do. This surfaced through a control-flow obfuscator
(opaque predicates around stores); a hand-written repro is below, no third-party
tool required.

Environment

.NET SDK 10.0.302, mono-aot-cross 10.0.10 (@Commit: f7d90799ce4ef09a0bb257852a57248d2a8fb8dd)
Runtime pack Microsoft.NETCore.App.Runtime.Mono.browser-wasm 10.0.10,
cross pack Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm 10.0.10
Host: Windows x64 (the pass is host-independent; the crash is in the AOT
front-end, before codegen)
Also reproduces on 10.0.9. Trigger is COMPILE_LLVM (see Root cause), so it is
specific to the LLVM AOT backend (e.g. browser-wasm), not the interpreter or
the classic JIT.

Minimal reproduction

AbcremRepro.il (56 lines, references only System.Runtime):

.assembly extern System.Runtime { .publickeytoken = (B0 3F 5F 7F 11 D5 0A 3A) .ver 10:0:0:0 }
.assembly AbcremRepro { .ver 1:0:0:0 }
.module AbcremRepro.dll

.class public sequential ansi sealed beforefieldinit Scope
       extends [System.Runtime]System.ValueType
{
  .field private int32 _dummy
  .method public hidebysig instance void Close() cil managed { .maxstack 8 ret }
}

.class public auto ansi sealed beforefieldinit Repro
       extends [System.Runtime]System.Object
{
  .method public hidebysig static int32 Crash(int32 len) cil managed
  {
    .maxstack 4
    .locals init (int32[] V_0, valuetype Scope V_1, int32 V_2)
    .try
    {
              ldarg.0
              newarr    [System.Runtime]System.Int32
              ldc.i4.7
              brtrue.s  ASTORE     // opaque predicate: always taken
              pop                  // dead arm: array dropped, V_0 left unassigned
    MID:      nop
              leave.s   AFTER
    ASTORE:   stloc.0
              br.s      MID
    }
    finally
    {
              ldloca.s  V_1
              ldc.i4.3
              brtrue.s  DISP       // opaque predicate: always taken
              pop
    EF:       endfinally
    DISP:     call      instance void Scope::Close()
              br.s      EF
    }
    AFTER:    ldc.i4.0
              stloc.2
              br.s      COND
    LOOP:     ldloc.0
              ldloc.2
              ldelem.i4            // bounds check on V_0 -> abcremoval evaluates it
              pop
              ldloc.2
              ldc.i4.1
              add
              stloc.2
    COND:     ldloc.2
              ldloc.0
              ldlen
              conv.i4
              blt.s     LOOP
              ldc.i4.0
              ret
  }
}

The equivalent C# (what an obfuscator transformed into the IL above), for
readers — do not expect Roslyn to reproduce it, it will not:

static int Crash(int len)
{
    int[] a;
    using (var scope = new Scope())   // a value-type/ref-struct dispose scope, e.g. Lock.Scope
        a = new int[len];
    int sum = 0;
    for (int i = 0; i < a.Length; i++) sum += a[i];
    return sum;
}

Steps (using the packs the wasm-tools workload installs, or the two nupkgs
from nuget.org):

:: 1. assemble the IL (ilasm from runtime.win-x64.Microsoft.NETCore.ILAsm 10.0.10)
ilasm.exe -dll -out:AbcremRepro.dll AbcremRepro.il

:: 2. AOT-compile it with the LLVM backend
set PACK=%ProgramFiles%\dotnet\packs\Microsoft.NETCore.App.Runtime.Mono.browser-wasm\10.0.10\runtimes\browser-wasm
set MONO_PATH=%PACK%\lib\net10.0;%PACK%\native
mono-aot-cross.exe --llvm "--aot=llvmonly,interp,asmonly,llvm-outfile=out.bc,temp-path=." AbcremRepro.dll

Actual result

Mono Ahead of Time compiler - compiling assembly ...\AbcremRepro.dll
AOTID ...
* Assertion: should not be reached at .../mono/mini/abcremoval.c:870

Process exits -1073740791 (0xC0000409). With -v (or MONO_VERBOSE_METHOD=Repro:Crash)
the same underlying fault surfaces one step earlier, in the verbose printer
(abcremoval.c:121), and the trace shows the sentinel directly:

Summarized variable 3: PHI (-1,65)
...
Evaluating variable 3 (target variable 3); Relation (EQ) with value PHI (-1,65)
Evaluating variable -1 (target variable 3); ... * Assertion: should not be reached

Expected result

The assembly AOT-compiles without error. This method is valid CIL — under
ECMA-335 .locals init zero-initialises the locals, so the ldloc V_0 on the
path where V_0 was not stored reads null and is well-defined. The pass only
runs under the LLVM backend (COMPILE_LLVM, see above), so the JIT and the
interpreter are unaffected; the bounds-check-removal pass must likewise handle an
SSA graph in which a value has an undefined incoming edge without indexing memory
with the -1 sentinel.

Root cause

The dead arm of each opaque predicate leaves a store unreached, so a local is
defined on one predecessor of a join and not on the other. Mono unlinks the
dead block from the block list but leaves it as a predecessor of the join (in
the attached trace the join block BB8 still has IN: BB18 BB16, while BB18
is absent from the printed DTREE). mono_ssa_compute initialises every PHI argument to the sentinel
-1 (ssa.c, "For debugging"), and mono_ssa_rename_vars fills in only the
edges it walks; the edge from the removed block keeps -1. So the array local
gets PHI(-1, …).

mono_perform_abc_removal (abcremoval.c) then evaluates the array variable of
the OP_BOUNDS_CHECK, follows the PHI to alternative -1, and calls
evaluate_relation_with_target_variable(area, -1, …), which reads
area->relations[-1] / area->contexts[-1] / area->statuses[-1]. The
out-of-bounds relations[-1].related_value.type is garbage and falls through
the switch to g_assert_not_reached() (line 870; the verbose printer hits the
identical default at line 121 first).

The pass is on because the LLVM backend forces it — mini.c:

if (COMPILE_LLVM (cfg))
    cfg->opt |= MONO_OPT_ABCREM;

so it also runs under the AOT no-opt argument, and --optimize=-abcrem /
-O=-abcrem are accepted but ignored. A guard in abcremoval against an
undefined (-1) PHI alternative — skip it, treat it as MONO_ANY — would fix
this the same way the JIT tolerates the shape.

Full verbose trace

MONO_VERBOSE_METHOD=Repro:Crash output of a 10.0.10 run: the IR after each pass, the dominator tree (BB18 missing while the join keeps it as a predecessor), and the abcrem evaluation reaching variable -1 before the assert.

