Skip to content

JIT: (bug) value numbering asserts when constant-folding 64-bit PopCount/LeadingZeroCount/TrailingZeroCount #133560

Closed

Description

@EgorBo

Repro

using System;
using System.Runtime.CompilerServices;

internal static class Program
{
    [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.AggressiveOptimization)]
    private static ulong TestPopCount(ulong y) => ulong.PopCount((y - y) + 256);

    [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.AggressiveOptimization)]
    private static ulong TestLeadingZeroCount(ulong y) => ulong.LeadingZeroCount((y - y) + 256);

    [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.AggressiveOptimization)]
    private static ulong TestTrailingZeroCount(ulong y) => ulong.TrailingZeroCount((y - y) + 256);

    private static void Main()
    {
        ulong y = (ulong)Environment.TickCount64;
        Console.WriteLine(TestPopCount(y));
        Console.WriteLine(TestLeadingZeroCount(y));
        Console.WriteLine(TestTrailingZeroCount(y));
    }
}

The importer already folds operands that are constant at import time, so the constant has
to appear later: y - y is folded to zero by value numbering itself, producing a ulong
constant at exactly the right moment.

Expected

1
55
8

Actual

Assert failure(PID 114088 [0x0001bda8], Thread: 109036 [0x1a9ec]): Assertion failed 'typ == TYP_INT' in 'Program:TestPopCount(ulong):ulong' during 'Do value numbering' (IL size 16; hash 0xd7ae60ea; FullOpts)

    File: C:\prj\runtime-main3\src\coreclr\jit\valuenum.cpp:10348

The process aborts with exit code 0xC0000602. TestLeadingZeroCount and
TestTrailingZeroCount fail at the same assert.

Platform

Windows x64 host, local Checked build of dotnet/runtime main (ef97eb5).

Requires a Checked/Debug JIT for a target that does not turn the 64-bit bit-counting
primitives into a hardware intrinsic, so the node keeps its TYP_LONG result type.
Observed by cross-compiling with the WASM alt-JIT:

set DOTNET_AltJit=TestPopCount
set DOTNET_AltJitName=clrjit_universal_wasm_x64.dll

x64 and arm64 are unaffected — they lower these to hardware instructions and produce the
expected output.

Activity

  1. added this to the 12.0.0 milestone on Sep 10, 2026
  2. added
    area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
    on Sep 10, 2026
  3. dotnet-policy-service commented on Sep 10, 2026

    @dotnet-policy-service
    Contributor

    Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
    See info in area-owners.md if you want to be subscribed.

  4. added a commit that references this issue on Sep 12, 2026
    b9678dc
  5. added a commit that references this issue on Sep 18, 2026
    2251f08
  6. locked and limited conversation to collaborators on Oct 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area-CodeGen-coreclrCLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions