JIT: Remove boxing from value type instance calls

[jakobbotsch]

Readds the optimization that we removed in
3206a8e, this time applying the optimization only when permitted by looking for RefSafetyRulesAttribute and UnscopedRef.

Depends on #130863
Fix #130185

Diff for `AsyncTaskMethodBuilder.AwaitUnsafeOnCompleted`

 ; Assembly listing for method System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1[System.Threading.Tasks.VoidTaskResult]:AwaitUnsafeOnCompleted[System.Runtime.CompilerServices.ValueTaskAwaiter`1[int]](byref,System.Runtime.CompilerServices.IAsyncStateMachineBox) (FullOpts)
 ; Emitting BLENDED_CODE for x64 + VEX on Windows
 ; FullOpts code
 ; optimized code
 ; optimized using Synthesized PGO
 ; rbp based frame
 ; fully interruptible
 ; with Synthesized PGO: fgCalledCount is 73.40032
 ; No PGO data
 ; Final local variable assignments
 ;
-;  V00 arg0         [V00,T00] (  4,  4   )   byref  ->  rbx         single-def
-;  V01 arg1         [V01,T03] (  3,  3   )     ref  ->  rsi         class-hnd single-def <System.Runtime.CompilerServices.IAsyncStateMachineBox>
+;  V00 arg0         [V00,T00] (  4,  4   )   byref  ->  rcx         single-def
+;  V01 arg1         [V01,T01] (  3,  3   )     ref  ->  rdx         class-hnd single-def <System.Runtime.CompilerServices.IAsyncStateMachineBox>
 ;* V02 loc0         [V02    ] (  0,  0   )  struct (16) zero-ref    do-not-enreg[S] ld-addr-op <System.Runtime.CompilerServices.ValueTaskAwaiter`1[int]>
 ;* V03 loc1         [V03    ] (  0,  0   )   byref  ->  zero-ref   
 ;* V04 loc2         [V04    ] (  0,  0   )     int  ->  zero-ref    ld-addr-op
 ;  V05 OutArgs      [V05    ] (  1,  1   )  struct (32) [rsp+0x00]  do-not-enreg[XS] addr-exposed "OutgoingArgSpace" <UNNAMED>
 ;* V06 tmp1         [V06    ] (  0,  0   )  struct (16) zero-ref    do-not-enreg[S] "spilling side-effects" <System.Runtime.CompilerServices.ValueTaskAwaiter`1[int]>
 ;* V07 tmp2         [V07    ] (  0,  0   )  struct (16) zero-ref    do-not-enreg[S] "spilling side-effects" <System.Runtime.CompilerServices.ValueTaskAwaiter`1[int]>
 ;* V08 tmp3         [V08    ] (  0,  0   )  struct (16) zero-ref    do-not-enreg[S] "spilling side-effects" <System.Runtime.CompilerServices.ValueTaskAwaiter`1[int]>
-;  V09 tmp4         [V09,T04] (  2,  4   )     ref  ->  rax         class-hnd exact single-def "Single-def Box Helper" <System.Runtime.CompilerServices.ValueTaskAwaiter`1[int]>
-;  V10 tmp5         [V10,T06] (  2,  0.00)     ref  ->  rcx         class-hnd single-def "impSpillSpecialSideEff" <System.Exception>
-;  V11 cse0         [V11,T05] (  3,  3   )   byref  ->  rdi         "CSE #01: aggressive"
-;  V12 rat0         [V12,T01] (  3,  6   )   byref  ->  r14         "ReplaceWithLclVar is creating a new local variable"
-;  V13 rat1         [V13,T02] (  3,  6   )   byref  ->  rbx         "ReplaceWithLclVar is creating a new local variable"
+;  V09 tmp4         [V09    ] (  2,  4   )  struct (16) [rbp-0x10]  do-not-enreg[XS] must-init addr-exposed ld-addr-op class-hnd exact "Single-def Box Helper" <System.Runtime.CompilerServices.ValueTaskAwaiter`1[int]>
+;  V10 tmp5         [V10,T02] (  2,  0.00)     ref  ->  rcx         class-hnd single-def "impSpillSpecialSideEff" <System.Exception>
 ;
-; Lcl frame size = 32
+; Lcl frame size = 48
 
