Widen return values in CallTailCallTarget stubs

src/coreclr/jit/morph.cpp

@@ -8272,10 +8272,9 @@ GenTree* Compiler::fgCreateCallDispatcherAndGetResult(GenTreeCall*          orig
     // void DispatchTailCalls(void* callersRetAddrSlot, void* callTarget, void* retValue)
 
     // Add return value arg.
-    GenTree*     retValArg;
-    GenTree*     retVal           = nullptr;
-    unsigned int newRetLcl        = BAD_VAR_NUM;
-    GenTree*     copyToRetBufNode = nullptr;
+    GenTree* retValArg;
+    GenTree* retVal           = nullptr;
+    GenTree* copyToRetBufNode = nullptr;
 
     if (origCall->HasRetBufArg())
     {
@@ -8326,24 +8325,26 @@ GenTree* Compiler::fgCreateCallDispatcherAndGetResult(GenTreeCall*          orig
     else if (origCall->gtType != TYP_VOID)
     {
         JITDUMP("Creating a new temp for the return value\n");
-        newRetLcl = lvaGrabTemp(false DEBUGARG("Return value for tail call dispatcher"));
+        unsigned int newRetLcl = lvaGrabTemp(false DEBUGARG("Return value for tail call dispatcher"));
         if (varTypeIsStruct(origCall->gtType))
         {
             lvaSetStruct(newRetLcl, origCall->gtRetClsHnd, false);
         }
         else
         {
-            // Since we pass a reference to the return value to the dispatcher
-            // we need to use the real return type so we can normalize it on
-            // load when we return it.
-            lvaTable[newRetLcl].lvType = (var_types)origCall->gtReturnType;
+            // It is the responsibility of the call-tail-call-target stub to
+            // normalize the return value in the same way that we would do it
+            // when it is stored. It is not possible for us to normalize it as
+            // we don't know which eventual tailcaller may have written it, and
+            // the type of that tailcaller could potentially be narrower than
+            // this call. See TailCallHelp::NeedsReturnWidening.
+            lvaTable[newRetLcl].lvType = origCall->gtType;
         }
 
         lvaSetVarAddrExposed(newRetLcl);
 
-        retValArg =
-            gtNewOperNode(GT_ADDR, TYP_I_IMPL, gtNewLclvNode(newRetLcl, genActualType(lvaTable[newRetLcl].lvType)));
-        retVal = gtNewLclvNode(newRetLcl, genActualType(lvaTable[newRetLcl].lvType));
+        retValArg = gtNewOperNode(GT_ADDR, TYP_I_IMPL, gtNewLclvNode(newRetLcl, lvaTable[newRetLcl].lvType));
+        retVal    = gtNewLclvNode(newRetLcl, lvaTable[newRetLcl].lvType);
 
         if (varTypeIsStruct(origCall->gtType))
         {

src/coreclr/vm/tailcallhelp.cpp

@@ -254,6 +254,28 @@ TypeHandle TailCallHelp::NormalizeSigType(TypeHandle tyHnd)
     return tyHnd;
 }
 
+// The managed calling convention requires that return types are widened up to 4 bytes.
+// This needs to be mirrored when storing the return value.
+bool TailCallHelp::NeedsReturnWidening(TypeHandle tyHnd, bool* isSigned)
+{
+    CorElementType ety = tyHnd.GetSignatureCorElementType();
+    switch (ety)
+    {
+    case ELEMENT_TYPE_I1:
+    case ELEMENT_TYPE_I2:
+        *isSigned = true;
+        return true;
+    case ELEMENT_TYPE_BOOLEAN:
+    case ELEMENT_TYPE_CHAR:
+    case ELEMENT_TYPE_U1:
+    case ELEMENT_TYPE_U2:
+        *isSigned = false;
+        return true;
+    default:
+        return false;
+    }
+}
+
 bool TailCallHelp::GenerateGCDescriptor(
     MethodDesc* pTargetMD, const ArgBufferLayout& layout, GCRefMapBuilder* builder)
 {
@@ -579,7 +601,20 @@ MethodDesc* TailCallHelp::CreateCallTargetStub(const TailCallInfo& info)
 
         pCode->EmitLDARG(ARG_RET_VAL);
         pCode->EmitLDLOC(resultLcl);
-        EmitStoreTyHnd(pCode, info.RetTyHnd);
+        bool isSigned;
+        if (NeedsReturnWidening(info.RetTyHnd, &isSigned))
+        {
+            if (isSigned)
+                pCode->EmitCONV_I4();
+            else
+                pCode->EmitCONV_U4();
+
+            pCode->EmitSTIND_I4();
+        }
+        else
+        {
+            EmitStoreTyHnd(pCode, info.RetTyHnd);
+        }
     }
 
     pCode->EmitRET();

src/coreclr/vm/tailcallhelp.h

@@ -30,6 +30,7 @@ class TailCallHelp
         MetaSig& callSiteSig, MethodDesc* calleeMD,
         bool storeTarget, bool thisArgByRef, bool hasInstArg, ArgBufferLayout* layout);
     static TypeHandle NormalizeSigType(TypeHandle tyHnd);
+    static bool NeedsReturnWidening(TypeHandle tyHnd, bool* isSigned);
     static bool GenerateGCDescriptor(MethodDesc* pTargetMD, const ArgBufferLayout& values, GCRefMapBuilder* builder);
 
     static MethodDesc* CreateStoreArgsStub(TailCallInfo& info);

src/tests/JIT/Regression/JitBlue/Runtime_55253/Runtime_55253.cs

@@ -0,0 +1,21 @@
+class Runtime_55253
+{
+    static int Main()
+    {
+        int errors = 0;
+        if (AsInt32() != -1)
+            errors |= 1;
+        if (AsUInt32() != 255)
+            errors |= 2;
+
+        return 100 + errors;
+    }
+
+    static uint AsUInt32() => AsUInt16();
+    static uint AsUInt16() => AsUInt8();
+    static uint AsUInt8() => 255;
+
+    static int AsInt32() => AsInt16();
+    static short AsInt16() => AsInt8();
+    static sbyte AsInt8() => -1;
+}

src/tests/JIT/Regression/JitBlue/Runtime_55253/Runtime_55253.csproj

@@ -0,0 +1,22 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+  </PropertyGroup>
+  <PropertyGroup>
+    <DebugType>None</DebugType>
+    <Optimize>False</Optimize>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="$(MSBuildProjectName).cs" />
+  </ItemGroup>
+  <PropertyGroup>
+    <CLRTestBatchPreCommands><![CDATA[
+$(CLRTestBatchPreCommands)
+set DOTNET_TailcallStress=1
+]]></CLRTestBatchPreCommands>
+    <BashCLRTestPreCommands><![CDATA[
+$(BashCLRTestPreCommands)
+export DOTNET_TailcallStress=1
+]]></BashCLRTestPreCommands>
+  </PropertyGroup>
+</Project>