Mono Ahead of Time compiler - compiling assembly C:\repro\AbcremRepro.dll
AOTID 80124163-6C95-C1AD-A17E-FE78338C4D56
converting llvm method int Repro:Crash (int)
created temp 0 (R1) of type System.Int32
creating vars
created temp 1 (R2) of type System.Int32
	return :  arg R1 <-
	arg [0]:  arg R2 <-
creating locals
	local [0]: created temp 2 (R3) of type System.Object
	local [1]: created temp 3 (R4) of type Scope
	local [2]: created temp 4 (R5) of type System.Int32
locals done
method to IR Repro:Crash (int)
created temp 5 (R6) of type System.Object
created temp 6 (R7) of type System.IntPtr
created temp 7 (R8) of type System.IntPtr
created temp 8 (R12) of type System.IntPtr
converting (in B5: stack: 0) IL_0000: ldarg.0   
converting (in B5: stack: 1) IL_0001: newarr    0x01000003
converting (in B5: stack: 1) IL_0006: ldc.i4.7  
converting (in B5: stack: 2) IL_0007: brtrue.s  IL_000d
1 item(s) on exit from B5
created temp 9 (R20) of type System.Object
storing 0 to temp 9
loading 0 from temp 9
converting (in B7: stack: 1) IL_0009: pop       
converting (in B9: stack: 0) IL_000a: nop       
converting (in B9: stack: 0) IL_000b: leave.s   IL_001e
loading 0 from temp 9
converting (in B6: stack: 1) IL_000d: stloc.0   
converting (in B6: stack: 0) IL_000e: br.s      IL_000a
converting (in B3: stack: 0) IL_0010: ldloca.s  1
converting (in B3: stack: 1) IL_0012: ldc.i4.3  
converting (in B3: stack: 2) IL_0013: brtrue.s  IL_0017
1 item(s) on exit from B3
created temp 10 (R29) of type System.IntPtr
storing 0 to temp 10
loading 0 from temp 10
converting (in B11: stack: 1) IL_0015: pop       
converting (in B12: stack: 0) IL_0016: endfinally
loading 0 from temp 10
converting (in B10: stack: 1) IL_0017: call      0x06000001
cmethod = void Scope:Close ()
converting (in B10: stack: 0) IL_001c: br.s      IL_0016
converting (in B8: stack: 0) IL_001e: ldc.i4.0  
converting (in B8: stack: 1) IL_001f: stloc.2   
converting (in B8: stack: 0) IL_0020: br.s      IL_002a
converting (in B14: stack: 0) IL_0022: ldloc.0   
converting (in B14: stack: 1) IL_0023: ldloc.2   
converting (in B14: stack: 2) IL_0024: ldelem.i4 
converting (in B14: stack: 1) IL_0025: pop       
converting (in B14: stack: 0) IL_0026: ldloc.2   
converting (in B14: stack: 1) IL_0027: ldc.i4.1  
converting (in B14: stack: 2) IL_0028: add       
converting (in B14: stack: 1) IL_0029: stloc.2   
converting (in B13: stack: 0) IL_002a: ldloc.2   
converting (in B13: stack: 1) IL_002b: ldloc.0   
converting (in B13: stack: 2) IL_002c: ldlen     
converting (in B13: stack: 2) IL_002d: conv.i4   
converting (in B13: stack: 2) IL_002e: blt.s     IL_0022
converting (in B15: stack: 0) IL_0030: ldc.i4.0  
converting (in B15: stack: 1) IL_0031: ret       
FIRST BB for 16 is BB_3
created temp 11 (R56) of type System.IntPtr
FIRST BB for 0 is BB_5
created temp 12 (R57) of type System.IntPtr
REGION BB0 IL_0000 ID_FFFFFFFF
REGION BB4 IL_0000 ID_FFFFFFFF
REGION BB5 IL_0007 ID_00000102
REGION BB7 IL_0009 ID_00000102
REGION BB9 IL_000b ID_00000102
REGION BB17 IL_000b ID_00000102
REGION BB16 IL_000b ID_00000102
REGION BB6 IL_000e ID_00000102
REGION BB3 IL_0013 ID_00000112
REGION BB11 IL_0015 ID_00000112
REGION BB12 IL_0016 ID_00000112
REGION BB10 IL_001c ID_00000112
REGION BB8 IL_0020 ID_FFFFFFFF
REGION BB14 IL_0029 ID_FFFFFFFF
REGION BB13 IL_002e ID_FFFFFFFF
REGION BB15 IL_0031 ID_FFFFFFFF
REGION BB1 IL_0000 ID_FFFFFFFF
AFTER METHOD-TO-IR 0: [IN: , OUT:  BB4(0) ]
AFTER METHOD-TO-IR 4: [IN:  BB0(0), OUT:  BB5(0) ]
 call R7 <- [mono_tls_get_lmf_addr_extern]
 ldaddr R10 <- R8
 load_membase R11 <- R7
 int_or_imm R11 <- R11 [2]
 store_membase_reg [R10] <- R11
 store_membase_reg [R7] <- R10
 ldaddr R13 <- R12
 aotconst R14 <-
 store_membase_reg [R13] <- R14
 ldaddr R15 <- R8
 storei4_membase_imm [R15 + 0xc] <-
 store_membase_reg [R15 + 0x28] <- R13
 iconst R3 <- [0]
 vzero R4 <-
 iconst R5 <- [0]
AFTER METHOD-TO-IR 5: [IN:  BB4(0), OUT:  BB6(0) BB7(0) ]
 ldaddr R16 <- R12
 storei4_membase_imm [R16 + 0x4] <-
 il_seq_point intr il: 0x0
 move R17 <- R2
 newarr R18 <- R17
 iconst R19 <- [7]
 move R20 <- R18
 icompare_imm R19 [0]
 int_bne_un [T:B6 F:B7]
AFTER METHOD-TO-IR 7: [IN:  BB5(0), OUT:  BB9(0) ]
 move R21 <- R20
 ldaddr R22 <- R12
 storei4_membase_imm [R22 + 0x4] <-
AFTER METHOD-TO-IR 9: [IN:  BB7(0) BB6(0), OUT:  BB3(0) BB16(0) BB17(0) ]
 ldaddr R23 <- R12
 storei4_membase_imm [R23 + 0x4] <-
 il_seq_point il: 0xa
 nop
 il_seq_point il: 0xb
 iconst R6 <- [0]
 call_handler [B3]
 compare_imm R6 [0]
 int_beq [T:B16 F:B17]
AFTER METHOD-TO-IR 17: [IN:  BB9(0), OUT:  BB16(0) ]
 voidcall [ves_icall_thread_finish_async_abort]
AFTER METHOD-TO-IR 16: [IN:  BB9(0) BB17(0), OUT:  BB8(0) ]
 br [B8]
AFTER METHOD-TO-IR 6: [IN:  BB5(0), OUT:  BB9(0) ]
 move R24 <- R20
 ldaddr R25 <- R12
 storei4_membase_imm [R25 + 0x4] <-
 move R3 <- R24
 il_seq_point il: 0xe
 br [B9]
AFTER METHOD-TO-IR 3: [IN:  BB2(0) BB9(0), OUT:  BB10(0) BB11(0) ]
 start_handler
 ldaddr R26 <- R12
 storei4_membase_imm [R26 + 0x4] <-
 il_seq_point il: 0x10
 ldaddr R27 <- R4
 iconst R28 <- [3]
 move R29 <- R27
 icompare_imm R28 [0]
 int_bne_un [T:B10 F:B11]
AFTER METHOD-TO-IR 11: [IN:  BB3(0), OUT:  BB12(0) ]
 move R30 <- R29
 ldaddr R31 <- R12
 storei4_membase_imm [R31 + 0x4] <-
AFTER METHOD-TO-IR 12: [IN:  BB11(0) BB10(0), OUT:  ]
 ldaddr R32 <- R12
 storei4_membase_imm [R32 + 0x4] <-
 il_seq_point il: 0x16
 endfinally
AFTER METHOD-TO-IR 10: [IN:  BB3(0), OUT:  BB12(0) ]
 move R33 <- R29
 ldaddr R34 <- R12
 storei4_membase_imm [R34 + 0x4] <-
 move R35 <- R33
 voidcall [void Scope:Close ()] [r0 <- R35]
 il_seq_point il: 0x1c, nonempty-stack
 il_seq_point il: 0x1c
 br [B12]
AFTER METHOD-TO-IR 8: [IN:  BB18(0) BB16(0), OUT:  BB13(0) ]
 ldaddr R36 <- R12
 storei4_membase_imm [R36 + 0x4] <-
 il_seq_point il: 0x1e
 iconst R37 <- [0]
 move R5 <- R37
 il_seq_point il: 0x20
 br [B13]
AFTER METHOD-TO-IR 14: [IN:  BB13(0), OUT:  BB13(0) ]
 ldaddr R38 <- R12
 storei4_membase_imm [R38 + 0x4] <-
 il_seq_point il: 0x22
 move R39 <- R3
 move R40 <- R5
 bounds_check R39 R40
 mul_imm R41 <- R40 [4]
 int_add R42 <- R39 R41
 int_add_imm R42 <- R42 [16]
 loadi4_membase R43 <- R42
 il_seq_point il: 0x26
 move R44 <- R5
 nop
 int_add_imm R46 <- R44 [1]
 move R5 <- R46
AFTER METHOD-TO-IR 13: [IN:  BB8(0) BB14(0), OUT:  BB14(0) BB15(0) ]
 ldaddr R47 <- R12
 storei4_membase_imm [R47 + 0x4] <-
 il_seq_point il: 0x2a
 move R48 <- R5
 move R49 <- R3
 ldlen R50 <- R49
 not_null R49
 move R51 <- R50
 icompare R48 R51
 int_blt [T:B14 F:B15]
AFTER METHOD-TO-IR 15: [IN:  BB13(0), OUT:  BB1(0) ]
 ldaddr R52 <- R12
 storei4_membase_imm [R52 + 0x4] <-
 il_seq_point il: 0x30
 iconst R53 <- [0]
 ldaddr R54 <- R8
 load_membase R55 <- R54
 int_xor_imm R55 <- R55 [2]
 store_membase_reg [R7] <- R55
 il_seq_point intr il: 0x31
 move R1 <- R53
 br [B1]
AFTER METHOD-TO-IR 1: [IN:  BB15(0), OUT:  ]
pessimize variables in bb 3.
pessimize variables in bb 11.
pessimize variables in bb 12.
pessimize variables in bb 10.
CCOPY/2: R17 -> R2
CCOPY/2: R24 -> R20
CCOPY/2: R39 -> R3
CCOPY/2: R40 -> R5
CCOPY/2: R40 -> R5
CCOPY/2: R39 -> R3
CCOPY/2: R44 -> R5
CCOPY/2: R49 -> R3
CCOPY/2: R49 -> R3
CCOPY/2: R48 -> R5
CCOPY/2: R51 -> R50

