From eff1076f75d5639dbaa80ba507c31277f0a82fbd Mon Sep 17 00:00:00 2001
From: EgorBo <egorbo@gmail.com>
Date: Tue, 11 Mar 2025 00:38:41 +0100
Subject: [PATCH] Don't update side-effects in a statement that doesn't exist

---
 src/coreclr/jit/rangecheckcloning.cpp         | 10 +++++--
 .../JitBlue/Runtime_113334/Runtime_113334.cs  | 30 +++++++++++++++++++
 .../Runtime_113334/Runtime_113334.csproj      |  8 +++++
 3 files changed, 46 insertions(+), 2 deletions(-)
 create mode 100644 src/tests/JIT/Regression/JitBlue/Runtime_113334/Runtime_113334.cs
 create mode 100644 src/tests/JIT/Regression/JitBlue/Runtime_113334/Runtime_113334.csproj

diff --git a/src/coreclr/jit/rangecheckcloning.cpp b/src/coreclr/jit/rangecheckcloning.cpp
index 4e0460ab4ce6f9..2064f873c511f3 100644
--- a/src/coreclr/jit/rangecheckcloning.cpp
+++ b/src/coreclr/jit/rangecheckcloning.cpp
@@ -345,7 +345,12 @@ static BasicBlock* optRangeCheckCloning_DoClone(Compiler*             comp,
         // it happens when we emit BBJ_COND(0 >= 0) fake block (for simplicity)
         comp->gtUpdateStmtSideEffects(lowerBndBb->lastStmt());
     }
-    comp->gtUpdateStmtSideEffects(upperBndBb->lastStmt());
+    if (upperBndBb->lastStmt() != nullptr)
+    {
+        // In rare cases, upperBndBb can also be folded into an empty block
+        // by fgMorphBlockStmt
+        comp->gtUpdateStmtSideEffects(upperBndBb->lastStmt());
+    }
 
     // All blocks must be in the same EH region
     assert(BasicBlock::sameEHRegion(prevBb, lowerBndBb));
@@ -395,7 +400,8 @@ class BoundsChecksVisitor final : public GenTreeVisitor<BoundsChecksVisitor>
 
     fgWalkResult PostOrderVisit(GenTree** use, GenTree* user)
     {
-        if ((*use)->OperIs(GT_BOUNDS_CHECK))
+        // For now, we only handle SCK_RNGCHK_FAIL
+        if ((*use)->OperIs(GT_BOUNDS_CHECK) && ((*use)->AsBoundsChk()->gtThrowKind == SCK_RNGCHK_FAIL))
         {
             m_boundsChks->Push(BoundCheckLocation(m_stmt, use, m_stmtIdx));
         }
diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_113334/Runtime_113334.cs b/src/tests/JIT/Regression/JitBlue/Runtime_113334/Runtime_113334.cs
new file mode 100644
index 00000000000000..620198a3fc05ca
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_113334/Runtime_113334.cs
@@ -0,0 +1,30 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+// Generated by Fuzzlyn v2.4 on 2025-03-09 18:07:26
+// Run on X86 Windows
+// Seed: 1821229397629005810-vectort,vector128,vector256,x86aes,x86avx,x86avx2,x86avx512bw,x86avx512bwvl,x86avx512cd,x86avx512cdvl,x86avx512dq,x86avx512dqvl,x86avx512f,x86avx512fvl,x86bmi1,x86bmi2,x86fma,x86lzcnt,x86pclmulqdq,x86popcnt,x86sse,x86sse2,x86sse3,x86sse41,x86sse42,x86ssse3,x86x86base
+// Reduced from 126.0 KiB to 0.5 KiB in 00:02:28
+// Hits JIT assert in Release:
+// Assertion failed 'use != nullptr' in 'Program:Main(Fuzzlyn.ExecutionServer.IRuntime)' during 'Clone blocks with range checks' (IL size 62; hash 0xade6b36b; FullOpts)
+
+using System.Runtime.Intrinsics;
+using System.Runtime.Intrinsics.X86;
+using Xunit;
+
+public class Runtime_113334
+{
+    [Fact]
+    public static void Problem()
+    {
+        if (Fma.IsSupported)
+        {
+            float[] vr8 = new float[]
+            {
+                0
+            };
+            var vr9 = Vector128.Create<float>(0);
+            Fma.MultiplyAddNegatedScalar(vr9, Vector128.Create(vr8[0], vr8[0], vr8[0], vr8[0]), Sse.CompareScalarEqual(Vector128.Create<float>(vr8[0]), Vector128.CreateScalar(vr8[0])));
+        }
+    }
+}
diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_113334/Runtime_113334.csproj b/src/tests/JIT/Regression/JitBlue/Runtime_113334/Runtime_113334.csproj
new file mode 100644
index 00000000000000..de6d5e08882e86
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_113334/Runtime_113334.csproj
@@ -0,0 +1,8 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <Optimize>True</Optimize>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="$(MSBuildProjectName).cs" />
+  </ItemGroup>
+</Project>