411

The following code gives different output when running the release inside Visual Studio, and running the release outside Visual Studio. I'm using Visual Studio 2008 and targeting .NET 3.5. I've also tried .NET 3.5 SP1.

When running outside Visual Studio, the JIT should kick in. Either (a) there's something subtle going on with C# that I'm missing or (b) the JIT is actually in error. I'm doubtful that the JIT can go wrong, but I'm running out of other possiblities...

Output when running inside Visual Studio:

    0 0,
    0 1,
    1 0,
    1 1,

Output when running release outside of Visual Studio:

    0 2,
    0 2,
    1 2,
    1 2,

What is the reason?

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;

namespace Test
{
    struct IntVec
    {
        public int x;
        public int y;
    }

    interface IDoSomething
    {
        void Do(IntVec o);
    }

    class DoSomething : IDoSomething
    {
        public void Do(IntVec o)
        {
            Console.WriteLine(o.x.ToString() + " " + o.y.ToString()+",");
        }
    }

    class Program
    {
        static void Test(IDoSomething oDoesSomething)
        {
            IntVec oVec = new IntVec();
            for (oVec.x = 0; oVec.x < 2; oVec.x++)
            {
                for (oVec.y = 0; oVec.y < 2; oVec.y++)
                {
                    oDoesSomething.Do(oVec);
                }
            }
        }

        static void Main(string[] args)
        {
            Test(new DoSomething());
            Console.ReadLine();
        }
    }
}
6
  • 8
    Yeah - how about that: finding a serious bug in something as essential as the .Net JIT - congrats! Jan 13, 2010 at 14:56
  • 73
    This appears to repro in my December 9th build of the 4.0 framework on x86. I'll pass it along to the jitter team. Thanks! Jan 13, 2010 at 18:26
  • 28
    This is one of the very few questions that actually deserve a gold badge. Jan 13, 2010 at 18:37
  • 28
    The fact that we all are interested in this question shows, we don’t expect bugs in the .NET JIT, well done Microsoft. Feb 2, 2010 at 8:06
  • 2
    We all waiting for Microsoft reply anxiously .....
    – Talha
    Jun 2, 2012 at 19:41

3 Answers 3

211

It is a JIT optimizer bug. It is unrolling the inner loop but not updating the oVec.y value properly:

      for (oVec.x = 0; oVec.x < 2; oVec.x++) {
0000000a  xor         esi,esi                         ; oVec.x = 0
        for (oVec.y = 0; oVec.y < 2; oVec.y++) {
0000000c  mov         edi,2                           ; oVec.y = 2, WRONG!
          oDoesSomething.Do(oVec);
00000011  push        edi  
00000012  push        esi  
00000013  mov         ecx,ebx 
00000015  call        dword ptr ds:[00170210h]        ; first unrolled call
0000001b  push        edi                             ; WRONG! does not increment oVec.y
0000001c  push        esi  
0000001d  mov         ecx,ebx 
0000001f  call        dword ptr ds:[00170210h]        ; second unrolled call
      for (oVec.x = 0; oVec.x < 2; oVec.x++) {
00000025  inc         esi  
00000026  cmp         esi,2 
00000029  jl          0000000C 

The bug disappears when you let oVec.y increment to 4, that's too many calls to unroll.

One workaround is this:

  for (int x = 0; x < 2; x++) {
    for (int y = 0; y < 2; y++) {
      oDoesSomething.Do(new IntVec(x, y));
    }
  }

UPDATE: re-checked in August 2012, this bug was fixed in the version 4.0.30319 jitter. But is still present in the v2.0.50727 jitter. It seems unlikely they'll fix this in the old version after this long.

3
  • 3
    +1, definitely a bug - I might have identified the conditions for the error (not saying that nobugz found it because of me, though!), but this (and yours, Nick, so +1 for you too) shows that the JIT is the culprit. interesting that the optimisation is either removed or different when IntVec is declared as a class. Even if you explicitly initialise the struct fields to 0 first before the loop the same behaviour is seen. Nasty! Jan 13, 2010 at 14:48
  • 3
    @Hans Passant What tool did you use to output the assembly code ?
    – user2324540
    May 23, 2013 at 14:51
  • 4
    @Joan - Just Visual Studio, copy/paste from the debugger's Disassembly window and comments added by hand. May 23, 2013 at 16:19
81

I believe this is in a genuine JIT compilation bug. I would report it to Microsoft and see what they say. Interestingly, I found that the x64 JIT does not have the same problem.

Here is my reading of the x86 JIT.

// save context
00000000  push        ebp  
00000001  mov         ebp,esp 
00000003  push        edi  
00000004  push        esi  
00000005  push        ebx  

// put oDoesSomething pointer in ebx
00000006  mov         ebx,ecx 

// zero out edi, this will store oVec.y
00000008  xor         edi,edi 

// zero out esi, this will store oVec.x
0000000a  xor         esi,esi 

// NOTE: the inner loop is unrolled here.
// set oVec.y to 2
0000000c  mov         edi,2 

// call oDoesSomething.Do(oVec) -- y is always 2!?!
00000011  push        edi  
00000012  push        esi  
00000013  mov         ecx,ebx 
00000015  call        dword ptr ds:[002F0010h] 

// call oDoesSomething.Do(oVec) -- y is always 2?!?!
0000001b  push        edi  
0000001c  push        esi  
0000001d  mov         ecx,ebx 
0000001f  call        dword ptr ds:[002F0010h] 

// increment oVec.x
00000025  inc         esi  

// loop back to 0000000C if oVec.x < 2
00000026  cmp         esi,2 
00000029  jl          0000000C 

// restore context and return
0000002b  pop         ebx  
0000002c  pop         esi  
0000002d  pop         edi  
0000002e  pop         ebp  
0000002f  ret     

This looks like an optimization gone bad to me...

23

I copied your code into a new Console App.

  • Debug Build
    • Correct output with both debugger and no debugger
  • Switched to Release Build
    • Again, correct output both times
  • Created a new x86 configuration (I'm on running X64 Windows 2008 and was using 'Any CPU')
  • Debug Build
    • Got the correct output both F5 and CTRL+F5
  • Release Build
    • Correct output with Debugger attached
    • No debugger - Got the incorrect output

So it is the x86 JIT incorrectly generating the code. Have deleted my original text about reordering of loops etc. A few other answers on here have confirmed that the JIT is unwinding the loop incorrectly when on x86.

To fix the problem you can change the declaration of IntVec to a class and it works in all flavours.

Think this needs to go on MS Connect....

-1 to Microsoft!

4
  • 1
    Interesting idea, but surely this isn't "optimisation" but a very major bug in the compiler if this is the case? Would have been found by now wouldn't it?
    – David M
    Jan 13, 2010 at 13:47
  • I agree with you. Reordering loops like this could cause untold issues. Actually this seems even less likely, because the for loops can't ever reach 2. Jan 13, 2010 at 13:52
  • 2
    Looks like one of these nasty Heisenbugs :P
    – arul
    Jan 13, 2010 at 14:03
  • Any CPU won't work if the OP (or anyone using his application) has a 32-bit x86 machine. The problem is that the x86 JIT with optimizations enabled generates bad code. Jan 13, 2010 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.