The Jit doesn't handle certain uses of field addresses correctly

[SingleAccretion]

Reproduction:

Console.WriteLine(Problem(null));

[MethodImpl(MethodImplOptions.NoInlining)]
static int Problem(StructWithIndex* s)
{
    return *(int*)((nint)(int*)&s->Value | -1);
}

struct StructWithIndex
{
    public int Index;
    public int Value;
}

Compile and run.

Expected result: NullReferenceException is thrown.

Actual result: AccessViolationException is thrown.

Cause: the morphing context used for checking whether an explicit null check is required has fairly non-obvious propagation rules. In particular, it does not get "reset" for arbitrary users, but passed as-is.

[ghost]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Reproduction:

Console.WriteLine(Problem(null));

[MethodImpl(MethodImplOptions.NoInlining)]
static int Problem(StructWithIndex* s)
{
    return *(int*)((nint)(int*)&s->Value | -1);
}

struct StructWithIndex
{
    public int Index;
    public int Value;
}

Compile and run.

Expected result: NullReferenceException is thrown.

Actual result: AccessViolationException is thrown.

Cause: the morphing context used for checking whether an explicit null check is required has fairly non-obvious propagation rules. In particular, it does not get "reset" for arbitrary users, but passed as-is.

Author:	SingleAccretion
Assignees:	SingleAccretion
Labels:	bug, area-CodeGen-coreclr
Milestone:	8.0.0