JIT: fix overly aggressive type propagation from returns (#21316)

For quite a while now the jit has been propagating return types from
callees to the return spill temp. However this is only safe when the
callee has a single return site (or all return sites return the same
type).

Because return spill temps often end up getting assigned to still more
temps we haven't seen this overly aggressive type propgagation lead to
bugs, but now that we're tracking single def temps and doing more type
propagation during the late devirtualization callback, the fact that
these types are wrong has been exposed and can lead to incorrect
devirtualization.

The fix is to only consider the return spill temp as single def if the
callee has a single return site, and to check that the return spill temp
is single def before trying to propagate the type.

Fixes #21295.

2 files changed, 56 insertions, 0 deletions

diff --git a/tests/src/JIT/Regression/JitBlue/GitHub_21295/GitHub_21295.cs b/tests/src/JIT/Regression/JitBlue/GitHub_21295/GitHub_21295.cs
new file mode 100644
index 0000000000..7bd3d75954
--- /dev/null
+++ b/tests/src/JIT/Regression/JitBlue/GitHub_21295/GitHub_21295.cs
@@ -0,0 +1,39 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using System;
+using System.Runtime.CompilerServices;
+
+class B
+{
+    public virtual int F() => 33;
+}
+
+sealed class D : B
+{
+    public override int F() => 44;
+}
+
+class X
+{
+    volatile static bool p;
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    static B GB() => new B();
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    static D GD() => new D();
+
+    [MethodImpl(MethodImplOptions.AggressiveInlining)]
+    static B G() => p ? GD() : GB();
+
+    public static int Main()
+    {
+        p = false;
+        // After inlining G(), the jit must not update
+        // the type of the return spill temp for G(), or it 
+        // may incorrectly devirtualize the call to F()
+        return G().F() + 67;
+    }
+}
diff --git a/tests/src/JIT/Regression/JitBlue/GitHub_21295/GitHub_21295.csproj b/tests/src/JIT/Regression/JitBlue/GitHub_21295/GitHub_21295.csproj
new file mode 100644
index 0000000000..d86ed9f3d7
--- /dev/null
+++ b/tests/src/JIT/Regression/JitBlue/GitHub_21295/GitHub_21295.csproj
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="12.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildThisFileDirectory), dir.props))\dir.props" />
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Release</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <AssemblyName>$(MSBuildProjectName)</AssemblyName>
+    <OutputType>Exe</OutputType>
+    <DebugType></DebugType>
+    <Optimize>True</Optimize>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="$(MSBuildProjectName).cs" />
+  </ItemGroup>
+  <Import Project="$([MSBuild]::GetDirectoryNameOfFileAbove($(MSBuildThisFileDirectory), dir.targets))\dir.targets" />
+  <PropertyGroup Condition=" '$(MsBuildProjectDirOverride)' != '' "></PropertyGroup>
+</Project>
\ No newline at end of file