JIT: Add support for bounds check no throw assertions in range check and make overflow check more precise (#100777)

jakobbotsch · web-flow · commit 69110bfdcf55 · 2024-04-17T12:00:18.000+02:00
Fix #9422 Fix #83349
diff --git a/src/coreclr/jit/assertionprop.cpp b/src/coreclr/jit/assertionprop.cpp
@@ -769,9 +769,9 @@ void Compiler::optPrintAssertion(AssertionDsc* curAssertion, AssertionIndex asse
     }
     else if (curAssertion->op1.kind == O1K_ARR_BND)
     {
-        printf("[idx:");
+        printf("[idx: " FMT_VN, curAssertion->op1.bnd.vnIdx);
         vnStore->vnDump(this, curAssertion->op1.bnd.vnIdx);
-        printf(";len:");
+        printf("; len: " FMT_VN, curAssertion->op1.bnd.vnLen);
         vnStore->vnDump(this, curAssertion->op1.bnd.vnLen);
         printf("]");
     }
diff --git a/src/coreclr/jit/rangecheck.cpp b/src/coreclr/jit/rangecheck.cpp
@@ -353,7 +353,7 @@ void RangeCheck::OptimizeRangeCheck(BasicBlock* block, Statement* stmt, GenTree*
         return;
     }
 
-    if (DoesOverflow(block, treeIndex))
+    if (DoesOverflow(block, treeIndex, range))
     {
         JITDUMP("Method determined to overflow.\n");
         return;
@@ -773,6 +773,22 @@ void RangeCheck::MergeEdgeAssertions(ValueNum normalLclVN, ASSERT_VALARG_TP asse
 
             isConstantAssertion = true;
         }
+        // Current assertion asserts a bounds check does not throw
+        else if (curAssertion->IsBoundsCheckNoThrow())
+        {
+            ValueNum indexVN = curAssertion->op1.bnd.vnIdx;
+            ValueNum lenVN   = curAssertion->op1.bnd.vnLen;
+            if (normalLclVN == indexVN)
+            {
+                isUnsigned = true;
+                cmpOper    = GT_LT;
+                limit      = Limit(Limit::keBinOpArray, lenVN, 0);
+            }
+            else
+            {
+                continue;
+            }
+        }
         // Current assertion is not supported, ignore it
         else
         {
@@ -782,7 +798,8 @@ void RangeCheck::MergeEdgeAssertions(ValueNum normalLclVN, ASSERT_VALARG_TP asse
         assert(limit.IsBinOpArray() || limit.IsConstant());
 
         // Make sure the assertion is of the form != 0 or == 0 if it isn't a constant assertion.
-        if (!isConstantAssertion && (curAssertion->op2.vn != m_pCompiler->vnStore->VNZeroForType(TYP_INT)))
+        if (!isConstantAssertion && (curAssertion->assertionKind != Compiler::OAK_NO_THROW) &&
+            (curAssertion->op2.vn != m_pCompiler->vnStore->VNZeroForType(TYP_INT)))
         {
             continue;
         }
@@ -1235,17 +1252,17 @@ bool RangeCheck::MultiplyOverflows(Limit& limit1, Limit& limit2)
 }
 
 // Does the bin operation overflow.
-bool RangeCheck::DoesBinOpOverflow(BasicBlock* block, GenTreeOp* binop)
+bool RangeCheck::DoesBinOpOverflow(BasicBlock* block, GenTreeOp* binop, const Range& range)
 {
     GenTree* op1 = binop->gtGetOp1();
     GenTree* op2 = binop->gtGetOp2();
 
-    if (!m_pSearchPath->Lookup(op1) && DoesOverflow(block, op1))
+    if (!m_pSearchPath->Lookup(op1) && DoesOverflow(block, op1, range))
     {
         return true;
     }
 
-    if (!m_pSearchPath->Lookup(op2) && DoesOverflow(block, op2))
+    if (!m_pSearchPath->Lookup(op2) && DoesOverflow(block, op2, range))
     {
         return true;
     }
@@ -1279,7 +1296,7 @@ bool RangeCheck::DoesBinOpOverflow(BasicBlock* block, GenTreeOp* binop)
 }
 
