Assert failure: System.Text.Json.Tests.Utf8JsonWriterTests.HighSurrogateMissingGetsReplaced / WriteStringValueSegment_Utf8_Split8CodePointsBasic

[JulieLeeMSFT]

Massive failures in all HighSurrogateMissingGetsReplaced / WriteStringValueSegment_Utf8_Split8CodePointsBasic tests.

Failed in (1):

• runtime-coreclr libraries-pgo 20260726.1

Console Log: Console Log
Source: runtime-coreclr libraries-pgo / net11.0-linux-Release-arm64-fullpgo_random_gdv_edge-AzureLinux.3.Arm64.Open / System.Text.Json.Tests.Utf8JsonWriterTests.HighSurrogateMissingGetsReplaced

Failed tests:

- net11.0-linux-Release-arm64-fullpgo_random_gdv_edge-AzureLinux.3.Arm64.Open
  - System.Text.Json.Tests.Utf8JsonWriterTests.HighSurrogateMissingGetsReplaced
  - System.Text.Json.Tests.Utf8JsonWriterTests.WriteStringValueSegment_Utf8_Split8CodePointsBasic

Error Message:

  Starting:    System.Text.Json.Tests (parallel test collections = on [2 threads], stop on fail = off)
    System.Text.Json.Tests.Utf8JsonWriterTests.HighSurrogateMissingGetsReplaced(options: System.Text.Json.JsonWriterOptions) [FAIL]
      Assert.Equal() Failure: Strings differ
                                                ↓ (pos 62)
      Expected: ···"udd1e\\udbff\\udfffa": "a\\ud800\\udc00\\ud803\\ude6d\\ud"···
      Actual:   ···"udd1e\\udbff\\udfffa": "a\\u0000\\u0e6d\\ud11e\\uffffa"\n"···
                                                ↑ (pos 62)

Stack Trace:

        /_/src/libraries/System.Text.Json/tests/System.Text.Json.Tests/JsonTestHelper.cs(719,0): at System.Text.Json.JsonTestHelper.AssertContents(String expectedValue, ArrayBufferWriter`1 buffer, Boolean skipSpecialRules)
        /_/src/libraries/System.Text.Json/tests/System.Text.Json.Tests/Utf8JsonWriterTests.cs(5112,0): at System.Text.Json.Tests.Utf8JsonWriterTests.HighSurrogateMissingGetsReplaced(JsonWriterOptions options)
           at System.RuntimeMethodHandle.InvokeMethod(ObjectHandleOnStack target, Void** arguments, ObjectHandleOnStack sig, BOOL isConstructor, ObjectHandleOnStack result)
           at System.RuntimeMethodHandle.InvokeMethod(ObjectHandleOnStack target, Void** arguments, ObjectHandleOnStack sig, BOOL isConstructor, ObjectHandleOnStack result)
        /_/src/coreclr/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.CoreCLR.cs(37,0): at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
        /_/src/libraries/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.cs(174,0): at System.Reflection.MethodBaseInvoker.InvokeDirectByRefWithFewArgs(Object obj, Span`1 copyOfArgs, BindingFlags invokeAttr)

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[MihuBot]

I'm a bot. Here is a possible related and/or duplicate issue (I may be wrong):

• Test failure: System.Text.Json.Tests.Utf8JsonWriterTests.WriteStringValueSegment_Utf8_Split8CodePointsBasic #131404

[AndyAyersMS]

#131404 is the same issue.

RBO leaves an unreachable block, and this trips up RangeCheck::MergeAssertion (which was recently "upgraded" in #129354). PR up shortly.

AI summary of what happens:

In Utf8JsonWriter:WriteStringEscapeValue(ReadOnlySpan<byte>, int) Tier1:

1. optJumpThreadCore (RBO) threads BB396→BB293 and BB397→BB295, leaving BB392 with
   bbPreds == nullptr but still in the flowgraph — by design, per its own comment at
   redundantbranchopts.cpp:2645:
   "jti.m_block is unreachable, but we won't remove it until the next flowgraph simplification pass."

2. BB295's PHI still names BB392 as a gtPredBB. Nothing in the JIT ever rewrites that field
   (grep -rn 'gtPredBB = ' src/coreclr/jit/ → no hits), so phis are stale by construction
   after any flow edit.

3. RangeCheck::MergeAssertion (rangecheck.cpp:1742-1745)
   reads that stale field and pulls the edge assertions with no reachability guard:

   if (op->OperIs(GT_PHI_ARG))
   {
       const BasicBlock* pred = op->AsPhiArg()->gtPredBB;   // BB392 — orphaned
       assertions             = m_compiler->optGetEdgeAssertions(block, pred);

   Assertions 101/102 (VN $352 u<= 65535) are correct for the 1/2/3-byte UTF-8 decode arms
   that used to reach BB392, but no flow reaches BB392 any more.

4. The result tightens VN $352 to <0, 65535> — the astral (4-byte decode) range
   <0x10000, 0x10FFFF> is missing from the merge — which folds (v > 0xFFFF) != 0 at BB424
   to false. BB429, the 12-byte surrogate-pair writer, becomes unreachable and is deleted in
   the next flowgraph opt pass.

MergeAssertion needs a similar safeguard to isUnreachableBlock in optVisitReachingAssertions

Note

This investigation was carried out with GitHub Copilot.