From 6ee2375c17cf608aa91d4bdda6d326ff5c9d802e Mon Sep 17 00:00:00 2001
From: Jakob Botsch Nielsen <jakob.botsch.nielsen@gmail.com>
Date: Tue, 20 Aug 2024 15:46:50 +0200
Subject: [PATCH 1/2] JIT: Avoid removing CSE candidates in fgMorphExpandCast

Fix #106609
---
 src/coreclr/jit/morph.cpp                     |  3 +-
 .../JitBlue/Runtime_106609/Runtime_106609.cs  | 39 +++++++++++++++++++
 .../Runtime_106609/Runtime_106609.csproj      |  8 ++++
 3 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 src/tests/JIT/Regression/JitBlue/Runtime_106609/Runtime_106609.cs
 create mode 100644 src/tests/JIT/Regression/JitBlue/Runtime_106609/Runtime_106609.csproj

diff --git a/src/coreclr/jit/morph.cpp b/src/coreclr/jit/morph.cpp
index d037282e447ab..f8989a40f405f 100644
--- a/src/coreclr/jit/morph.cpp
+++ b/src/coreclr/jit/morph.cpp
@@ -451,7 +451,8 @@ GenTree* Compiler::fgMorphExpandCast(GenTreeCast* tree)
     // Because there is no IL instruction conv.r4.un, uint/ulong -> float
     // casts are always imported as CAST(float <- CAST(double <- uint/ulong)).
     // We can eliminate the redundant intermediate cast as an optimization.
-    else if ((dstType == TYP_FLOAT) && (srcType == TYP_DOUBLE) && oper->OperIs(GT_CAST)
+    else if ((dstType == TYP_FLOAT) && (srcType == TYP_DOUBLE) && oper->OperIs(GT_CAST) &&
+             !gtIsActiveCSE_Candidate(tree)
 #ifdef TARGET_ARM
              && !varTypeIsLong(oper->AsCast()->CastOp())
 #endif
diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_106609/Runtime_106609.cs b/src/tests/JIT/Regression/JitBlue/Runtime_106609/Runtime_106609.cs
new file mode 100644
index 0000000000000..808cb739171f2
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_106609/Runtime_106609.cs
@@ -0,0 +1,39 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+// Generated by Fuzzlyn v2.2 on 2024-08-17 17:16:59
+// Run on Arm64 Windows
+// Seed: 18124298882625099135-vectort,vector64,vector128,armadvsimd,armadvsimdarm64,armaes,armarmbase,armarmbasearm64,armcrc32,armcrc32arm64,armdp,armsha1,armsha256
+// Reduced from 129.5 KiB to 0.4 KiB in 00:04:55
+// Hits JIT assert in Release:
+// Assertion failed 'link' in 'Program:Main(Fuzzlyn.ExecutionServer.IRuntime)' during 'Optimize Valnum CSEs' (IL size 39; hash 0xade6b36b; FullOpts)
+// 
+//     File: D:\a\_work\1\s\src\coreclr\jit\optcse.cpp Line: 5295
+// 
+using System.Runtime.CompilerServices;
+using System.Runtime.Intrinsics;
+using System.Runtime.Intrinsics.Arm;
+using Xunit;
+
+public class Runtime_106609
+{
+    [Fact]
+    public static void TestEntrypoint()
+    {
+        if (AdvSimd.IsSupported)
+        {
+            Test();
+        }
+    }
+
+    public static float[] s_2;    
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    private static void Test()
+    {
+        for (int vr8 = 0; vr8 < 2; vr8++)
+        {
+            var vr9 = Vector64.Create<uint>(0);
+            s_2[0] = (float)(-(-(double)AdvSimd.Extract(vr9, 0)));
+        }
+    }
+}
\ No newline at end of file
diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_106609/Runtime_106609.csproj b/src/tests/JIT/Regression/JitBlue/Runtime_106609/Runtime_106609.csproj
new file mode 100644
index 0000000000000..de6d5e08882e8
--- /dev/null
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_106609/Runtime_106609.csproj
@@ -0,0 +1,8 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <Optimize>True</Optimize>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="$(MSBuildProjectName).cs" />
+  </ItemGroup>
+</Project>

From 2694dde1f5092e422671f2164de59488cf830737 Mon Sep 17 00:00:00 2001
From: Jakob Botsch Nielsen <jakob.botsch.nielsen@gmail.com>
Date: Tue, 20 Aug 2024 18:05:07 +0200
Subject: [PATCH 2/2] Fix test

---
 .../JitBlue/Runtime_106609/Runtime_106609.cs           | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/tests/JIT/Regression/JitBlue/Runtime_106609/Runtime_106609.cs b/src/tests/JIT/Regression/JitBlue/Runtime_106609/Runtime_106609.cs
index 808cb739171f2..e640f91d86c66 100644
--- a/src/tests/JIT/Regression/JitBlue/Runtime_106609/Runtime_106609.cs
+++ b/src/tests/JIT/Regression/JitBlue/Runtime_106609/Runtime_106609.cs
@@ -22,11 +22,17 @@ public static void TestEntrypoint()
     {
         if (AdvSimd.IsSupported)
         {
-            Test();
+            try
+            {
+                Test();
+            }
+            catch
+            {
+            }
         }
     }
 
-    public static float[] s_2;    
+    public static float[] s_2;
     [MethodImpl(MethodImplOptions.NoInlining)]
     private static void Test()
     {