 // Check if the var definition the rhs involves arithmetic that overflows.
-bool RangeCheck::DoesVarDefOverflow(GenTreeLclVarCommon* lcl)
+bool RangeCheck::DoesVarDefOverflow(BasicBlock* block, GenTreeLclVarCommon* lcl, const Range& range)
 {
     LclSsaVarDsc* ssaDef = GetSsaDefStore(lcl);
     if (ssaDef == nullptr)
@@ -1291,10 +1308,25 @@ bool RangeCheck::DoesVarDefOverflow(GenTreeLclVarCommon* lcl)
         }
         return true;
     }
-    return DoesOverflow(ssaDef->GetBlock(), ssaDef->GetDefNode()->Data());
+
+    // We can use intermediate assertions about the local to prove that any
+    // overflow on this path does not matter for the range computed.
+    Range assertionRange = Range(Limit(Limit::keUnknown));
+    MergeAssertion(block, lcl, &assertionRange DEBUGARG(0));
+
+    // But only if the range from the assertion is more strict than the global
+    // range computed; otherwise we might still have used the def's value to
+    // tighten the range of the global range.
+    Range merged = RangeOps::Merge(range, assertionRange, false);
+    if (merged.LowerLimit().Equals(range.LowerLimit()) && merged.UpperLimit().Equals(range.UpperLimit()))
+    {
+        return false;
+    }
+
+    return DoesOverflow(ssaDef->GetBlock(), ssaDef->GetDefNode()->Data(), range);
 }
 
-bool RangeCheck::DoesPhiOverflow(BasicBlock* block, GenTree* expr)
+bool RangeCheck::DoesPhiOverflow(BasicBlock* block, GenTree* expr, const Range& range)
 {
     for (GenTreePhi::Use& use : expr->AsPhi()->Uses())
     {
@@ -1303,25 +1335,38 @@ bool RangeCheck::DoesPhiOverflow(BasicBlock* block, GenTree* expr)
         {
             continue;
         }
-        if (DoesOverflow(block, arg))
+        if (DoesOverflow(block, arg, range))
         {
             return true;
         }
     }
     return false;
 }
 
-bool RangeCheck::DoesOverflow(BasicBlock* block, GenTree* expr)
+//------------------------------------------------------------------------
+// DoesOverflow: Check if the computation of "expr" may have overflowed.
+//
+// Arguments:
+//   block - the block that contains `expr`
+//   expr  - expression to check overflow of
+//   range - range that we believe "expr" to be in without accounting for
+//           overflow; used to ignore potential overflow on paths where
+//           we can prove the value is in this range regardless.
+//
+// Return value:
+//   True if the computation may have involved an impactful overflow.
+//
+bool RangeCheck::DoesOverflow(BasicBlock* block, GenTree* expr, const Range& range)
 {
     bool overflows = false;
     if (!GetOverflowMap()->Lookup(expr, &overflows))
     {
-        overflows = ComputeDoesOverflow(block, expr);
+        overflows = ComputeDoesOverflow(block, expr, range);
     }
     return overflows;
 }
 