 G_M37897_IG01:
        push     rbp
-       push     r14
-       push     rdi
-       push     rsi
-       push     rbx
-       sub      rsp, 32
-       lea      rbp, [rsp+0x40]
-       mov      rbx, rcx
-       mov      rsi, rdx
-						;; size=21 bbWeight=1 PerfScore 6.25
+       sub      rsp, 48
+       lea      rbp, [rsp+0x30]
+       xor      eax, eax
+       mov      qword ptr [rbp-0x10], rax
+						;; size=16 bbWeight=1 PerfScore 3.00
 G_M37897_IG02:
-       cmp      byte  ptr [rbx], bl
+       cmp      byte  ptr [rcx], cl
 						;; size=2 bbWeight=1 PerfScore 2.00
 G_M37897_IG03:
-       mov      rcx, 0xD1FFAB1E      ; System.Runtime.CompilerServices.ValueTaskAwaiter`1[int]
-       call     CORINFO_HELP_NEWSFAST
-       lea      rdi, bword ptr [rax+0x08]
-       mov      r14, rdi
-       mov      rdx, gword ptr [rbx]
-       mov      rcx, r14
-       call     CORINFO_HELP_ASSIGN_REF
-       mov      rcx, qword ptr [rbx+0x08]
-       mov      qword ptr [r14+0x08], rcx
-       mov      rcx, rdi
-       mov      rdx, rsi
+       vmovdqu  xmm0, xmmword ptr [rcx]
+       vmovdqu  xmmword ptr [rbp-0x10], xmm0
+						;; size=9 bbWeight=1 PerfScore 3.00
+G_M37897_IG04:
+       lea      rcx, [rbp-0x10]
        call     [System.Runtime.CompilerServices.ValueTaskAwaiter`1[int]:System.Runtime.CompilerServices.IStateMachineBoxAwareAwaiter.AwaitUnsafeOnCompleted(System.Runtime.CompilerServices.IAsyncStateMachineBox):this]
        nop      
-						;; size=54 bbWeight=1 PerfScore 12.00
-G_M37897_IG04:
-       add      rsp, 32
-       pop      rbx
-       pop      rsi
-       pop      rdi
-       pop      r14
+						;; size=11 bbWeight=1 PerfScore 3.75
+G_M37897_IG05:
+       add      rsp, 48
        pop      rbp
        ret      
-						;; size=11 bbWeight=1.00 PerfScore 3.75
-G_M37897_IG05:
+						;; size=6 bbWeight=1.00 PerfScore 1.75
+G_M37897_IG06:
        sub      rsp, 40
 						;; size=4 bbWeight=0.00 PerfScore 0.00
-G_M37897_IG06:
+G_M37897_IG07:
        xor      rdx, rdx
        call     [System.Threading.Tasks.Task:ThrowAsync(System.Exception,System.Threading.SynchronizationContext)]
-       lea      rax, G_M37897_IG04
+       lea      rax, G_M37897_IG05
 						;; size=15 bbWeight=0.00 PerfScore 0.00
-G_M37897_IG07:
+G_M37897_IG08:
        add      rsp, 40
        ret      
 						;; size=5 bbWeight=0.00 PerfScore 0.00
 
-; Total bytes of code 112, prolog size 21, PerfScore 24.00, instruction count 36, allocated bytes for code 112 (MethodHash=e9416bf6) for method System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1[System.Threading.Tasks.VoidTaskResult]:AwaitUnsafeOnCompleted[System.Runtime.CompilerServices.ValueTaskAwaiter`1[int]](byref,System.Runtime.CompilerServices.IAsyncStateMachineBox) (FullOpts)
+; Total bytes of code 68, prolog size 16, PerfScore 13.50, instruction count 20, allocated bytes for code 68 (MethodHash=e9416bf6) for method System.Runtime.CompilerServices.AsyncTaskMethodBuilder`1[System.Threading.Tasks.VoidTaskResult]:AwaitUnsafeOnCompleted[System.Runtime.CompilerServices.ValueTaskAwaiter`1[int]](byref,System.Runtime.CompilerServices.IAsyncStateMachineBox) (FullOpts)
 ; ============================================================

[azure-pipelines]

Azure Pipelines:
Successfully started running 6 pipeline(s).
9 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR reintroduces a JIT optimization to eliminate boxing for certain value-type instance calls by allowing the JIT to ask the runtime whether the value-type receiver (this) can escape the callee, based on RefSafetyRulesAttribute opt-in and [UnscopedRef] annotations.

