Skip to content

JIT: Preserve receiver-before-index evaluation for Span indexers - #133968

Merged
EgorBo merged 2 commits into
mainfrom
copilot/fix-span-get-item-intrinsic
Sep 16, 2026
Merged

EgorBo merged 2 commits into
mainfrom
copilot/fix-span-get-item-intrinsic

Conversation

Copilot AI commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Span<T> and ReadOnlySpan<T> indexer expansion can spill the index before a side-effecting receiver, violating IL evaluation order and producing incorrect values or exceptions.

  • Importer: Keep the receiver on the evaluation stack during index cloning/spilling so existing spill logic preserves ordering; pop it afterward.
  • Regression coverage: Exercise both Span types with static-field indexes, index calls, exception ordering, and an earlier stack operand.

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
16 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@dotnet-policy-service

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @dotnet/runtime-infrastructure
See info in area-owners.md if you want to be subscribed.

Co-authored-by: EgorBo <523221+EgorBo@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix Span<T>.get_Item intrinsic evaluation order issue JIT: Preserve receiver-before-index evaluation for Span indexers Sep 15, 2026
Copilot AI requested a review from EgorBo September 15, 2026 17:44
@EgorBo

EgorBo commented Sep 15, 2026

Copy link
Copy Markdown
Member

PTAL @dotnet/jit-contrib almost no diffs

@EgorBo
EgorBo marked this pull request as ready for review September 15, 2026 19:47
@EgorBo
EgorBo requested review from a team and a lite review from Copilot September 15, 2026 19:47
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The reviewed changes address the evaluation-order issue and include regression coverage.

Pull request overview

This pull request fixes JIT evaluation-order handling for Span<T> and ReadOnlySpan<T> indexers.

Changes:

  • Preserves the receiver while spilling the index.
  • Adds regression coverage for evaluation order and exceptions.
File summaries
File Description
src/tests/JIT/Regression_ro_2/Runtime_133963.cs Adds regression tests for both span types.
src/coreclr/jit/importercalls.cpp Preserves receiver-before-index evaluation.
Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
  • Review effort level: Lite

@EgorBo
EgorBo merged commit 1f9fd43 into main Sep 16, 2026
144 of 147 checks passed
@EgorBo
EgorBo deleted the copilot/fix-span-get-item-intrinsic branch September 16, 2026 10:08
@dotnet-milestone-bot dotnet-milestone-bot Bot added this to the 12.0-preview1 milestone Sep 17, 2026
jtschuster pushed a commit to jtschuster/runtime that referenced this pull request Sep 18, 2026
…net#133968)

<!-- -->
`Span<T>` and `ReadOnlySpan<T>` indexer expansion can spill the index
before a side-effecting receiver, violating IL evaluation order and
producing incorrect values or exceptions.

- **Importer:** Keep the receiver on the evaluation stack during index
cloning/spilling so existing spill logic preserves ordering; pop it
afterward.
- **Regression coverage:** Exercise both Span types with static-field
indexes, index calls, exception ordering, and an earlier stack operand.

<!-- START COPILOT CODING AGENT SUFFIX -->

- Fixes dotnet#133963

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: EgorBo <523221+EgorBo@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

JIT: (bug) Span<T>.get_Item intrinsic evaluates the index before the receiver

4 participants