-bool RangeCheck::ComputeDoesOverflow(BasicBlock* block, GenTree* expr)
+bool RangeCheck::ComputeDoesOverflow(BasicBlock* block, GenTree* expr, const Range& range)
 {
     JITDUMP("Does overflow [%06d]?\n", Compiler::dspTreeID(expr));
     m_pSearchPath->Set(expr, block, SearchPath::Overwrite);
@@ -1343,17 +1388,17 @@ bool RangeCheck::ComputeDoesOverflow(BasicBlock* block, GenTree* expr)
     }
     else if (expr->OperIs(GT_COMMA))
     {
-        overflows = ComputeDoesOverflow(block, expr->gtEffectiveVal());
+        overflows = ComputeDoesOverflow(block, expr->gtEffectiveVal(), range);
     }
     // Check if the var def has rhs involving arithmetic that overflows.
     else if (expr->IsLocal())
     {
-        overflows = DoesVarDefOverflow(expr->AsLclVarCommon());
+        overflows = DoesVarDefOverflow(block, expr->AsLclVarCommon(), range);
     }
     // Check if add overflows.
     else if (expr->OperIs(GT_ADD, GT_MUL))
     {
-        overflows = DoesBinOpOverflow(block, expr->AsOp());
+        overflows = DoesBinOpOverflow(block, expr->AsOp(), range);
     }
     // These operators don't overflow.
     // Actually, GT_LSH can overflow so it depends on the analysis done in ComputeRangeForBinOp
@@ -1364,11 +1409,11 @@ bool RangeCheck::ComputeDoesOverflow(BasicBlock* block, GenTree* expr)
     // Walk through phi arguments to check if phi arguments involve arithmetic that overflows.
     else if (expr->OperIs(GT_PHI))
     {
-        overflows = DoesPhiOverflow(block, expr);
+        overflows = DoesPhiOverflow(block, expr, range);
     }
     else if (expr->OperIs(GT_CAST))
     {
-        overflows = ComputeDoesOverflow(block, expr->gtGetOp1());
+        overflows = ComputeDoesOverflow(block, expr->gtGetOp1(), range);
     }
     GetOverflowMap()->Set(expr, overflows, OverflowMap::Overwrite);
     m_pSearchPath->Remove(expr);
diff --git a/src/coreclr/jit/rangecheck.h b/src/coreclr/jit/rangecheck.h
@@ -199,7 +199,7 @@ struct Limit
         return false;
     }
 
-    bool Equals(Limit& l)
+    bool Equals(const Limit& l) const
     {
         switch (type)
         {
@@ -262,11 +262,21 @@ struct Range
     {
     }
 
+    const Limit& UpperLimit() const
+    {
+        return uLimit;
+    }
+
     Limit& UpperLimit()
     {
         return uLimit;
     }
 
+    const Limit& LowerLimit() const
+    {
+        return lLimit;
+    }
+
     Limit& LowerLimit()
     {
         return lLimit;
@@ -440,12 +450,12 @@ struct RangeOps
 
     // Given two ranges "r1" and "r2", do a Phi merge. If "monIncreasing" is true,
     // then ignore the dependent variables for the lower bound but not for the upper bound.
-    static Range Merge(Range& r1, Range& r2, bool monIncreasing)
+    static Range Merge(const Range& r1, const Range& r2, bool monIncreasing)
     {
-        Limit& r1lo = r1.LowerLimit();
-        Limit& r1hi = r1.UpperLimit();
-        Limit& r2lo = r2.LowerLimit();
-        Limit& r2hi = r2.UpperLimit();
+        const Limit& r1lo = r1.LowerLimit();
+        const Limit& r1hi = r1.UpperLimit();
+        const Limit& r2lo = r2.LowerLimit();
+        const Limit& r2hi = r2.UpperLimit();
 
         // Take care of lo part.
         Range result = Limit(Limit::keUnknown);
@@ -689,19 +699,19 @@ class RangeCheck
     bool MultiplyOverflows(Limit& limit1, Limit& limit2);
 
     // Does the binary operation between the operands overflow? Check recursively.
-    bool DoesBinOpOverflow(BasicBlock* block, GenTreeOp* binop);
+    bool DoesBinOpOverflow(BasicBlock* block, GenTreeOp* binop, const Range& range);
 
     // Do the phi operands involve a definition that could overflow?
-    bool DoesPhiOverflow(BasicBlock* block, GenTree* expr);
+    bool DoesPhiOverflow(BasicBlock* block, GenTree* expr, const Range& range);
 
     // Find the def of the "expr" local and recurse on the arguments if any of them involve a
     // calculation that overflows.
-    bool DoesVarDefOverflow(GenTreeLclVarCommon* lcl);
+    bool DoesVarDefOverflow(BasicBlock* block, GenTreeLclVarCommon* lcl, const Range& range);
 
-    bool ComputeDoesOverflow(BasicBlock* block, GenTree* expr);
+    bool ComputeDoesOverflow(BasicBlock* block, GenTree* expr, const Range& range);
 
-    // Does the current "expr" which is a use involve a definition, that overflows.
-    bool DoesOverflow(BasicBlock* block, GenTree* tree);
+    // Does the current "expr", which is a use, involve a definition that overflows.
+    bool DoesOverflow(BasicBlock* block, GenTree* tree, const Range& range);
 
     // Widen the range by first checking if the induction variable is monotonically increasing.
     // Requires "pRange" to be partially computed.
diff --git a/src/libraries/System.Private.CoreLib/src/System/Collections/Generic/Dictionary.cs b/src/libraries/System.Private.CoreLib/src/System/Collections/Generic/Dictionary.cs
@@ -418,7 +418,6 @@ internal ref TValue FindValue(TKey key)
                     i--; // Value in _buckets is 1-based; subtract 1 from i. We do it here so it fuses with the following conditional.
                     do
                     {
-                        // Should be a while loop https://github.com/dotnet/runtime/issues/9422
                         // Test in if to drop range check for following array access
                         if ((uint)i >= (uint)entries.Length)
                         {
@@ -450,7 +449,6 @@ internal ref TValue FindValue(TKey key)
                     i--; // Value in _buckets is 1-based; subtract 1 from i. We do it here so it fuses with the following conditional.
                     do
                     {
-                        // Should be a while loop https://github.com/dotnet/runtime/issues/9422
                         // Test in if to drop range check for following array access
                         if ((uint)i >= (uint)entries.Length)
                         {
@@ -535,15 +533,8 @@ private bool TryInsert(TKey key, TValue value, InsertionBehavior behavior)
                 comparer == null)
             {
                 // ValueType: Devirtualize with EqualityComparer<TKey>.Default intrinsic
-                while (true)
+                while ((uint)i < (uint)entries.Length)
                 {
-                    // Should be a while loop https://github.com/dotnet/runtime/issues/9422
-                    // Test uint in if rather than loop condition to drop range check for following array access
-                    if ((uint)i >= (uint)entries.Length)
-                    {
-                        break;
-                    }
-
                     if (entries[i].hashCode == hashCode && EqualityComparer<TKey>.Default.Equals(entries[i].key, key))
                     {
                         if (behavior == InsertionBehavior.OverwriteExisting)
@@ -574,15 +565,8 @@ private bool TryInsert(TKey key, TValue value, InsertionBehavior behavior)
             else
             {
                 Debug.Assert(comparer is not null);
-                while (true)
+                while ((uint)i < (uint)entries.Length)
                 {
-                    // Should be a while loop https://github.com/dotnet/runtime/issues/9422
-                    // Test uint in if rather than loop condition to drop range check for following array access
-                    if ((uint)i >= (uint)entries.Length)
-                    {
-                        break;
-                    }
-
                     if (entries[i].hashCode == hashCode && comparer.Equals(entries[i].key, key))
                     {
                         if (behavior == InsertionBehavior.OverwriteExisting)
@@ -690,15 +674,8 @@ internal static class CollectionsMarshalHelper
                     comparer == null)
                 {
                     // ValueType: Devirtualize with EqualityComparer<TKey>.Default intrinsic
-                    while (true)
+                    while ((uint)i < (uint)entries.Length)
                     {
-                        // Should be a while loop https://github.com/dotnet/runtime/issues/9422
-                        // Test uint in if rather than loop condition to drop range check for following array access
-                        if ((uint)i >= (uint)entries.Length)
-                        {
-                            break;
-                        }
-
                         if (entries[i].hashCode == hashCode && EqualityComparer<TKey>.Default.Equals(entries[i].key, key))
                         {
                             exists = true;
@@ -720,15 +697,8 @@ internal static class CollectionsMarshalHelper
                 else
                 {
                     Debug.Assert(comparer is not null);
-                    while (true)
+                    while ((uint)i < (uint)entries.Length)
                     {
-                        // Should be a while loop https://github.com/dotnet/runtime/issues/9422
-                        // Test uint in if rather than loop condition to drop range check for following array access
-                        if ((uint)i >= (uint)entries.Length)
-                        {
-                            break;
-                        }
-
                         if (entries[i].hashCode == hashCode && comparer.Equals(entries[i].key, key))
                         {
                             exists = true;