Changes:

• Adds a new JIT↔EE interface method canValueClassInstancePointerEscape (and updates versioning, thunks, wrappers, SuperPMI recording/replay).
• Implements CoreCLR + managed (R2R/NativeAOT tooling) logic to determine escape eligibility using module-scoped RefSafetyRulesAttribute and method-scoped UnscopedRefAttribute.
• Updates the JIT importer to replace eligible heap boxes with a stack-local copy when calling an unboxed entry point, and tracks a new JIT metric for this optimization.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/coreclr/vm/wellknownattributes.h	Adds UnscopedRef / RefSafetyRules to well-known attribute handling (incl. R2R awareness asserts).
src/coreclr/vm/jitinterface.cpp	Implements CEEInfo::canValueClassInstancePointerEscape and module opt-in parsing via RefSafetyRulesAttribute.
src/coreclr/tools/superpmi/superpmi/icorjitinfo.cpp	Records/replays the new JIT↔EE API call in SuperPMI.
src/coreclr/tools/superpmi/superpmi-shim-simple/icorjitinfo_generated.cpp	Forwards the new API in the simple shim.
src/coreclr/tools/superpmi/superpmi-shim-counter/icorjitinfo_generated.cpp	Adds call counting for the new API in the counter shim.
src/coreclr/tools/superpmi/superpmi-shim-collector/icorjitinfo.cpp	Records the new API result in the collector shim.
src/coreclr/tools/superpmi/superpmi-shared/methodcontext.h	Adds MethodContext packet + API record/replay declarations for the new call.
src/coreclr/tools/superpmi/superpmi-shared/methodcontext.cpp	Implements MethodContext record/dump/replay storage for the new call.
src/coreclr/tools/superpmi/superpmi-shared/lwmlist.h	Adds an LWM map for CanValueClassInstancePointerEscape.
src/coreclr/tools/Common/JitInterface/ThunkGenerator/ThunkInput.txt	Adds the new interface method to thunk generation input.
src/coreclr/tools/Common/JitInterface/CorInfoImpl.cs	Implements the managed-side escape check using metadata attributes.
src/coreclr/tools/Common/JitInterface/CorInfoImpl_generated.cs	Wires the new callback through the generated unmanaged entrypoints.
src/coreclr/tools/aot/jitinterface/jitinterface_generated.h	Adds the new callback/wrapper for the AOT JIT interface wrapper.
src/coreclr/tools/aot/ILCompiler.ReadyToRun/Compiler/DependencyAnalysis/ReadyToRun/AttributePresenceFilterNode.cs	Ensures [UnscopedRef] is tracked in the R2R attribute presence table.
src/coreclr/jit/jitmetadatalist.h	Adds a new metric counter for “removed box” devirtualized calls.
src/coreclr/jit/importercalls.cpp	Uses the new escape query to replace eligible heap boxes with a local copy when calling unboxed entrypoints.
src/coreclr/jit/ICorJitInfo_wrapper_generated.hpp	Adds wrapper plumbing for the new interface method.
src/coreclr/jit/ICorJitInfo_names_generated.h	Adds the method name entry for the interface.
src/coreclr/jit/gentree.cpp	Extends gtTryRemoveBoxUpstreamEffects with BR_MAKE_LOCAL_COPY transformation support.
src/coreclr/jit/compiler.h	Adds BR_MAKE_LOCAL_COPY option to BoxRemovalOptions.
src/coreclr/inc/jiteeversionguid.h	Bumps the JIT↔EE interface GUID for versioning.
src/coreclr/inc/icorjitinfoimpl_generated.h	Adds the new method declaration to the generated EE-side impl header.
src/coreclr/inc/corinfo.h	Adds the new ICorStaticInfo::canValueClassInstancePointerEscape API contract.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

src/coreclr/jit/gentree.cpp:16859

• When converting the box temp local from TYP_REF to a struct local, lvaSetStruct is invoked with unsafeValueClsCheck forced to false. This can skip the CORINFO_FLG_UNSAFE_VALUECLASS check and fail to mark the local as an unsafe buffer / require a GS cookie, which is a correctness+security issue for value types flagged as unsafe value classes.

Use unsafeValueClsCheck: true here so the JIT preserves existing GS cookie behavior for such structs.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.

[azure-pipelines]

Azure Pipelines:
Successfully started running 6 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[jakobbotsch]

cc @dotnet/jit-contrib PTAL @AndyAyersMS @jkotas

This was mostly written by Copilot (reverting the removal and the VM/crossgen2 attribute parsing part).

[AndyAyersMS]

I take it SPC has already opted into ref safety? It does. Looks like Roslyn adds this.

MihuBot (or similar) should show diffs in the key async methods we're targeting.

[AndyAyersMS]

JIT/SPMI changes LGTM.

[MichalStrehovsky]

How often is JIT going to ask this question? Wondering if these two attribute lookups would need to be promoted into something that the type system knows about and caches as bits.