HANDLE-GLOBAL-VREGS BLOCK 0:

HANDLE-GLOBAL-VREGS BLOCK 4:
 call R7 <- [mono_tls_get_lmf_addr_extern]
 ldaddr R10 <- R8
 load_membase R11 <- R7
 int_or_imm R11 <- R11 [2]
 store_membase_reg [R10] <- R11
 store_membase_reg [R7] <- R10
 ldaddr R13 <- R12
 aotconst R14 <-
 store_membase_reg [R13] <- R14
 ldaddr R15 <- R8
 storei4_membase_imm [R15 + 0xc] <-
 store_membase_reg [R15 + 0x28] <- R13
 iconst R3 <- [0]
 vzero R4 <-
 iconst R5 <- [0]

HANDLE-GLOBAL-VREGS BLOCK 5:
 ldaddr R16 <- R12
 storei4_membase_imm [R16 + 0x4] <-
 il_seq_point intr il: 0x0
 move R17 <- R2
 newarr R18 <- R2
 iconst R19 <- [7]
 move R20 <- R18
 icompare_imm R19 [0]
 int_bne_un [T:B6 F:B7]

HANDLE-GLOBAL-VREGS BLOCK 7:
 move R21 <- R20
 ldaddr R22 <- R12
 storei4_membase_imm [R22 + 0x4] <-

HANDLE-GLOBAL-VREGS BLOCK 9:
 ldaddr R23 <- R12
 storei4_membase_imm [R23 + 0x4] <-
 il_seq_point il: 0xa
 il_seq_point il: 0xb
 iconst R6 <- [0]
 call_handler [B3]
 compare_imm R6 [0]
 int_beq [T:B16 F:B17]

HANDLE-GLOBAL-VREGS BLOCK 17:
 voidcall [ves_icall_thread_finish_async_abort]

HANDLE-GLOBAL-VREGS BLOCK 16:
 br [B8]

HANDLE-GLOBAL-VREGS BLOCK 6:
 move R24 <- R20
 ldaddr R25 <- R12
 storei4_membase_imm [R25 + 0x4] <-
 move R3 <- R20
 il_seq_point il: 0xe
 br [B9]

HANDLE-GLOBAL-VREGS BLOCK 3:
 start_handler
 ldaddr R26 <- R12
 storei4_membase_imm [R26 + 0x4] <-
 il_seq_point il: 0x10
 ldaddr R27 <- R4
 iconst R28 <- [3]
 ldaddr R29 <- R4
 icompare_imm R28 [0]
 int_bne_un [T:B10 F:B11]

HANDLE-GLOBAL-VREGS BLOCK 11:
 move R30 <- R29
 ldaddr R31 <- R12
 storei4_membase_imm [R31 + 0x4] <-

HANDLE-GLOBAL-VREGS BLOCK 12:
 ldaddr R32 <- R12
 storei4_membase_imm [R32 + 0x4] <-
 il_seq_point il: 0x16
 endfinally

HANDLE-GLOBAL-VREGS BLOCK 10:
 move R33 <- R29
 ldaddr R34 <- R12
 storei4_membase_imm [R34 + 0x4] <-
 move R35 <- R33
 voidcall [void Scope:Close ()] [r0 <- R35]
 il_seq_point il: 0x1c, nonempty-stack
 il_seq_point il: 0x1c
 br [B12]

HANDLE-GLOBAL-VREGS BLOCK 8:
 ldaddr R36 <- R12
 storei4_membase_imm [R36 + 0x4] <-
 il_seq_point il: 0x1e
 iconst R37 <- [0]
 iconst R5 <- [0]
 il_seq_point il: 0x20
 br [B13]

HANDLE-GLOBAL-VREGS BLOCK 14:
 ldaddr R38 <- R12
 storei4_membase_imm [R38 + 0x4] <-
 il_seq_point il: 0x22
 move R39 <- R3
 move R40 <- R5
 bounds_check R3 R5
 shl_imm R41 <- R5
 int_add R42 <- R3 R41
 int_add_imm R42 <- R42 [16]
 loadi4_membase R43 <- R42
 il_seq_point il: 0x26
 move R44 <- R5
 int_add_imm R46 <- R5 [1]
 move R5 <- R46

HANDLE-GLOBAL-VREGS BLOCK 13:
 ldaddr R47 <- R12
 storei4_membase_imm [R47 + 0x4] <-
 il_seq_point il: 0x2a
 move R48 <- R5
 move R49 <- R3
 ldlen R50 <- R3
 not_null R3
 move R51 <- R50
 icompare R5 R50
 int_blt [T:B14 F:B15]

HANDLE-GLOBAL-VREGS BLOCK 15:
 ldaddr R52 <- R12
 storei4_membase_imm [R52 + 0x4] <-
 il_seq_point il: 0x30
 iconst R53 <- [0]
 ldaddr R54 <- R8
 load_membase R55 <- R54
 int_xor_imm R55 <- R55 [2]
 store_membase_reg [R7] <- R55
 il_seq_point intr il: 0x31
 iconst R1 <- [0]
 br [B1]