Original file line number	Diff line number	Diff line change
`@@ -769,9 +769,9 @@ void Compiler::optPrintAssertion(AssertionDsc* curAssertion, AssertionIndex asse`
`769`	`769`	`}`
`770`	`770`	`else if (curAssertion->op1.kind == O1K_ARR_BND)`
`771`	`771`	`{`
`772`		`- printf("[idx:");`
	`772`	`+ printf("[idx: " FMT_VN, curAssertion->op1.bnd.vnIdx);`
`773`	`773`	`vnStore->vnDump(this, curAssertion->op1.bnd.vnIdx);`
`774`		`- printf(";len:");`
	`774`	`+ printf("; len: " FMT_VN, curAssertion->op1.bnd.vnLen);`
`775`	`775`	`vnStore->vnDump(this, curAssertion->op1.bnd.vnLen);`
`776`	`776`	`printf("]");`
`777`	`777`	`}`
Original file line number	Diff line number	Diff line change
`@@ -353,7 +353,7 @@ void RangeCheck::OptimizeRangeCheck(BasicBlock* block, Statement* stmt, GenTree*`
`353`	`353`	`return;`
`354`	`354`	`}`
`355`	`355`
`356`		`- if (DoesOverflow(block, treeIndex))`
	`356`	`+ if (DoesOverflow(block, treeIndex, range))`
`357`	`357`	`{`
`358`	`358`	`JITDUMP("Method determined to overflow.\n");`
`359`	`359`	`return;`
`@@ -773,6 +773,22 @@ void RangeCheck::MergeEdgeAssertions(ValueNum normalLclVN, ASSERT_VALARG_TP asse`
`773`	`773`
`774`	`774`	`isConstantAssertion = true;`
`775`	`775`	`}`
	`776`	`+ // Current assertion asserts a bounds check does not throw`
	`777`	`+ else if (curAssertion->IsBoundsCheckNoThrow())`
	`778`	`+ {`
	`779`	`+ ValueNum indexVN = curAssertion->op1.bnd.vnIdx;`
	`780`	`+ ValueNum lenVN = curAssertion->op1.bnd.vnLen;`
	`781`	`+ if (normalLclVN == indexVN)`
	`782`	`+ {`
	`783`	`+ isUnsigned = true;`
	`784`	`+ cmpOper = GT_LT;`
	`785`	`+ limit = Limit(Limit::keBinOpArray, lenVN, 0);`
	`786`	`+ }`
	`787`	`+ else`
	`788`	`+ {`
	`789`	`+ continue;`
	`790`	`+ }`
	`791`	`+ }`
`776`	`792`	`// Current assertion is not supported, ignore it`
`777`	`793`	`else`
`778`	`794`	`{`
`@@ -782,7 +798,8 @@ void RangeCheck::MergeEdgeAssertions(ValueNum normalLclVN, ASSERT_VALARG_TP asse`
`782`	`798`	`assert(limit.IsBinOpArray() \|\| limit.IsConstant());`
`783`	`799`
`784`	`800`	`// Make sure the assertion is of the form != 0 or == 0 if it isn't a constant assertion.`
`785`		`- if (!isConstantAssertion && (curAssertion->op2.vn != m_pCompiler->vnStore->VNZeroForType(TYP_INT)))`
	`801`	`+ if (!isConstantAssertion && (curAssertion->assertionKind != Compiler::OAK_NO_THROW) &&`
	`802`	`+ (curAssertion->op2.vn != m_pCompiler->vnStore->VNZeroForType(TYP_INT)))`
`786`	`803`	`{`
`787`	`804`	`continue;`
`788`	`805`	`}`
`@@ -1235,17 +1252,17 @@ bool RangeCheck::MultiplyOverflows(Limit& limit1, Limit& limit2)`
`1235`	`1252`	`}`
`1236`	`1253`
`1237`	`1254`	`// Does the bin operation overflow.`
`1238`		`-bool RangeCheck::DoesBinOpOverflow(BasicBlock* block, GenTreeOp* binop)`
	`1255`	`+bool RangeCheck::DoesBinOpOverflow(BasicBlock* block, GenTreeOp* binop, const Range& range)`
