arm64: Assertion failed 'loop->ContainsBlock(pred)' during 'Do value numbering'

[kunalspathak]

// Found by Antigen
// Reduced from 14.87 KB to 3.01 KB.


using System;
using System.Collections.Generic;
using System.Runtime.CompilerServices;
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.Arm;
using System.Runtime.Intrinsics.X86;
using System.Numerics;
public class TestClass
{
    public struct S1
    {
        public float float_0;
    }
    static bool s_bool_2 = false;
    static int s_int_8 = -2;
    static uint s_uint_14 = 2;
    static S1 s_s1_17 = new S1();
    int int_25 = 0;
    float float_28 = 2.0238094f;
    S1 s1_34 = new S1();
    private static List<string> toPrint = new List<string>();
    [MethodImpl(MethodImplOptions.NoInlining)]
    public int LeafMethod6()
    {
        unchecked
        {
            return 15>>4;
        }
    }
    public float LeafMethod9()
    {
        unchecked
        {
            return s_s1_17.float_0 *= float_28 = s1_34.float_0;
        }
    }
    public S1 LeafMethod15()
    {
        unchecked
        {
            return s1_34;
        }
    }
    public void Method0()
    {
        unchecked
        {
            int int_61 = -2;
            uint uint_67 = 0;
            while (s_int_8 >> (int_25 |= int_25)+ (s_int_8 -= LeafMethod6())== int_61)
            {
                if (15*4> (uint_67 = 15&4& s_uint_14 - 15*4))
{}                else
                {
                    switch (s_int_8)
                    {
                        case -1:
                        {
                            do
                            {
                            }
                            while (15>4&& s_bool_2);
                            break;
                        }
                        case -5:
                        {
                            try
                            {
                                LeafMethod9();
                            }
                            catch (System.StackOverflowException)
                            {
                            }
                            break;
                        }
                        default:
                        {
                            try
                            {
                                LeafMethod15();
                            }
                            catch (System.TimeZoneNotFoundException)
                            {
                            }
                            catch (System.NotSupportedException)
                            {
                            }
                            catch (System.ArrayTypeMismatchException)
                            {
                            }
                            catch (System.InsufficientMemoryException)
                            {
                            }
                            break;
                        }
                    }
                }
            }
            return;
        }
    }
    public static void Main(string[] args)
    {
    }
    public static int Antigen()
    {
        new TestClass().Method0();
        return string.Join(Environment.NewLine, toPrint).GetHashCode();
    }
}
/*
Environment:

set DOTNET_JitRLCSEGreedy=1
set DOTNET_JitFakeProcedureSplitting=1
set DOTNET_JitRandomGuardedDevirtualization=1
set DOTNET_JitRandomOnStackReplacement=10
set DOTNET_TC_OnStackReplacement=1
set DOTNET_TC_PartialCompilation=1
set DOTNET_TC_QuickJitForLoops=1
set DOTNET_TieredCompilation=0
set DOTNET_TieredPGO=1
set DOTNET_EnablePCLMULQDQ=1
set DOTNET_TailcallStress=0
set DOTNET_JitThrowOnAssertionFailure=1
set DOTNET_LegacyExceptionHandling=1

Debug: -402375315

Release: 0
JIT assert failed:
Assertion failed 'loop->ContainsBlock(pred)' in 'TestClass:Method0():this' during 'Do value numbering' (IL size 136; hash 0x46e9aa75; FullOpts)

    File: /Users/runner/work/1/s/src/coreclr/jit/fgdiagnostic.cpp Line: 4713


*/

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[jakobbotsch]

Bisected to #110273, cc @AndyAyersMS

Presumably the new removal phases are not properly maintaining canonicalized loop shapes. Can the second run of these phases be changed to run before loop finding/canonicalization happens?