HANDLE-GLOBAL-VREGS BLOCK 1:
 setret R1
	Reverse copyprop in BB14 on  move R5 <- R46
BEFORE ALIAS_ANALYSIS 0: [IN: , OUT:  BB4(0) ]
BEFORE ALIAS_ANALYSIS 4: [IN:  BB0(0), OUT:  BB5(0) ]
 call R7 <- [mono_tls_get_lmf_addr_extern]
 ldaddr R10 <- R8
 load_membase R11 <- R7
 int_or_imm R11 <- R11 [2]
 store_membase_reg [R10] <- R11
 store_membase_reg [R7] <- R10
 ldaddr R13 <- R12
 aotconst R14 <-
 store_membase_reg [R13] <- R14
 ldaddr R15 <- R8
 storei4_membase_imm [R15 + 0xc] <-
 store_membase_reg [R15 + 0x28] <- R13
 iconst R3 <- [0]
 vzero R4 <-
 iconst R5 <- [0]
BEFORE ALIAS_ANALYSIS 5: [IN:  BB4(0), OUT:  BB6(0) BB7(0) ]
 ldaddr R16 <- R12
 storei4_membase_imm [R16 + 0x4] <-
 il_seq_point intr il: 0x0
 newarr R18 <- R2
 iconst R19 <- [7]
 move R20 <- R18
 icompare_imm R19 [0]
 int_bne_un [T:B6 F:B7]
BEFORE ALIAS_ANALYSIS 7: [IN:  BB5(0), OUT:  BB9(0) ]
 ldaddr R22 <- R12
 storei4_membase_imm [R22 + 0x4] <-
BEFORE ALIAS_ANALYSIS 9: [IN:  BB7(0) BB6(0), OUT:  BB3(0) BB16(0) BB17(0) ]
 ldaddr R23 <- R12
 storei4_membase_imm [R23 + 0x4] <-
 il_seq_point il: 0xa
 il_seq_point il: 0xb
 iconst R6 <- [0]
 call_handler [B3]
 compare_imm R6 [0]
 int_beq [T:B16 F:B17]
BEFORE ALIAS_ANALYSIS 17: [IN:  BB9(0), OUT:  BB16(0) ]
 voidcall [ves_icall_thread_finish_async_abort]
BEFORE ALIAS_ANALYSIS 16: [IN:  BB9(0) BB17(0), OUT:  BB8(0) ]
 br [B8]
BEFORE ALIAS_ANALYSIS 6: [IN:  BB5(0), OUT:  BB9(0) ]
 ldaddr R25 <- R12
 storei4_membase_imm [R25 + 0x4] <-
 move R3 <- R20
 il_seq_point il: 0xe
 br [B9]
BEFORE ALIAS_ANALYSIS 3: [IN:  BB2(0) BB9(0), OUT:  BB10(0) BB11(0) ]
 start_handler
 ldaddr R26 <- R12
 storei4_membase_imm [R26 + 0x4] <-
 il_seq_point il: 0x10
 iconst R28 <- [3]
 ldaddr R29 <- R4
 icompare_imm R28 [0]
 int_bne_un [T:B10 F:B11]
BEFORE ALIAS_ANALYSIS 11: [IN:  BB3(0), OUT:  BB12(0) ]
 ldaddr R31 <- R12
 storei4_membase_imm [R31 + 0x4] <-
BEFORE ALIAS_ANALYSIS 12: [IN:  BB11(0) BB10(0), OUT:  ]
 ldaddr R32 <- R12
 storei4_membase_imm [R32 + 0x4] <-
 il_seq_point il: 0x16
 endfinally
BEFORE ALIAS_ANALYSIS 10: [IN:  BB3(0), OUT:  BB12(0) ]
 move R33 <- R29
 ldaddr R34 <- R12
 storei4_membase_imm [R34 + 0x4] <-
 move R35 <- R33
 voidcall [void Scope:Close ()] [r0 <- R35]
 il_seq_point il: 0x1c, nonempty-stack
 il_seq_point il: 0x1c
 br [B12]
BEFORE ALIAS_ANALYSIS 8: [IN:  BB18(0) BB16(0), OUT:  BB13(0) ]
 ldaddr R36 <- R12
 storei4_membase_imm [R36 + 0x4] <-
 il_seq_point il: 0x1e
 iconst R5 <- [0]
 il_seq_point il: 0x20
 br [B13]
BEFORE ALIAS_ANALYSIS 14: [IN:  BB13(0), OUT:  BB13(0) ]
 ldaddr R38 <- R12
 storei4_membase_imm [R38 + 0x4] <-
 il_seq_point il: 0x22
 bounds_check R3 R5
 shl_imm R41 <- R5
 int_add R42 <- R3 R41
 int_add_imm R42 <- R42 [16]
 loadi4_membase R43 <- R42
 il_seq_point il: 0x26
 int_add_imm R5 <- R5 [1]
BEFORE ALIAS_ANALYSIS 13: [IN:  BB8(0) BB14(0), OUT:  BB14(0) BB15(0) ]
 ldaddr R47 <- R12
 storei4_membase_imm [R47 + 0x4] <-
 il_seq_point il: 0x2a
 ldlen R50 <- R3
 not_null R3
 icompare R5 R50
 int_blt [T:B14 F:B15]
BEFORE ALIAS_ANALYSIS 15: [IN:  BB13(0), OUT:  BB1(0) ]
 ldaddr R52 <- R12
 storei4_membase_imm [R52 + 0x4] <-
 il_seq_point il: 0x30
 ldaddr R54 <- R8
 load_membase R55 <- R54
 int_xor_imm R55 <- R55 [2]
 store_membase_reg [R7] <- R55
 il_seq_point intr il: 0x31
 iconst R1 <- [0]
 br [B1]
BEFORE ALIAS_ANALYSIS 1: [IN:  BB15(0), OUT:  ]
 setret R1
Found address to volatile var, can't take it:  ldaddr R10 <- R8
Found address to volatile var, can't take it:  ldaddr R13 <- R12
Found address to volatile var, can't take it:  ldaddr R15 <- R8
Found address to volatile var, can't take it:  ldaddr R16 <- R12
Found address to volatile var, can't take it:  ldaddr R22 <- R12
Found address to volatile var, can't take it:  ldaddr R23 <- R12
Found address to volatile var, can't take it:  ldaddr R25 <- R12
Found address to volatile var, can't take it:  ldaddr R26 <- R12
New address:  ldaddr R29 <- R4
Found address to volatile var, can't take it:  ldaddr R31 <- R12
Found address to volatile var, can't take it:  ldaddr R32 <- R12
Found address to volatile var, can't take it:  ldaddr R34 <- R12
Found address to volatile var, can't take it:  ldaddr R36 <- R12
Found address to volatile var, can't take it:  ldaddr R38 <- R12
Found address to volatile var, can't take it:  ldaddr R47 <- R12
Found address to volatile var, can't take it:  ldaddr R52 <- R12
Found address to volatile var, can't take it:  ldaddr R54 <- R8
Killing : local R4 <-
Killing : local R8 <-
Killing : local R12 <-
Found op : ldaddr R10 <- R8
Restoring : local R8 <-
Found op : ldaddr R13 <- R12
Restoring : local R12 <-
Found op : ldaddr R15 <- R8
Found op : ldaddr R16 <- R12
Found op : ldaddr R22 <- R12
Found op : ldaddr R23 <- R12
Found op : ldaddr R25 <- R12
Found op : ldaddr R26 <- R12
Found op : ldaddr R29 <- R4
Restoring : local R4 <-
Found op : ldaddr R31 <- R12
Found op : ldaddr R32 <- R12
Found op : ldaddr R34 <- R12
Found op : ldaddr R36 <- R12
Found op : ldaddr R38 <- R12
Found op : ldaddr R47 <- R12
Found op : ldaddr R52 <- R12
Found op : ldaddr R54 <- R8
AFTER ALIAS_ANALYSIS 0: [IN: , OUT:  BB4(0) ]
AFTER ALIAS_ANALYSIS 4: [IN:  BB0(0), OUT:  BB5(0) ]
 call R7 <- [mono_tls_get_lmf_addr_extern]
 ldaddr R10 <- R8
 load_membase R11 <- R7
 int_or_imm R11 <- R11 [2]
 store_membase_reg [R10] <- R11
 store_membase_reg [R7] <- R10
 ldaddr R13 <- R12
 aotconst R14 <-
 store_membase_reg [R13] <- R14
 ldaddr R15 <- R8
 storei4_membase_imm [R15 + 0xc] <-
 store_membase_reg [R15 + 0x28] <- R13
 iconst R3 <- [0]
 vzero R4 <-
 iconst R5 <- [0]
AFTER ALIAS_ANALYSIS 5: [IN:  BB4(0), OUT:  BB6(0) BB7(0) ]
 ldaddr R16 <- R12
 storei4_membase_imm [R16 + 0x4] <-
 il_seq_point intr il: 0x0
 newarr R18 <- R2
 iconst R19 <- [7]
 move R20 <- R18
 icompare_imm R19 [0]
 int_bne_un [T:B6 F:B7]
AFTER ALIAS_ANALYSIS 7: [IN:  BB5(0), OUT:  BB9(0) ]
 ldaddr R22 <- R12
 storei4_membase_imm [R22 + 0x4] <-
AFTER ALIAS_ANALYSIS 9: [IN:  BB7(0) BB6(0), OUT:  BB3(0) BB16(0) BB17(0) ]
 ldaddr R23 <- R12
 storei4_membase_imm [R23 + 0x4] <-
 il_seq_point il: 0xa
 il_seq_point il: 0xb
 iconst R6 <- [0]
 call_handler [B3]
 compare_imm R6 [0]
 int_beq [T:B16 F:B17]
AFTER ALIAS_ANALYSIS 17: [IN:  BB9(0), OUT:  BB16(0) ]
 voidcall [ves_icall_thread_finish_async_abort]
AFTER ALIAS_ANALYSIS 16: [IN:  BB9(0) BB17(0), OUT:  BB8(0) ]
 br [B8]
AFTER ALIAS_ANALYSIS 6: [IN:  BB5(0), OUT:  BB9(0) ]
 ldaddr R25 <- R12
 storei4_membase_imm [R25 + 0x4] <-
 move R3 <- R20
 il_seq_point il: 0xe
 br [B9]
AFTER ALIAS_ANALYSIS 3: [IN:  BB2(0) BB9(0), OUT:  BB10(0) BB11(0) ]
 start_handler
 ldaddr R26 <- R12
 storei4_membase_imm [R26 + 0x4] <-
 il_seq_point il: 0x10
 iconst R28 <- [3]
 ldaddr R29 <- R4
 icompare_imm R28 [0]
 int_bne_un [T:B10 F:B11]
AFTER ALIAS_ANALYSIS 11: [IN:  BB3(0), OUT:  BB12(0) ]
 ldaddr R31 <- R12
 storei4_membase_imm [R31 + 0x4] <-
AFTER ALIAS_ANALYSIS 12: [IN:  BB11(0) BB10(0), OUT:  ]
 ldaddr R32 <- R12
 storei4_membase_imm [R32 + 0x4] <-
 il_seq_point il: 0x16
 endfinally
AFTER ALIAS_ANALYSIS 10: [IN:  BB3(0), OUT:  BB12(0) ]
 move R33 <- R29
 ldaddr R34 <- R12
 storei4_membase_imm [R34 + 0x4] <-
 move R35 <- R33
 voidcall [void Scope:Close ()] [r0 <- R35]
 il_seq_point il: 0x1c, nonempty-stack
 il_seq_point il: 0x1c
 br [B12]
AFTER ALIAS_ANALYSIS 8: [IN:  BB18(0) BB16(0), OUT:  BB13(0) ]
 ldaddr R36 <- R12
 storei4_membase_imm [R36 + 0x4] <-
 il_seq_point il: 0x1e
 iconst R5 <- [0]
 il_seq_point il: 0x20
 br [B13]
AFTER ALIAS_ANALYSIS 14: [IN:  BB13(0), OUT:  BB13(0) ]
 ldaddr R38 <- R12
 storei4_membase_imm [R38 + 0x4] <-
 il_seq_point il: 0x22
 bounds_check R3 R5
 shl_imm R41 <- R5
 int_add R42 <- R3 R41
 int_add_imm R42 <- R42 [16]
 loadi4_membase R43 <- R42
 il_seq_point il: 0x26
 int_add_imm R5 <- R5 [1]
AFTER ALIAS_ANALYSIS 13: [IN:  BB8(0) BB14(0), OUT:  BB14(0) BB15(0) ]
 ldaddr R47 <- R12
 storei4_membase_imm [R47 + 0x4] <-
 il_seq_point il: 0x2a
 ldlen R50 <- R3
 not_null R3
 icompare R5 R50
 int_blt [T:B14 F:B15]
AFTER ALIAS_ANALYSIS 15: [IN:  BB13(0), OUT:  BB1(0) ]
 ldaddr R52 <- R12
 storei4_membase_imm [R52 + 0x4] <-
 il_seq_point il: 0x30
 ldaddr R54 <- R8
 load_membase R55 <- R54
 int_xor_imm R55 <- R55 [2]
 store_membase_reg [R7] <- R55
 il_seq_point intr il: 0x31
 iconst R1 <- [0]
 br [B1]
AFTER ALIAS_ANALYSIS 1: [IN:  BB15(0), OUT:  ]
 setret R1
BB0 IN: 
BB4 IN: 0 
BB5 IN: 4 
BB6 IN: 5 
BB9 IN: 7 6 
BB3 IN: 2 9 
BB10 IN: 3 
BB12 IN: 11 10 
BB11 IN: 3 
BB16 IN: 9 17 
BB8 IN: 18 16 
BB13 IN: 8 14 
BB14 IN: 13 
BB15 IN: 13 
BB1 IN: 15 
BB17 IN: 9 
BB7 IN: 5 
DTREE Repro:Crash (int) 1
BB0(dfn=0) (IDOM=BB-1):  BB0
BB4(dfn=1) (IDOM=BB0):  BB0 BB4
BB5(dfn=2) (IDOM=BB4):  BB0 BB4 BB5
BB6(dfn=3) (IDOM=BB5):  BB0 BB4 BB5 BB6
BB9(dfn=4) (IDOM=BB5):  BB0 BB4 BB5 BB9
BB3(dfn=5) (IDOM=BB0):  BB0 BB3
BB10(dfn=6) (IDOM=BB3):  BB0 BB3 BB10
BB12(dfn=7) (IDOM=BB3):  BB0 BB3 BB12
BB11(dfn=8) (IDOM=BB3):  BB0 BB3 BB11
BB16(dfn=9) (IDOM=BB9):  BB0 BB4 BB5 BB9 BB16
BB8(dfn=10) (IDOM=BB0):  BB0 BB8
BB13(dfn=11) (IDOM=BB8):  BB0 BB8 BB13
BB14(dfn=12) (IDOM=BB13):  BB0 BB8 BB13 BB14
BB15(dfn=13) (IDOM=BB13):  BB0 BB8 BB13 BB15
BB1(dfn=14) (IDOM=BB15):  BB0 BB8 BB13 BB15 BB1
BB17(dfn=15) (IDOM=BB9):  BB0 BB4 BB5 BB9 BB17
BB7(dfn=16) (IDOM=BB5):  BB0 BB4 BB5 BB7
LOOP START 13
	BB13 1 00000277E9B23870
	BB14 1 0000000000000000