`1239`	`1256`	`{`
`1240`	`1257`	`GenTree* op1 = binop->gtGetOp1();`
`1241`	`1258`	`GenTree* op2 = binop->gtGetOp2();`
`1242`	`1259`
`1243`		`- if (!m_pSearchPath->Lookup(op1) && DoesOverflow(block, op1))`
	`1260`	`+ if (!m_pSearchPath->Lookup(op1) && DoesOverflow(block, op1, range))`
`1244`	`1261`	`{`
`1245`	`1262`	`return true;`
`1246`	`1263`	`}`
`1247`	`1264`
`1248`		`- if (!m_pSearchPath->Lookup(op2) && DoesOverflow(block, op2))`
	`1265`	`+ if (!m_pSearchPath->Lookup(op2) && DoesOverflow(block, op2, range))`
`1249`	`1266`	`{`
`1250`	`1267`	`return true;`
`1251`	`1268`	`}`
`@@ -1279,7 +1296,7 @@ bool RangeCheck::DoesBinOpOverflow(BasicBlock* block, GenTreeOp* binop)`
`1279`	`1296`	`}`
`1280`	`1297`
`1281`	`1298`	`// Check if the var definition the rhs involves arithmetic that overflows.`
`1282`		`-bool RangeCheck::DoesVarDefOverflow(GenTreeLclVarCommon* lcl)`
	`1299`	`+bool RangeCheck::DoesVarDefOverflow(BasicBlock* block, GenTreeLclVarCommon* lcl, const Range& range)`
`1283`	`1300`	`{`
`1284`	`1301`	`LclSsaVarDsc* ssaDef = GetSsaDefStore(lcl);`
`1285`	`1302`	`if (ssaDef == nullptr)`
`@@ -1291,10 +1308,25 @@ bool RangeCheck::DoesVarDefOverflow(GenTreeLclVarCommon* lcl)`
`1291`	`1308`	`}`
`1292`	`1309`	`return true;`
`1293`	`1310`	`}`
`1294`		`- return DoesOverflow(ssaDef->GetBlock(), ssaDef->GetDefNode()->Data());`
	`1311`	`+`
	`1312`	`+ // We can use intermediate assertions about the local to prove that any`
	`1313`	`+ // overflow on this path does not matter for the range computed.`
	`1314`	`+ Range assertionRange = Range(Limit(Limit::keUnknown));`
	`1315`	`+ MergeAssertion(block, lcl, &assertionRange DEBUGARG(0));`
	`1316`	`+`
	`1317`	`+ // But only if the range from the assertion is more strict than the global`
	`1318`	`+ // range computed; otherwise we might still have used the def's value to`
	`1319`	`+ // tighten the range of the global range.`
	`1320`	`+ Range merged = RangeOps::Merge(range, assertionRange, false);`
	`1321`	`+ if (merged.LowerLimit().Equals(range.LowerLimit()) && merged.UpperLimit().Equals(range.UpperLimit()))`
	`1322`	`+ {`
	`1323`	`+ return false;`
	`1324`	`+ }`
	`1325`	`+`
	`1326`	`+ return DoesOverflow(ssaDef->GetBlock(), ssaDef->GetDefNode()->Data(), range);`
`1295`	`1327`	`}`
`1296`	`1328`
`1297`		`-bool RangeCheck::DoesPhiOverflow(BasicBlock* block, GenTree* expr)`
	`1329`	`+bool RangeCheck::DoesPhiOverflow(BasicBlock* block, GenTree* expr, const Range& range)`
`1298`	`1330`	`{`
`1299`	`1331`	`for (GenTreePhi::Use& use : expr->AsPhi()->Uses())`
`1300`	`1332`	`{`
`@@ -1303,25 +1335,38 @@ bool RangeCheck::DoesPhiOverflow(BasicBlock* block, GenTree* expr)`
`1303`	`1335`	`{`
`1304`	`1336`	`continue;`
`1305`	`1337`	`}`
`1306`		`- if (DoesOverflow(block, arg))`
