Skip to content

Span index access not eliminating bounds checks depending on access order #116088

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
ovska opened this issue May 29, 2025 · 2 comments · Fixed by #116105
Closed

Span index access not eliminating bounds checks depending on access order #116088

ovska opened this issue May 29, 2025 · 2 comments · Fixed by #116105
Assignees
@EgorBo
Labels
area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
Milestone
10.0.0

Comments

@ovska
Copy link

ovska commented May 29, 2025

Description

When accessing span items by Index from end, some patterns do not eliminate the bounds check.

Reproduction Steps

Access a span by both its' first and last item. Both accesses incur an index bounds check, despite the s[0] ensuring the span is non-empty. Accessing s[^1] first eliminates the second bounds check.

IsEmpty and an explicit Length != 0 checks seem to work properly, e.g. s.IsEmpty ? -1 : s[0].

Expected behavior

public static int Bounds2(ReadOnlySpan<byte> s)
{
    byte sz = s[^1];
    byte s0 = s[0];
    return s0 + sz;
}
; Method ConsoleApp7.TestClass:Bounds2(System.ReadOnlySpan`1[ubyte]):int (FullOpts)
G_M000_IG01:                ;; offset=0x0000
       sub      rsp, 40

G_M000_IG02:                ;; offset=0x0004
       mov      rax, bword ptr [rcx]
       mov      ecx, dword ptr [rcx+0x08]
       lea      edx, [rcx-0x01]
       cmp      edx, ecx
       jae      SHORT G_M000_IG04
       mov      ecx, edx
       movzx    rcx, byte  ptr [rax+rcx]
       movzx    rax, byte  ptr [rax]
       add      eax, ecx

G_M000_IG03:                ;; offset=0x001C
       add      rsp, 40
       ret      

G_M000_IG04:                ;; offset=0x0021
       call     CORINFO_HELP_RNGCHKFAIL
       int3     
; Total bytes of code: 39

Actual behavior

Both accesses cause a range check.

public static int Bounds1(ReadOnlySpan<byte> s)
{
    byte s0 = s[0];
    byte sz = s[^1];
    return s0 + sz;
}
; Method ConsoleApp7.TestClass:Bounds1(System.ReadOnlySpan`1[ubyte]):int (FullOpts)
G_M000_IG01:                ;; offset=0x0000
       sub      rsp, 40

G_M000_IG02:                ;; offset=0x0004
       mov      rax, bword ptr [rcx]
       mov      ecx, dword ptr [rcx+0x08]
       test     ecx, ecx
       je       SHORT G_M000_IG04
       movzx    rdx, byte  ptr [rax]
       lea      r8d, [rcx-0x01]
       cmp      r8d, ecx
       jae      SHORT G_M000_IG04
       mov      ecx, r8d
       movzx    rax, byte  ptr [rax+rcx]
       add      eax, edx

G_M000_IG03:                ;; offset=0x0023
       add      rsp, 40
       ret      

G_M000_IG04:                ;; offset=0x0028
       call     CORINFO_HELP_RNGCHKFAIL
       int3     
; Total bytes of code: 46

Regression?

No response

Known Workarounds

Swap the operations or use unsafe code for the second access (which generates roughly the same ASM as the swapped version). This is obviously not a huge deal unless you are writing high-performance code without resorting to Unsafe & friends.

Configuration

dotnet --version: 9.0.203
dotnet build -f net9.0 -c Release -o bin\Release\net9.0\Disasmo-v5.9.2
DOTNET_TieredPGO=0
DOTNET_JitDisasmDiffable=0
DOTNET_TieredCompilation=0
DOTNET_ReadyToRun=1
DOTNET_TieredPGO_InstrumentOnlyHotCode=0
Windows 10 64bit ZEN2

Can also be seen on https://godbolt.org/z/4q66bo36n and on arm64 arch as well

Other information

No response
@dotnet-policy-service dotnet-policy-service bot added the untriaged New issue has not been triaged by the area owner label May 29, 2025
@github-actions github-actions bot added the area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI label May 29, 2025
@dotnet-policy-service Dotnet Policy Service
Copy link
Contributor

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

@EgorBo EgorBo self-assigned this May 29, 2025
@EgorBo EgorBo removed the untriaged New issue has not been triaged by the area owner label May 29, 2025
@EgorBo EgorBo added this to the Future milestone May 29, 2025
@EgorBo EgorBo mentioned this issue May 29, 2025
Merged
@EgorBo EgorBo modified the milestones: Future, 10.0.0 May 29, 2025
@EgorBo
Copy link
Member

EgorBo commented May 29, 2025

Thanks for reporting this, I've filed a PR to fix it: #116105

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@EgorBo EgorBo

Labels
area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI
Projects
None yet
Milestone
10.0.0
Development

Successfully merging a pull request may close this issue.

Remove redundant bounds checks around arr[arr.Length - cns] pattern EgorBo/runtime-1
2 participants
@EgorBo @ovska