COMPUTE SSA 13 (R58-)


LIVENESS:
BLOCK BB0 (BB4, ):
GEN  BB0: {}
KILL BB0: {}
BLOCK BB4 (BB5, ):
	1  call R7 <- [mono_tls_get_lmf_addr_extern]
	KILL: R7(6)
	1  ldaddr R10 <- R8
	GEN: R8(7)
	1  load_membase R11 <- R7
	GEN: R7(6)
	1  int_or_imm R11 <- R11 [2]
	1  store_membase_reg [R10] <- R11
	1  store_membase_reg [R7] <- R10
	1  ldaddr R13 <- R12
	GEN: R12(8)
	1  aotconst R14 <-
	1  store_membase_reg [R13] <- R14
	1  ldaddr R15 <- R8
	GEN: R8(7)
	1  storei4_membase_imm [R15 + 0xc] <-
	1  store_membase_reg [R15 + 0x28] <- R13
	1  iconst R3 <- [0]
	KILL: R3(2)
	1  vzero R4 <-
	KILL: R4(3)
	1  iconst R5 <- [0]
	KILL: R5(4)
GEN  BB4: {7, 8}
KILL BB4: {2, 3, 4, 6}
BLOCK BB5 (BB6, BB7, ):
	1  ldaddr R16 <- R12
	GEN: R12(8)
	1  storei4_membase_imm [R16 + 0x4] <-
	1  il_seq_point intr il: 0x0
	1  newarr R18 <- R2
	GEN: R2(1)
	1  iconst R19 <- [7]
	1  move R20 <- R18
	KILL: R20(9)
	1  icompare_imm R19 [0]
	1  int_bne_un [T:B6 F:B7]
GEN  BB5: {1, 8}
KILL BB5: {9}
BLOCK BB6 (BB9, ):
	1  ldaddr R25 <- R12
	GEN: R12(8)
	1  storei4_membase_imm [R25 + 0x4] <-
	1  move R3 <- R20
	GEN: R20(9)
	KILL: R3(2)
	1  il_seq_point il: 0xe
	1  br [B9]
GEN  BB6: {8, 9}
KILL BB6: {2}
BLOCK BB9 (BB3, BB16, BB17, ):
	1  ldaddr R23 <- R12
	GEN: R12(8)
	1  storei4_membase_imm [R23 + 0x4] <-
	1  il_seq_point il: 0xa
	1  il_seq_point il: 0xb
	1  iconst R6 <- [0]
	KILL: R6(5)
	1  call_handler [B3]
	1  compare_imm R6 [0]
	GEN: R6(5)
	1  int_beq [T:B16 F:B17]
GEN  BB9: {8}
KILL BB9: {5}
BLOCK BB3 (BB10, BB11, ):
	1  start_handler
	1  ldaddr R26 <- R12
	GEN: R12(8)
	1  storei4_membase_imm [R26 + 0x4] <-
	1  il_seq_point il: 0x10
	1  iconst R28 <- [3]
	1  ldaddr R29 <- R4
	GEN: R4(3)
	KILL: R29(10)
	1  icompare_imm R28 [0]
	1  int_bne_un [T:B10 F:B11]
GEN  BB3: {3, 8}
KILL BB3: {10}
BLOCK BB10 (BB12, ):
	1  move R33 <- R29
	GEN: R29(10)
	1  ldaddr R34 <- R12
	GEN: R12(8)
	1  storei4_membase_imm [R34 + 0x4] <-
	1  move R35 <- R33
	1  voidcall [void Scope:Close ()] [r0 <- R35]
	1  il_seq_point il: 0x1c, nonempty-stack
	1  il_seq_point il: 0x1c
	1  br [B12]
GEN  BB10: {8, 10}
KILL BB10: {}
BLOCK BB12 ():
	1  ldaddr R32 <- R12
	GEN: R12(8)
	1  storei4_membase_imm [R32 + 0x4] <-
	1  il_seq_point il: 0x16
	1  endfinally
GEN  BB12: {8}
KILL BB12: {}
BLOCK BB11 (BB12, ):
	1  ldaddr R31 <- R12
	GEN: R12(8)
	1  storei4_membase_imm [R31 + 0x4] <-
GEN  BB11: {8}
KILL BB11: {}
BLOCK BB16 (BB8, ):
	1  br [B8]
GEN  BB16: {}
KILL BB16: {}
BLOCK BB8 (BB13, ):
	1  ldaddr R36 <- R12
	GEN: R12(8)
	1  storei4_membase_imm [R36 + 0x4] <-
	1  il_seq_point il: 0x1e
	1  iconst R5 <- [0]
	KILL: R5(4)
	1  il_seq_point il: 0x20
	1  br [B13]
GEN  BB8: {8}
KILL BB8: {4}
BLOCK BB13 (BB14, BB15, ):
	1  ldaddr R47 <- R12
	GEN: R12(8)
	1  storei4_membase_imm [R47 + 0x4] <-
	1  il_seq_point il: 0x2a
	1  ldlen R50 <- R3
	GEN: R3(2)
	1  not_null R3
	GEN: R3(2)
	1  icompare R5 R50
	GEN: R5(4)
	1  int_blt [T:B14 F:B15]
GEN  BB13: {2, 4, 8}
KILL BB13: {}
BLOCK BB14 (BB13, ):
	1  ldaddr R38 <- R12
	GEN: R12(8)
	1  storei4_membase_imm [R38 + 0x4] <-
	1  il_seq_point il: 0x22
	1  bounds_check R3 R5
	GEN: R3(2)
	GEN: R5(4)
	1  shl_imm R41 <- R5
	GEN: R5(4)
	1  int_add R42 <- R3 R41
	GEN: R3(2)
	1  int_add_imm R42 <- R42 [16]
	1  loadi4_membase R43 <- R42
	1  il_seq_point il: 0x26
	1  int_add_imm R5 <- R5 [1]
	GEN: R5(4)
	KILL: R5(4)
GEN  BB14: {2, 4, 8}
KILL BB14: {4}
BLOCK BB15 (BB1, ):
	1  ldaddr R52 <- R12
	GEN: R12(8)
	1  storei4_membase_imm [R52 + 0x4] <-
	1  il_seq_point il: 0x30
	1  ldaddr R54 <- R8
	GEN: R8(7)
	1  load_membase R55 <- R54
	1  int_xor_imm R55 <- R55 [2]
	1  store_membase_reg [R7] <- R55
	1  il_seq_point intr il: 0x31
	1  iconst R1 <- [0]
	KILL: R1(0)
	1  br [B1]
GEN  BB15: {6, 7, 8}
KILL BB15: {0}
BLOCK BB1 ():
	1  setret R1
	GEN: R1(0)
GEN  BB1: {0}
KILL BB1: {}
BLOCK BB17 (BB16, ):
	1  voidcall [ves_icall_thread_finish_async_abort]
GEN  BB17: {}
KILL BB17: {}
BLOCK BB7 (BB9, ):
	1  ldaddr R22 <- R12
	GEN: R12(8)
	1  storei4_membase_imm [R22 + 0x4] <-
GEN  BB7: {8}
KILL BB7: {}