	`1338`	`+ if (DoesOverflow(block, arg, range))`
`1307`	`1339`	`{`
`1308`	`1340`	`return true;`
`1309`	`1341`	`}`
`1310`	`1342`	`}`
`1311`	`1343`	`return false;`
`1312`	`1344`	`}`
`1313`	`1345`
`1314`		`-bool RangeCheck::DoesOverflow(BasicBlock* block, GenTree* expr)`
	`1346`	`+//------------------------------------------------------------------------`
	`1347`	`+// DoesOverflow: Check if the computation of "expr" may have overflowed.`
	`1348`	`+//`
	`1349`	`+// Arguments:`
	`1350`	+// block - the block that contains `expr`
	`1351`	`+// expr - expression to check overflow of`
	`1352`	`+// range - range that we believe "expr" to be in without accounting for`
	`1353`	`+// overflow; used to ignore potential overflow on paths where`
	`1354`	`+// we can prove the value is in this range regardless.`
	`1355`	`+//`
	`1356`	`+// Return value:`
	`1357`	`+// True if the computation may have involved an impactful overflow.`
	`1358`	`+//`
	`1359`	`+bool RangeCheck::DoesOverflow(BasicBlock* block, GenTree* expr, const Range& range)`
`1315`	`1360`	`{`
`1316`	`1361`	`bool overflows = false;`
`1317`	`1362`	`if (!GetOverflowMap()->Lookup(expr, &overflows))`
`1318`	`1363`	`{`
`1319`		`- overflows = ComputeDoesOverflow(block, expr);`
	`1364`	`+ overflows = ComputeDoesOverflow(block, expr, range);`
`1320`	`1365`	`}`
`1321`	`1366`	`return overflows;`
`1322`	`1367`	`}`
`1323`	`1368`
`1324`		`-bool RangeCheck::ComputeDoesOverflow(BasicBlock* block, GenTree* expr)`
	`1369`	`+bool RangeCheck::ComputeDoesOverflow(BasicBlock* block, GenTree* expr, const Range& range)`
`1325`	`1370`	`{`
`1326`	`1371`	`JITDUMP("Does overflow [%06d]?\n", Compiler::dspTreeID(expr));`
`1327`	`1372`	`m_pSearchPath->Set(expr, block, SearchPath::Overwrite);`
`@@ -1343,17 +1388,17 @@ bool RangeCheck::ComputeDoesOverflow(BasicBlock* block, GenTree* expr)`
`1343`	`1388`	`}`
`1344`	`1389`	`else if (expr->OperIs(GT_COMMA))`
`1345`	`1390`	`{`
`1346`		`- overflows = ComputeDoesOverflow(block, expr->gtEffectiveVal());`
	`1391`	`+ overflows = ComputeDoesOverflow(block, expr->gtEffectiveVal(), range);`
`1347`	`1392`	`}`
`1348`	`1393`	`// Check if the var def has rhs involving arithmetic that overflows.`
`1349`	`1394`	`else if (expr->IsLocal())`
`1350`	`1395`	`{`
`1351`		`- overflows = DoesVarDefOverflow(expr->AsLclVarCommon());`
	`1396`	`+ overflows = DoesVarDefOverflow(block, expr->AsLclVarCommon(), range);`
`1352`	`1397`	`}`
`1353`	`1398`	`// Check if add overflows.`
`1354`	`1399`	`else if (expr->OperIs(GT_ADD, GT_MUL))`
`1355`	`1400`	`{`
`1356`		`- overflows = DoesBinOpOverflow(block, expr->AsOp());`
	`1401`	`+ overflows = DoesBinOpOverflow(block, expr->AsOp(), range);`
`1357`	`1402`	`}`
`1358`	`1403`	`// These operators don't overflow.`
