JIT: Preserve receiver-before-index evaluation for Span indexers

src/coreclr/jit/importercalls.cpp

@@ -4069,7 +4069,7 @@ GenTree* Compiler::impIntrinsic(CORINFO_CLASS_HANDLE    clsHnd,
                         isReadOnly ? "ReadOnly" : "", eeGetClassName(spanElemHnd), elemSize);
 
                 GenTree* index          = impPopStack().val;
-                GenTree* ptrToSpan      = impPopStack().val;
+                GenTree* ptrToSpan      = impStackTop().val;
                 GenTree* indexClone     = nullptr;
                 GenTree* ptrToSpanClone = nullptr;
                 assert(genActualType(index) == TYP_INT);
@@ -4086,8 +4086,10 @@ GenTree* Compiler::impIntrinsic(CORINFO_CLASS_HANDLE    clsHnd,
 #endif // defined(DEBUG)
 
                 // We need to use both index and ptr-to-span twice, so clone or spill.
+                // Keep ptr-to-span on the stack so it is evaluated before any index spill.
                 index = impCloneExpr(index, &indexClone, CHECK_SPILL_ALL, nullptr DEBUGARG("Span.get_Item index"));
 
+                ptrToSpan = impPopStack().val;
                 if (impIsAddressInLocal(ptrToSpan))
                 {
                     ptrToSpanClone = gtCloneExpr(ptrToSpan);

src/tests/JIT/Regression_ro_2/Runtime_133963.cs

@@ -0,0 +1,80 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System;
+using System.Runtime.CompilerServices;
+using Xunit;
+
+public class Runtime_133963
+{
+    private static int s_index;
+
+    [Theory]
+    [InlineData(false, 0)]
+    [InlineData(true, 0)]
+    [InlineData(false, 1)]
+    [InlineData(true, 1)]
+    [InlineData(false, 2)]
+    [InlineData(true, 2)]
+    [InlineData(false, 3)]
+    [InlineData(true, 3)]
+    public static void TestEntryPoint(bool readOnly, int testCase)
+    {
+        int[] data = { 10, 20 };
+        Func<int> test = () => readOnly ? TestReadOnlySpan(data, testCase) : TestSpan(data, testCase);
+
+        s_index = 0;
+        if (testCase == 2)
+        {
+            Assert.Throws<DivideByZeroException>(() => test());
+        }
+        else
+        {
+            Assert.Equal(20, test());
+        }
+        Assert.Equal(testCase == 1 ? 2 : 1, s_index);
+    }
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    private static ref Span<int> GetSpan(ref Span<int> span)
+    {
+        s_index++;
+        return ref span;
+    }
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    private static ref ReadOnlySpan<int> GetReadOnlySpan(ref ReadOnlySpan<int> span)
+    {
+        s_index++;
+        return ref span;
+    }
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    private static int GetIndex() => s_index++;
+
+    [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.AggressiveOptimization)]
+    private static int TestSpan(int[] data, int testCase)
+    {
+        Span<int> span = data;
+        return testCase switch
+        {
+            0 => GetSpan(ref span)[s_index],
+            1 => GetSpan(ref span)[GetIndex()],
+            2 => GetSpan(ref span)[1 / (s_index - 1)],
+            _ => s_index + GetSpan(ref span)[s_index],
+        };
+    }
+
+    [MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.AggressiveOptimization)]
+    private static int TestReadOnlySpan(int[] data, int testCase)
+    {
+        ReadOnlySpan<int> span = data;
+        return testCase switch
+        {
+            0 => GetReadOnlySpan(ref span)[s_index],
+            1 => GetReadOnlySpan(ref span)[GetIndex()],
+            2 => GetReadOnlySpan(ref span)[1 / (s_index - 1)],
+            _ => s_index + GetReadOnlySpan(ref span)[s_index],
+        };
+    }
+}