Regression: Extra range check generated

[rameel]

In the latest .NET build, additional range checks are introduced when slicing a span.

godbolt

A repro:

public static int Test(ReadOnlySpan<char> s)
{
    while (s.Length != 0)
    {
        if (s[^1] != ' ')
            break;

        s = s.Slice(0, s.Length - 1);
    }
    
    return s.Length;
}

trunk-20250427+cb4581af6e:

Sample:Test(System.ReadOnlySpan`1[ushort]):int (FullOpts):
       push     rbp
       mov      rbp, rsp
       test     esi, esi
       je       SHORT G_M44937_IG04
       align    [8 bytes for IG03]
G_M44937_IG03:  ;; offset=0x0010
       lea      eax, [rsi-0x01]
       mov      ecx, eax
       cmp      ecx, esi                   ; <---- extra check
       jae      SHORT G_M44937_IG07        ; <----
       cmp      word  ptr [rdi+2*rcx], 32
       jne      SHORT G_M44937_IG04
       cmp      eax, esi
       ja       SHORT G_M44937_IG06
       mov      esi, eax
       test     esi, esi
       jne      SHORT G_M44937_IG03
G_M44937_IG04:  ;; offset=0x002A
       mov      eax, esi
       pop      rbp
       ret      
G_M44937_IG06:  ;; offset=0x002E
       call     [System.ThrowHelper:ThrowArgumentOutOfRangeException()]
       int3     
G_M44937_IG07:  ;; offset=0x0035
       call     CORINFO_HELP_RNGCHKFAIL
       int3     

9.0.2:

Sample:Test(System.ReadOnlySpan`1[ushort]):int (FullOpts):
       push     rbp
       mov      rbp, rsp
G_M44937_IG02:  ;; offset=0x0004
       test     esi, esi
       je       SHORT G_M44937_IG04
       lea      eax, [rsi-0x01]
       mov      ecx, eax
       cmp      word  ptr [rdi+2*rcx], 32
       jne      SHORT G_M44937_IG04
       cmp      eax, esi
       ja       SHORT G_M44937_IG06
       mov      esi, eax
       jmp      SHORT G_M44937_IG02
G_M44937_IG04:  ;; offset=0x001C
       mov      eax, esi
       pop      rbp
       ret      
G_M44937_IG06:  ;; offset=0x0020
       call     [System.ThrowHelper:ThrowArgumentOutOfRangeException()]
       int3     

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[rameel]

If the loop condition is slightly modified, .NET 9 is able to eliminate all unnecessary checks, while in the latest build there are still two redundant range checks.

godbolt

public static int Test(ReadOnlySpan<char> s)
{
    while ((uint)s.Length - 1 < (uint)s.Length) // loop condition changed
    {
        if (s[^1] != ' ')
            break;

        s = s.Slice(0, s.Length - 1);
    }
    
    return s.Length;
}

Sample:Test(System.ReadOnlySpan`1[ushort]):int (FullOpts):
       push     rbp
       mov      rbp, rsp
G_M44937_IG02:  ;; offset=0x0004
       lea      eax, [rsi-0x01]
       cmp      eax, esi
       jae      SHORT G_M44937_IG04
       mov      ecx, eax
       cmp      word  ptr [rdi+2*rcx], 32
       jne      SHORT G_M44937_IG04
       mov      esi, eax
       jmp      SHORT G_M44937_IG02
G_M44937_IG04:  ;; offset=0x0018
       mov      eax, esi
       pop      rbp
       ret      

[JulieLeeMSFT]

CC @dotnet/jit-contrib.