Split StackType.O into StackType.Obj+StackType.VT

[dgrunwald]

Object references and value types are quite different; so let's try keeping them in separate StackTypes throughout the whole compiler.
We have many assertions based on stack type comparisons, so the main effect of this change is to strengthen our invariants.

[dgrunwald]

Preexisting, but weird how the expected parameters are constructed based on the argument types.
Surely they should be based on the unexpanded parameter type instead?

Reviewed with Stampeded!

[siegfriedpammer]

decompdiff over the top-200 nuget.org corpus — master (dbf23c6) against this branch rebased onto that same commit, so the diff isolates the PR. 167 assemblies, 37,530 types.

Counters are flat and there are no new errors: 37,505 types byte-identical, 25 changed, 137 changed lines in total.

	old	new	delta
lines	4,055,141	4,055,142	+1
goto statements	2,315	2,315	0
//IL_ warnings	24,191	24,191	0
generated-name leaks	2,544	2,544	0

One of the 25 changes is a behavioural difference.

Invented (byte) cast truncates Regex character masks

7 of the changed types, all System.Text.RegularExpressions.Generated.*, in AWSSDK.Core, Dapper (x2), FluentValidation, OpenTelemetry and Renci.SshNet (x2).

// master
if (((c = span[i]) < 0x80 ? (mask[c >> 4] & (1 << (c & 0xF)))
    : (CharInClass(c, "...") ? 1 : 0)) == 0)

// this branch
if (!((c = span[i]) < 0x80 ? ((byte)(mask[c >> 4] & (1 << (c & 0xF))) != 0)
    : CharInClass(c, "...")))

The bool-shaped conditional is an improvement and matches the shape the source generator actually emitted. The (byte) is not in the IL — there is no conv.u1 anywhere in the method:

IL_0053: ldstr "\0\0..."   // the mask table
IL_0058: ldloc.2
IL_0059: ldc.i4.4
IL_005a: shr               // c >> 4
IL_005b: call instance char String::get_Chars(int32)
IL_0060: ldc.i4.1
IL_0061: ldloc.2
IL_0062: ldc.i4.s 15
IL_0064: and               // c & 15
IL_0065: ldc.i4.s 31
IL_0067: and               // & 31
IL_0068: shl               // 1 << ((c & 15) & 31)  -> up to 32768
IL_0069: and               // mask[c >> 4] & bit
IL_006a: ldc.i4.0
IL_006b: cgt.un            // != 0

The shift count is (c & 15) & 31, so the masked value reaches 32768 and (byte) discards every bit from 8 up. With AWSSDK's mask[2] = U+7800, character '+' (0x2B) tests bit 11: master computes 0x800 != 0 and matches, this branch computes (byte)0x800 == 0 and does not. FluentValidation's mask holds U+FFFE and U+FFFF entries, so most of its character class is affected.

git bisect run over the branch points at 30552b0, Replace a couple of inst.ResultType -> IType conversions with InferType() calls — specifically one line in ExpressionBuilder.VisitIfInstruction, on the path that picks a target type for a conditional whose branches have no common type:

- targetType = FindType(inst.ResultType, context.TypeHint.GetSign());
+ targetType = inst.InferType(compilation);

The old form derived the type from the stack type, so an I4 conditional became int. InferType narrows from the operands instead: c & 15 has range 0–15 and fits a byte, but that inference must not survive shl, because 1 << n is not byte-ranged. Reverting just this line at the branch tip removes the cast.

One thing to note for a fix: the guard removed from VisitSwitchInstruction in the same commit would not have caught this either, since it compares GetStackType() and both byte and int are I4.

Repro:

ilspycmd ~/.cache/nugetfuzz/awssdk.core/4.0.102.4/lib/net8.0/AWSSDK.Core.dll \
    -t "System.Text.RegularExpressions.Generated.<RegexGenerator_g>F23AE...__RoleSessionNameRegex_0"

The other 18 changes

• 10 types differ only in warning text: //IL_xxxx: Expected O, but got Unknown becomes Expected Obj, from the enum rename.
• BoolToTwoValuesConverter<TProvider> now declines instead of emitting (TProvider v) => (object)v == (object)trueValue. Master compared box identity where the tree compares values, so this is a fix.
• Logging.Logger, DebuggerDisplayFormatting: LogLevel[] readOnlySpan becomes ReadOnlySpan<LogLevel>.
• StackExchange.Redis.Condition: RedisCommand num becomes redisCommand — inference now yields the enum rather than its underlying integer.
• SharpCompress ZStandard: (nint)(...) becomes (nint)((IntPtr)(...)). Same type, so semantically identical, just slightly worse to read.

Corpus caveats: four assemblies are undecompilable on both sides for missing references (System.Web.Mvc, Microsoft.Azure.WebJobs.Host, MongoDB.Driver, MongoDB.Driver.Core) and twelve more decompile with unresolved references. Those are identical on both sides, so they are corpus gaps rather than PR effects.

Posted by an AI agent (Claude) on Siegfried's behalf.