[release/10.0] JIT: fix switch peeling stealing the wrong operand of its compare

[EgorBo]

Backport of #132395 to release/10.0

Customer Impact

• Customer reported
• Found internally

Reported in #132370, with a standalone 71-line repro. Silent wrong code on a default installation — no configuration or environment variables needed.

fgPeelSwitch reattached the switch value via fgMakeMultiUse(&compare->gtOp1) after the compare was put into a statement. Creating the statement sequences the tree via gtSetEvalOrder, which swaps a compare's operands when op1 is a constant, so the switch ended up "stealing" the dominant case constant instead of the switch value.

The switch value is a constant when the loop around the switch is unrolled, so every unrolled copy dispatched on case 0. In the reported case a method checking whether all three components of a vector are zero returned true for (0, 0, 1).

Fix: build the compare fully before creating the statement.

Regression

• Yes
• No

.NET 10. The reporter verified every published .NET 10 runtime is affected (all 21, from preview.1 through 10.0.11, 10/10 runs each); .NET 8 and .NET 9 are not.

Testing

Regression test Runtime_132370 from the original PR is included. The original PR reported no asm diffs (benchmarks.run, libraries.pmi).

Risk

Low. Pure ordering change within fgPeelSwitch — the compare is now fully built before it is sequenced, so the operand it hands to the switch is the intended one. No behavior change beyond that.

Notes on the backport

Nearly clean; fgopt.cpp applies verbatim. Only the test wiring differs: main registers the test in the merged runner src/tests/JIT/Regression/Regression_ro_2.csproj, which does not exist on release/10.0, so the test gets its own Runtime_132370.csproj per this branch's JitBlue convention.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Backports the .NET 10 JIT fix for switch peeling in fgPeelSwitch, where sequencing the newly-created compare could swap operands and cause the switch to reuse the wrong value, leading to silent wrong-code in unrolled-switch scenarios. Adds a JIT regression test to reproduce the reported issue under Tiered PGO.

Changes:

• Fix fgPeelSwitch to reattach the switch value to the switch before creating/sequencing the compare statement, preventing operand swapping from corrupting the switch value.
• Add regression test Runtime_132370 and wire it up with the needed Tiered Compilation / Tiered PGO environment variables.
• Add a dedicated .csproj for the test per release/10.0 JitBlue conventions.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/coreclr/jit/fgopt.cpp	Reorders compare construction vs statement sequencing to avoid operand swapping and incorrect switch dispatch.
src/tests/JIT/Regression/JitBlue/Runtime_132370/Runtime_132370.csproj	Adds a standalone JitBlue test project and enables Tiered PGO via test environment variables.
src/tests/JIT/Regression/JitBlue/Runtime_132370/Runtime_132370.cs	Adds a regression repro that exercises unrolled switch peeling under Tiered PGO.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.