From 26b683b43753d2292db194fb3991c8faf84b52b5 Mon Sep 17 00:00:00 2001
From: Jakob Botsch Nielsen <jakob.botsch.nielsen@gmail.com>
Date: Tue, 5 Sep 2023 14:01:43 +0200
Subject: [PATCH 1/2] JIT: Compensate for mistyped commas in morph pre-order
 too

Morph has post-order logic to compensate for mistyped commas produced by
impStoreStruct. However, block morphing can optimize unused stores into
INDs; this interacts with the mistyped commas to produce illegal IR
shapes (e.g. `COMMA<simd12>(..., IND<ubyte>(...))`).

The ideal solution is to fix impStoreStruct (#91586 tracks this), but
this change has a more surgical fix for the problem that can be
backported to .NET 8.

Fix #91443
---
 src/coreclr/jit/morph.cpp                     |  6 +++++
 .../JitBlue/Runtime_91443/Runtime_91443.cs    | 23 +++++++++++++++++++
 .../Runtime_91443/Runtime_91443.csproj        |  8 +++++++
 3 files changed, 37 insertions(+)
 create mode 100644 src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.cs
 create mode 100644 src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.csproj

diff --git a/src/coreclr/jit/morph.cpp b/src/coreclr/jit/morph.cpp
index 52454b0c8b7316..86691fb28c807d 100644
--- a/src/coreclr/jit/morph.cpp
+++ b/src/coreclr/jit/morph.cpp
@@ -8919,6 +8919,12 @@ GenTree* Compiler::fgMorphSmpOp(GenTree* tree, MorphAddrContext* mac, bool* optA
             break;
 #endif
 
+        case GT_COMMA:
+            if (op2->OperIsStore() || (op2->OperGet() == GT_COMMA && op2->TypeGet() == TYP_VOID) || fgIsThrow(op2))
+            {
+                typ = tree->gtType = TYP_VOID;
+            }
+
         default:
             break;
     }
diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.cs b/src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.cs
new file mode 100644
index 00000000000000..d3844b77271dd7
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.cs
@@ -0,0 +1,23 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Numerics;
+using System.Runtime.CompilerServices;
+using Xunit;
+
+public class Runtime_91443
+{
+    [Fact]
+    public static void TestEntryPoint()
+    {
+        new Runtime_91443().Method0();
+    }
+    
+    static Vector3 s;
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    private void Method0()
+    {
+        Vector3.Cross(s, s);
+    }
+}
diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.csproj b/src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.csproj
new file mode 100644
index 00000000000000..de6d5e08882e86
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_91443/Runtime_91443.csproj
@@ -0,0 +1,8 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <Optimize>True</Optimize>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="$(MSBuildProjectName).cs" />
+  </ItemGroup>
+</Project>

From 99b7f1fc9fcdba1b7c15bbc553afdfe274464b5e Mon Sep 17 00:00:00 2001
From: Jakob Botsch Nielsen <jakob.botsch.nielsen@gmail.com>
Date: Tue, 5 Sep 2023 14:26:16 +0200
Subject: [PATCH 2/2] Fix build

---
 src/coreclr/jit/morph.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/coreclr/jit/morph.cpp b/src/coreclr/jit/morph.cpp
index 86691fb28c807d..153f9b8bba8a82 100644
--- a/src/coreclr/jit/morph.cpp
+++ b/src/coreclr/jit/morph.cpp
@@ -8925,6 +8925,8 @@ GenTree* Compiler::fgMorphSmpOp(GenTree* tree, MorphAddrContext* mac, bool* optA
                 typ = tree->gtType = TYP_VOID;
             }
 
+            break;
+
         default:
             break;
     }