ITERATION:
P: BB7(16): IN: BB5 OUT:BB9 
	LIVE IN  BB7: {8}
P: BB17(15): IN: BB9 OUT:BB16 
	LIVE IN  BB17: {}
P: BB1(14): IN: BB15 OUT:
P: BB15(13): IN: BB13 OUT:BB1 
	LIVE IN  BB15: {6, 7, 8}
P: BB14(12): IN: BB13 OUT:BB13 
	LIVE IN  BB14: {2, 4, 8}
P: BB13(11): IN: BB8 BB14 OUT:BB14 BB15 
	ADD: 14
	LIVE IN  BB13: {2, 4, 6, 7, 8}
P: BB14(12): IN: BB13 OUT:BB13 
	ADD: 13
	LIVE IN  BB14: {2, 4, 6, 7, 8}
P: BB13(11): IN: BB8 BB14 OUT:BB14 BB15 
	LIVE IN  BB13: {2, 4, 6, 7, 8}
P: BB8(10): IN: BB18 BB16 OUT:BB13 
	LIVE IN  BB8: {2, 6, 7, 8}
P: BB16(9): IN: BB9 BB17 OUT:BB8 
	ADD: 17
	LIVE IN  BB16: {2, 6, 7, 8}
P: BB17(15): IN: BB9 OUT:BB16 
	LIVE IN  BB17: {2, 6, 7, 8}
P: BB11(8): IN: BB3 OUT:BB12 
	LIVE IN  BB11: {8}
P: BB12(7): IN: BB11 BB10 OUT:
P: BB10(6): IN: BB3 OUT:BB12 
	LIVE IN  BB10: {8, 10}
P: BB3(5): IN: BB2 BB9 OUT:BB10 BB11 
	LIVE IN  BB3: {3, 8}
P: BB9(4): IN: BB7 BB6 OUT:BB3 BB16 BB17 
	ADD: 7
	LIVE IN  BB9: {2, 3, 6, 7, 8}
P: BB7(16): IN: BB5 OUT:BB9 
	LIVE IN  BB7: {2, 3, 6, 7, 8}
P: BB6(3): IN: BB5 OUT:BB9 
	LIVE IN  BB6: {3, 6, 7, 8, 9}
P: BB5(2): IN: BB4 OUT:BB6 BB7 
	LIVE IN  BB5: {1, 2, 3, 6, 7, 8}
P: BB4(1): IN: BB0 OUT:BB5 
	LIVE IN  BB4: {1, 7, 8}
P: BB0(0): IN: OUT:BB4 
	LIVE IN  BB0: {1, 7, 8}
IT: 17 19.
LIVE IN  BB7: {2, 3, 6, 7, 8}
LIVE OUT BB7: {2, 3, 6, 7, 8}
LIVE IN  BB17: {2, 6, 7, 8}
LIVE OUT BB17: {2, 6, 7, 8}
LIVE IN  BB1: {0}
LIVE OUT BB1: {}
LIVE IN  BB15: {6, 7, 8}
LIVE OUT BB15: {0}
LIVE IN  BB14: {2, 4, 6, 7, 8}
LIVE OUT BB14: {2, 4, 6, 7, 8}
LIVE IN  BB13: {2, 4, 6, 7, 8}
LIVE OUT BB13: {2, 4, 6, 7, 8}
LIVE IN  BB8: {2, 6, 7, 8}
LIVE OUT BB8: {2, 4, 6, 7, 8}
LIVE IN  BB16: {2, 6, 7, 8}
LIVE OUT BB16: {2, 6, 7, 8}
LIVE IN  BB11: {8}
LIVE OUT BB11: {8}
LIVE IN  BB12: {8}
LIVE OUT BB12: {}
LIVE IN  BB10: {8, 10}
LIVE OUT BB10: {8}
LIVE IN  BB3: {3, 8}
LIVE OUT BB3: {8, 10}
LIVE IN  BB9: {2, 3, 6, 7, 8}
LIVE OUT BB9: {2, 3, 6, 7, 8}
LIVE IN  BB6: {3, 6, 7, 8, 9}
LIVE OUT BB6: {2, 3, 6, 7, 8}
LIVE IN  BB5: {1, 2, 3, 6, 7, 8}
LIVE OUT BB5: {2, 3, 6, 7, 8, 9}
LIVE IN  BB4: {1, 7, 8}
LIVE OUT BB4: {1, 2, 3, 6, 7, 8}
LIVE IN  BB0: {1, 7, 8}
LIVE OUT BB0: {1, 7, 8}
V0: [0x0 - 0x380002]
V1: [0x0 - 0x80008]
V2: [0x4001b - 0x43ffff]
V3: [0x4001d - 0x43ffff]
V4: [0x4001f - 0x33ffff]
V5: [0x10000b - 0x10000e]
V6: [0x40003 - 0x43ffff]
V7: [0x0 - 0x43ffff]
V8: [0x0 - 0x43ffff]
V9: [0x8000d - 0xc0006]
V10: [0x14000d - 0x180002]
V11: [0xffffffff - 0x0]
V12: [0xffffffff - 0x0]
	R3 needs PHI functions in : BB9 BB3 BB8
	R5 needs PHI functions in : BB13

RENAME VARS BLOCK 0:

RENAME VARS BLOCK 8:
	Add PHI R5 <- R5 to BB13

RENAME VARS BLOCK 13:
created temp 13 (R58) of type System.Int32
  R5 -> R58

RENAME VARS BLOCK 15:
created temp 14 (R60) of type System.Int32
  R1 -> R60

RENAME VARS BLOCK 1:

RENAME VARS BLOCK 14:
created temp 15 (R62) of type System.Int32
  R5 -> R62
	Add PHI R58 <- R62 to BB13

RENAME VARS BLOCK 3:

RENAME VARS BLOCK 11:

RENAME VARS BLOCK 12:

RENAME VARS BLOCK 10:

RENAME VARS BLOCK 4:
created temp 16 (R64) of type System.Object
  R3 -> R64

RENAME VARS BLOCK 5:

RENAME VARS BLOCK 7:
	Add PHI R3 <- R64 to BB9

RENAME VARS BLOCK 9:
created temp 17 (R65) of type System.Object
  R3 -> R65

RENAME VARS BLOCK 17:

RENAME VARS BLOCK 16:
	Add PHI R3 <- R65 to BB8

RENAME VARS BLOCK 6:
created temp 18 (R66) of type System.Object
  R3 -> R66
	Add PHI R65 <- R66 to BB9

END COMPUTE SSA.

