[Release/10.0] JIT: Fix bug in GenTree::Equals (#128654)#128724
Merged
JulieLeeMSFT merged 1 commit intoMay 29, 2026
Conversation
Make sure we properly distinguish virtual stub calls to avoid incorrect head/tail merges. Fixes dotnet#128631. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> (cherry picked from commit dfd91b8)
github-actions
Bot
added
the
area-CodeGen-coreclr
Member
Author
|
@jakobbotsch @JulieLeeMSFT PTAL |
Contributor
|
Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch |
Contributor
There was a problem hiding this comment.
Pull request overview
Backport of #128654 to release/10.0. Fixes a JIT tail-merge bug where two shared-generic virtual stub calls with distinct stub dispatch cells were considered equal by GenTree::Equals, causing the JIT to merge them and dispatch to the wrong method.
Changes:
- Add a stub-address check in
GenTreeCall::Equalsso virtual stub calls are only considered equal when their dispatch cells match. - Add a JitBlue regression test (
Runtime_128631) covering two sibling shared-generic interface calls.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| src/coreclr/jit/gentree.cpp | Adds virtual stub address comparison in GenTreeCall::Equals to prevent incorrect head/tail merges. |
| src/tests/JIT/Regression/JitBlue/Runtime_128631/Runtime_128631.cs | New regression test exercising two shared-generic interface dispatches that must not be merged. |
| src/tests/JIT/Regression/JitBlue/Runtime_128631/Runtime_128631.csproj | Test project file for the new regression test. |
AndyAyersMS
changed the title
JulieLeeMSFT
added
the
Servicing-consider
jakobbotsch
approved these changes
May 28, 2026
JulieLeeMSFT
added
Servicing-approved
This was referenced May 29, 2026
Open
Member
|
@AndyAyersMS, please check test failrues. |
Member
Author
|
Failures are mono / timeouts. Unrelated. |
Member
|
/ba-g all known issues, and mono failures are unrelated |
Contributor
|
Guess it will be part of the next milestone 10.0.10 ? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make sure to properly distinguish virtual stub calls to avoid incorrect head/tail merges.
Fixes #128631.
Backport of #128654 to release/10.0
Customer Impact
A bug in the JIT's tail merge optimization can cause the wrong method to be invoked.
The pattern required is a shared generic method invoked at two sibling tail call sites on differently typed objects with otherwise identical arguments. These calls are only distinguishable by the different virtual stub addresses, and the JIT was not considering these when checking if the calls were identical.
EG in a case like
The JIT can collapse the two calls into one and so invoke the wrong method for one of the cases.
Regression
It is harder to reproduce in .NET 8 as the optimization was less general back then.
Testing
Verified fix with customer repro and locally crafted repro case.
Risk
Low. Adds some extra checking to the method that tail merging uses to determine if two calls are identical. Overall the JIT becomes (properly) more cautions about this optimization. No diffs in SPMI.