JIT: restore type-based upper bound for RSZ in range analysis

PR #122263 unified RSZ/RSH range computation, dropping the type-based

fallback that derives the upper bound from op1's bit-width when r1's

range isn't a useful constant. As a result, patterns like

`vals[i >>> 31]` against a length-2 span no longer had their bounds

check eliminated.

Pass op1's bit-width to `RangeOps::ShiftRight` and, for logical shifts:

- when `minShift >= 1`, force the lower bound to 0 (high bit cleared),

- derive an upper bound of `UMAX(op1Type) >> minShift` and intersect with

  any bound already derived from r1.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: EgorBo

src/coreclr/jit/rangecheck.cpp

@@ -1748,6 +1748,8 @@ Range RangeCheck::ComputeRangeForBinOp(BasicBlock* block, GenTreeOp* binop, bool
             r = RangeOps::ShiftRight(op1Range, op2Range, /*logical*/ false);
             break;
         case GT_RSZ:
+            // RSZ here is always 32-bit: TYP_LONG is bailed out by GetRangeWorker.
+            assert(genActualType(op1) == TYP_INT);
             r = RangeOps::ShiftRight(op1Range, op2Range, /*logical*/ true);
             break;
         case GT_LSH:

src/coreclr/jit/rangecheck.h

@@ -402,24 +402,45 @@ struct RangeOps
         Range result = Limit(Limit::keUnknown);
 
         // For SHR we require the rhs to be a constant range within [0..31].
-        // We only perform the shift if the lhs is also a constant range (never-negative for now
-        // to handle both logical and arithmetic shifts uniformly).
         if (!r2.IsConstantRange() || (static_cast<unsigned>(r2.LowerLimit().GetConstant()) > 31) ||
             (static_cast<unsigned>(r2.UpperLimit().GetConstant()) > 31))
         {
             return result;
         }
 
-        // We shift by r2.UpperLimit() for the lower limit and by r2.LowerLimit() for the upper limit.
-        // Example: [0..65535] >> [0..3] = [0 >> 3 .. 65535 >> 0] = [0..65535]
-        //          [0..65535] >> [2..2] = [0 >> 2 .. 65535 >> 2] = [0..16383]
-        if (r1.LowerLimit().IsConstant() && (r1.LowerLimit().GetConstant() >= 0))
+        const int  minShift          = r2.LowerLimit().GetConstant();
+        const int  maxShift          = r2.UpperLimit().GetConstant();
+        const bool r1KnownNonNegLow  = r1.LowerLimit().IsConstant() && (r1.LowerLimit().GetConstant() >= 0);
+        const bool r1KnownNonNegHigh = r1.UpperLimit().IsConstant() && (r1.UpperLimit().GetConstant() >= 0);
+
+        // Shift by maxShift for the lower limit and by minShift for the upper limit.
+        // Example: [0..65535] >> [0..3] = [0..65535],  [0..65535] >> [2..2] = [0..16383]
+        if (r1KnownNonNegLow)
         {
-            result.lLimit = Limit(Limit::keConstant, r1.LowerLimit().GetConstant() >> r2.UpperLimit().GetConstant());
+            result.lLimit = Limit(Limit::keConstant, r1.LowerLimit().GetConstant() >> maxShift);
         }
-        if (r1.UpperLimit().IsConstant() && (r1.UpperLimit().GetConstant() >= 0))
+        else if (logical && (minShift >= 1))
         {
-            result.uLimit = Limit(Limit::keConstant, r1.UpperLimit().GetConstant() >> r2.LowerLimit().GetConstant());
+            // RSZ by >= 1 always clears the high bit, so result >= 0 regardless of r1's sign.
+            result.lLimit = Limit(Limit::keConstant, 0);
+        }
+
+        // For RSZ, r1.UpperLimit() is only a sound upper bound when r1 is fully non-negative
+        // (negative r1 values reinterpret as large unsigned values). RSH preserves it either way.
+        if (r1KnownNonNegHigh && (!logical || r1KnownNonNegLow))
+        {
+            result.uLimit = Limit(Limit::keConstant, r1.UpperLimit().GetConstant() >> minShift);
+        }
+
+        // RSZ always satisfies result <= UINT_MAX >> minShift (RSZ here is always 32-bit: TYP_LONG
+        // is bailed out by GetRangeWorker, and CIL shifts have no small-typed operands).
+        if (logical && (minShift >= 1))
+        {
+            const int typeBasedUpper = static_cast<int>(UINT32_MAX >> minShift);
+            if (!result.uLimit.IsConstant() || (result.uLimit.GetConstant() > typeBasedUpper))
+            {
+                result.uLimit = Limit(Limit::keConstant, typeBasedUpper);
+            }
         }
         return result;
     }

src/tests/JIT/opt/RangeChecks/ElidedBoundsChecks.cs

@@ -95,6 +95,37 @@ static bool TryStripFirstChar(ref ReadOnlySpan<char> span, char value)
         return false;
     }
 
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    static int UnsignedShiftBySignBit(int i)
+    {
+        // X64-NOT: CORINFO_HELP_RNGCHKFAIL
+        // ARM64-NOT: CORINFO_HELP_RNGCHKFAIL
+        ReadOnlySpan<int> vals = [0, 1];
+        return vals[i >>> 31];
+    }
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    static int UnsignedShiftByConst(int i)
+    {
+        // X64-NOT: CORINFO_HELP_RNGCHKFAIL
+        // ARM64-NOT: CORINFO_HELP_RNGCHKFAIL
+        ReadOnlySpan<int> vals = [0, 10, 20, 30, 40, 50, 60, 70, 80, 90, 100, 110, 120, 130, 140, 150];
+        return vals[i >>> 28];
+    }
+
+    [MethodImpl(MethodImplOptions.NoInlining)]
+    static int UnsignedShiftStraddlingRange(int i)
+    {
+        // i is in [-9..99] (straddles zero). For i=-1, (i >>> 5) is 134217727, so the
+        // bounds check MUST be preserved (no X64-NOT marker).
+        ReadOnlySpan<int> vals = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];
+        if (i > -10 && i < 100)
+        {
+            return vals[i >>> 5];
+        }
+        return -1;
+    }
+
     [Fact]
     public static int TestEntryPoint()
     {
@@ -139,6 +170,33 @@ public static int TestEntryPoint()
         if (TryStripFirstChar(ref chars, 'h') != false)
             return 0;
 
+        if (UnsignedShiftBySignBit(0) != 0)
+            return 0;
+
+        if (UnsignedShiftBySignBit(-1) != 1)
+            return 0;
+
+        if (UnsignedShiftBySignBit(int.MaxValue) != 0)
+            return 0;
+
+        if (UnsignedShiftByConst(0) != 0)
+            return 0;
+
+        if (UnsignedShiftByConst(-1) != 150)
+            return 0;
+
+        if (UnsignedShiftStraddlingRange(50) != 1)
+            return 0;
+        // For i=-1, (i >>> 5) is 134217727; the bounds check must throw, not be elided.
+        try
+        {
+            UnsignedShiftStraddlingRange(-1);
+            return 0;
+        }
+        catch (IndexOutOfRangeException)
+        {
+        }
+
         return 100;
     }
 }