IR code for method Repro:Crash (int)

BB0 (0) (len: 0): 
	prev:		succ: BB4
	idom: BB-1
	dominators: BB0
	dfrontier:

BB4 (1) (len: 0): 
 call R7 <- [mono_tls_get_lmf_addr_extern]
 ldaddr R10 <- R8
 load_membase R11 <- R7
 int_or_imm R63 <- R11 [2]
 store_membase_reg [R10] <- R63
 store_membase_reg [R7] <- R10
 ldaddr R13 <- R12
 aotconst R14 <-
 store_membase_reg [R13] <- R14
 ldaddr R15 <- R8
 storei4_membase_imm [R15 + 0xc] <-
 store_membase_reg [R15 + 0x28] <- R13
 iconst R64 <- [0]
 vzero R4 <-
 nop
	prev: BB0		succ: BB5
	idom: BB0
	dominators: [BB0] BB4
	dfrontier: BB3 BB8

BB5 (2) (len: 9): 
 ldaddr R16 <- R12
 storei4_membase_imm [R16 + 0x4] <-
 il_seq_point intr il: 0x0
 newarr R18 <- R2
 iconst R19 <- [7]
 move R20 <- R18
 icompare_imm R19 [0]
 int_bne_un [T:B6 F:B7]
	prev: BB4		succ: BB6 BB7
	idom: BB4
	dominators: BB0 [BB4] BB5
	dfrontier: BB3 BB8

BB6 (3) (len: 3): 
 ldaddr R25 <- R12
 storei4_membase_imm [R25 + 0x4] <-
 move R66 <- R20
 il_seq_point il: 0xe
 br [B9]
	prev: BB5		succ: BB9
	idom: BB5
	dominators: BB0 BB4 [BB5] BB6
	dfrontier: BB9

BB9 (4) (len: 0): 
 phi R65 <- [2 (R64, R66)]
 ldaddr R23 <- R12
 storei4_membase_imm [R23 + 0x4] <-
 il_seq_point il: 0xa
 il_seq_point il: 0xb
 iconst R6 <- [0]
 call_handler [B3]
 compare_imm R6 [0]
 int_beq [T:B16 F:B17]
	prev: BB7 BB6		succ: BB3 BB16 BB17
	idom: BB5
	dominators: BB0 BB4 [BB5] BB9
	dfrontier: BB3 BB8

BB3 (5) (len: 5): 
 start_handler
 ldaddr R26 <- R12
 storei4_membase_imm [R26 + 0x4] <-
 il_seq_point il: 0x10
 iconst R28 <- [3]
 ldaddr R29 <- R4
 icompare_imm R28 [0]
 int_bne_un [T:B10 F:B11]
	prev: BB2 BB9		succ: BB10 BB11
	idom: BB0
	dominators: [BB0] BB3
	dfrontier:

BB10 (6) (len: 7): 
 move R33 <- R29
 ldaddr R34 <- R12
 storei4_membase_imm [R34 + 0x4] <-
 move R35 <- R33
 voidcall [void Scope:Close ()] [r0 <- R35]
 il_seq_point il: 0x1c, nonempty-stack
 il_seq_point il: 0x1c
 br [B12]
	prev: BB3		succ: BB12
	idom: BB3
	dominators: BB0 [BB3] BB10
	dfrontier: BB12

BB12 (7) (len: 1): 
 ldaddr R32 <- R12
 storei4_membase_imm [R32 + 0x4] <-
 il_seq_point il: 0x16
 endfinally
	prev: BB11 BB10		succ:
	idom: BB3
	dominators: BB0 [BB3] BB12
	dfrontier:

BB11 (8) (len: 0): 
 ldaddr R31 <- R12
 storei4_membase_imm [R31 + 0x4] <-
	prev: BB3		succ: BB12
	idom: BB3
	dominators: BB0 [BB3] BB11
	dfrontier: BB12

BB16 (9) (len: -312212883): 
 br [B8]
	prev: BB9 BB17		succ: BB8
	idom: BB9
	dominators: BB0 BB4 BB5 [BB9] BB16
	dfrontier: BB8

BB8 (10) (len: 4): 
 phi R3 <- [2 (R-1, R65)]
 ldaddr R36 <- R12
 storei4_membase_imm [R36 + 0x4] <-
 il_seq_point il: 0x1e
 iconst R5 <- [0]
 il_seq_point il: 0x20
 br [B13]
	prev: BB18 BB16		succ: BB13
	idom: BB0
	dominators: [BB0] BB8
	dfrontier:

BB13 (11) (len: 6): 
 phi R58 <- [4 (R5, R62)]
 ldaddr R47 <- R12
 storei4_membase_imm [R47 + 0x4] <-
 il_seq_point il: 0x2a
 ldlen R50 <- R3
 not_null R3
 icompare R58 R50
 int_blt [T:B14 F:B15]
	prev: BB8 BB14		succ: BB14 BB15
	idom: BB8
	dominators: BB0 [BB8] BB13
	dfrontier: BB13

BB14 (12) (len: 0): 
 ldaddr R38 <- R12
 storei4_membase_imm [R38 + 0x4] <-
 il_seq_point il: 0x22
 bounds_check R3 R58
 shl_imm R41 <- R58
 int_add R42 <- R3 R41
 int_add_imm R61 <- R42 [16]
 loadi4_membase R43 <- R61
 il_seq_point il: 0x26
 int_add_imm R62 <- R58 [1]
	prev: BB13		succ: BB13
	idom: BB13
	dominators: BB0 BB8 [BB13] BB14
	dfrontier: BB13

BB15 (13) (len: 2): 
 ldaddr R52 <- R12
 storei4_membase_imm [R52 + 0x4] <-
 il_seq_point il: 0x30
 ldaddr R54 <- R8
 load_membase R55 <- R54
 int_xor_imm R59 <- R55 [2]
 store_membase_reg [R7] <- R59
 il_seq_point intr il: 0x31
 iconst R60 <- [0]
 br [B1]
	prev: BB13		succ: BB1
	idom: BB13
	dominators: BB0 BB8 [BB13] BB15
	dfrontier:

BB1 (14) (len: 0): 
 setret R60
	prev: BB15		succ:
	idom: BB15
	dominators: BB0 BB8 BB13 [BB15] BB1
	dfrontier:

BB17 (15) (len: 0): 
 voidcall [ves_icall_thread_finish_async_abort]
	prev: BB9		succ: BB16
	idom: BB9
	dominators: BB0 BB4 BB5 [BB9] BB17
	dfrontier: BB16

BB7 (16) (len: 0): 
 ldaddr R22 <- R12
 storei4_membase_imm [R22 + 0x4] <-
	prev: BB5		succ: BB9
	idom: BB5
	dominators: BB0 BB4 [BB5] BB7
	dfrontier: BB9


ABCREM BLOCK 0:

ABCREM BLOCK 4:
 call R7 <- [mono_tls_get_lmf_addr_extern]
Summarized variable 7: ANY
 ldaddr R10 <- R8
Summarized variable 10: CONSTANT -2147483648, not-null = 1
 load_membase R11 <- R7
Summarized variable 11: ANY
 int_or_imm R63 <- R11 [2]
Summarized variable 63: ANY
 ldaddr R13 <- R12
Summarized variable 13: CONSTANT -2147483648, not-null = 1
 aotconst R14 <-
Summarized variable 14: ANY
 ldaddr R15 <- R8
Summarized variable 15: CONSTANT -2147483648, not-null = 1
 iconst R64 <- [0]
Summarized variable 64: CONSTANT 0, not-null = 0
Global register 4 is not in the SSA form, skipping.

ABCREM BLOCK 5:
 ldaddr R16 <- R12
Summarized variable 16: CONSTANT -2147483648, not-null = 1
 newarr R18 <- R2
Summarized variable 18: VARIABLE 2, delta 0, not-null = 1
 iconst R19 <- [7]
Summarized variable 19: CONSTANT 7, not-null = 0
 move R20 <- R18
Summarized variable 20: VARIABLE 18, delta 0, not-null = 2

ABCREM BLOCK 7:
 ldaddr R22 <- R12
Summarized variable 22: CONSTANT -2147483648, not-null = 1

ABCREM BLOCK 9:
 phi R65 <- [2 (R64, R66)]
Summarized variable 65: PHI (64,66)
 ldaddr R23 <- R12
Summarized variable 23: CONSTANT -2147483648, not-null = 1
Global register 6 is not in the SSA form, skipping.

ABCREM BLOCK 17:

ABCREM BLOCK 16:

ABCREM BLOCK 6:
 ldaddr R25 <- R12
Summarized variable 25: CONSTANT -2147483648, not-null = 1
 move R66 <- R20
Summarized variable 66: VARIABLE 20, delta 0, not-null = 2

ABCREM BLOCK 3:
 ldaddr R26 <- R12
Summarized variable 26: CONSTANT -2147483648, not-null = 1
 iconst R28 <- [3]
Summarized variable 28: CONSTANT 3, not-null = 0
Global register 29 is not in the SSA form, skipping.

ABCREM BLOCK 11:
 ldaddr R31 <- R12
Summarized variable 31: CONSTANT -2147483648, not-null = 1

ABCREM BLOCK 12:
 ldaddr R32 <- R12
Summarized variable 32: CONSTANT -2147483648, not-null = 1

ABCREM BLOCK 10:
Global register 29 is not in the SSA form, skipping.
 ldaddr R34 <- R12
Summarized variable 34: CONSTANT -2147483648, not-null = 1
 move R35 <- R33
Summarized variable 35: VARIABLE 33, delta 0, not-null = 2

ABCREM BLOCK 8:
 phi R3 <- [2 (R-1, R65)]
Summarized variable 3: PHI (-1,65)
 ldaddr R36 <- R12
Summarized variable 36: CONSTANT -2147483648, not-null = 1
 iconst R5 <- [0]
Summarized variable 5: CONSTANT 0, not-null = 0

ABCREM BLOCK 14:
 ldaddr R38 <- R12
Summarized variable 38: CONSTANT -2147483648, not-null = 1
 shl_imm R41 <- R58
Summarized variable 41: ANY
 int_add R42 <- R3 R41
Summarized variable 42: ANY
 int_add_imm R61 <- R42 [16]
Summarized variable 61: VARIABLE 42, delta 16, not-null = 0
 loadi4_membase R43 <- R61
Summarized variable 43: ANY
 int_add_imm R62 <- R58 [1]
Summarized variable 62: VARIABLE 58, delta 1, not-null = 0

ABCREM BLOCK 13:
 phi R58 <- [4 (R5, R62)]
Summarized variable 58: PHI (5,62)
 ldaddr R47 <- R12
Summarized variable 47: CONSTANT -2147483648, not-null = 1
 ldlen R50 <- R3
[var50 >= 0]Summarized variable 50: VARIABLE 3, delta 0, not-null = 0

ABCREM BLOCK 15:
 ldaddr R52 <- R12
Summarized variable 52: CONSTANT -2147483648, not-null = 1
 ldaddr R54 <- R8
Summarized variable 54: CONSTANT -2147483648, not-null = 1
 load_membase R55 <- R54
Summarized variable 55: ANY
 int_xor_imm R59 <- R55 [2]
Summarized variable 59: ANY
 iconst R60 <- [0]
Summarized variable 60: CONSTANT 0, not-null = 0

ABCREM BLOCK 1:
Added symmetric summarized value for variable variable 18 (to 2): VARIABLE 18, delta 0, not-null = 0
Added symmetric summarized value for variable variable 20 (to 18): VARIABLE 20, delta 0, not-null = 2
Added symmetric summarized value for variable variable 35 (to 33): VARIABLE 35, delta 0, not-null = 2
Added symmetric summarized value for variable variable 50 (to 3): VARIABLE 50, delta 0, not-null = 0
Added symmetric summarized value for variable variable 61 (to 42): VARIABLE 61, delta -16, not-null = 0
Added symmetric summarized value for variable variable 62 (to 58): VARIABLE 62, delta -1, not-null = 0
Added symmetric summarized value for variable variable 66 (to 20): VARIABLE 66, delta 0, not-null = 2

ABCREM BLOCK/2 0 [dfn 0]...

ABCREM BLOCK/2 8 [dfn 10]...
 phi R3 <- [2 (R-1, R65)]
 ldaddr R36 <- R12
 storei4_membase_imm [R36 + 0x4] <-
 il_seq_point il: 0x1e
 iconst R5 <- [0]
 il_seq_point il: 0x20
 br [B13]

ABCREM BLOCK/2 13 [dfn 11]...
 phi R58 <- [4 (R5, R62)]
 ldaddr R47 <- R12
 storei4_membase_imm [R47 + 0x4] <-
 il_seq_point il: 0x2a
 ldlen R50 <- R3
 not_null R3
 icompare R58 R50
 int_blt [T:B14 F:B15]

ABCREM BLOCK/2 15 [dfn 13]...
Adding relation 1 on variable 58: Relation (EQ|GT) with value VARIABLE 50, delta 0, not-null = 0
Adding relation 2 on variable 50: Relation (LT|EQ) with value VARIABLE 58, delta 0, not-null = 0
 ldaddr R52 <- R12
 storei4_membase_imm [R52 + 0x4] <-
 il_seq_point il: 0x30
 ldaddr R54 <- R8
 load_membase R55 <- R54
 int_xor_imm R59 <- R55 [2]
 store_membase_reg [R7] <- R59
 il_seq_point intr il: 0x31
 iconst R60 <- [0]
 br [B1]

ABCREM BLOCK/2 1 [dfn 14]...
 setret R60

ABCREM BLOCK/2 14 [dfn 12]...
Adding relation 1 on variable 58: Relation (LT) with value VARIABLE 50, delta 0, not-null = 0
Adding relation 2 on variable 50: Relation (GT) with value VARIABLE 58, delta 0, not-null = 0
 ldaddr R38 <- R12
 storei4_membase_imm [R38 + 0x4] <-
 il_seq_point il: 0x22
 bounds_check R3 R58
Evaluating variable 58 (target variable 3); Relation (EQ) with value PHI (5,62)
Processing (58): Relation (EQ) with value PHI (5,62)
Evaluating variable 5 (target variable 3); Relation (EQ) with value CONSTANT 0, not-null = 0
Processing (5): Relation (EQ) with value CONSTANT 0, not-null = 0
Ranges for variable 5 (target variable 3) computed: (ranges: zero [0,0] (not-null = 0), variable [-2147483648,2147483647])
Evaluating variable 62 (target variable 3); Relation (EQ) with value VARIABLE 58, delta 1, not-null = 0
Processing (62): Relation (EQ) with value VARIABLE 58, delta 1, not-null = 0
Evaluation of variable 58 (target variable 3) already in progress
(EVALUATION_IN_PROGRESS)(ranges: zero [-2147483648,2147483647] (not-null = 0), variable [-2147483648,2147483647])
Relation (EQ) with value PHI (5,62)
Recursivity accepted ((RECURSIVELY_ASCENDING))
Recursivity detected for variable 62 (target variable 3), status (EVALUATION_IN_PROGRESS|RECURSIVELY_ASCENDING), ranges not computed
Recursivity for variable 62 (target variable 3) discards computation, status (EVALUATION_IN_PROGRESS|RECURSIVELY_ASCENDING)
Recursivity detected for variable 58 (target variable 3), status (EVALUATION_IN_PROGRESS|RECURSIVELY_ASCENDING)
Processing (58): Relation (EQ) with value VARIABLE 62, delta -1, not-null = 0
Evaluating variable 62 (target variable 3); Relation (EQ) with value VARIABLE 58, delta 1, not-null = 0
Processing (62): Relation (EQ) with value VARIABLE 58, delta 1, not-null = 0
Relation is a back-edge in this traversal, skipping
Ranges for variable 62 (target variable 3) computed: (ranges: zero [-2147483648,2147483647] (not-null = 0), variable [-2147483648,2147483647])
Processing (58): Relation (LT) with value VARIABLE 50, delta 0, not-null = 0
Evaluating variable 50 (target variable 3); Relation (EQ) with value VARIABLE 3, delta 0, not-null = 0
Processing (50): Relation (EQ) with value VARIABLE 3, delta 0, not-null = 0
Evaluating variable 3 (target variable 3); Relation (EQ) with value PHI (-1,65)
Target variable reached (3), continuing to evaluate relations with constants
Processing (3): Relation (EQ) with value PHI (-1,65)
Evaluating variable -1 (target variable 3); Relation (EQ) with value * Assertion: should not be reached at D:\a\_work\1\s\src\runtime\src\mono\mono\mini\abcremoval.c:121

@JulieLeeMSFT

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

@steveisok

Tagging subscribers to this area: @steveisok, @vitek-karas
See info in area-owners.md if you want to be subscribed.

@BrzVlad

@BrzVlad is this something worth fixing?

[mono][llvm] Properly link endfinally to leave targets (#133011)

Navigation Menu

Repository navigation

Mono LLVM-AOT: `abcremoval.c` crashes on valid IL that reads a maybe-unassigned local through a bounds check #132936

Description

Environment

Minimal reproduction

Actual result

Expected result

Root cause

Full verbose trace

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Mono LLVM-AOT: abcremoval.c crashes on valid IL that reads a maybe-unassigned local through a bounds check #132936

Description

Description

Environment

Minimal reproduction

Actual result

Expected result

Root cause

Full verbose trace

Activity

dotnet-policy-service commented on Aug 30, 2026

dotnet-policy-service commented on Aug 30, 2026

vitek-karas commented on Aug 31, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Mono LLVM-AOT: `abcremoval.c` crashes on valid IL that reads a maybe-unassigned local through a bounds check #132936