`1359`	`1404`	`// Actually, GT_LSH can overflow so it depends on the analysis done in ComputeRangeForBinOp`
`@@ -1364,11 +1409,11 @@ bool RangeCheck::ComputeDoesOverflow(BasicBlock* block, GenTree* expr)`
`1364`	`1409`	`// Walk through phi arguments to check if phi arguments involve arithmetic that overflows.`
`1365`	`1410`	`else if (expr->OperIs(GT_PHI))`
`1366`	`1411`	`{`
`1367`		`- overflows = DoesPhiOverflow(block, expr);`
	`1412`	`+ overflows = DoesPhiOverflow(block, expr, range);`
`1368`	`1413`	`}`
`1369`	`1414`	`else if (expr->OperIs(GT_CAST))`
`1370`	`1415`	`{`
`1371`		`- overflows = ComputeDoesOverflow(block, expr->gtGetOp1());`
	`1416`	`+ overflows = ComputeDoesOverflow(block, expr->gtGetOp1(), range);`
`1372`	`1417`	`}`
`1373`	`1418`	`GetOverflowMap()->Set(expr, overflows, OverflowMap::Overwrite);`
`1374`	`1419`	`m_pSearchPath->Remove(expr);`
Original file line number	Diff line number	Diff line change
`@@ -418,7 +418,6 @@ internal ref TValue FindValue(TKey key)`
`418`	`418`	`i--; // Value in _buckets is 1-based; subtract 1 from i. We do it here so it fuses with the following conditional.`
`419`	`419`	`do`
`420`	`420`	`{`
`421`		`- // Should be a while loop https://github.com/dotnet/runtime/issues/9422`
`422`	`421`	`// Test in if to drop range check for following array access`
`423`	`422`	`if ((uint)i >= (uint)entries.Length)`
`424`	`423`	`{`
`@@ -450,7 +449,6 @@ internal ref TValue FindValue(TKey key)`
`450`	`449`	`i--; // Value in _buckets is 1-based; subtract 1 from i. We do it here so it fuses with the following conditional.`
`451`	`450`	`do`
`452`	`451`	`{`
`453`		`- // Should be a while loop https://github.com/dotnet/runtime/issues/9422`
`454`	`452`	`// Test in if to drop range check for following array access`
`455`	`453`	`if ((uint)i >= (uint)entries.Length)`
`456`	`454`	`{`
`@@ -535,15 +533,8 @@ private bool TryInsert(TKey key, TValue value, InsertionBehavior behavior)`
`535`	`533`	`comparer == null)`
`536`	`534`	`{`
`537`	`535`	`// ValueType: Devirtualize with EqualityComparer<TKey>.Default intrinsic`
`538`		`- while (true)`
	`536`	`+ while ((uint)i < (uint)entries.Length)`
`539`	`537`	`{`
`540`		`- // Should be a while loop https://github.com/dotnet/runtime/issues/9422`
`541`		`- // Test uint in if rather than loop condition to drop range check for following array access`
`542`		`- if ((uint)i >= (uint)entries.Length)`
`543`		`- {`
`544`		`- break;`
`545`		`- }`
`546`		`-`
`547`	`538`	`if (entries[i].hashCode == hashCode && EqualityComparer<TKey>.Default.Equals(entries[i].key, key))`
`548`	`539`	`{`
`549`	`540`	`if (behavior == InsertionBehavior.OverwriteExisting)`
`@@ -574,15 +565,8 @@ private bool TryInsert(TKey key, TValue value, InsertionBehavior behavior)`
`574`	`565`	`else`
`575`	`566`	`{`
`576`	`567`	`Debug.Assert(comparer is not null);`
`577`		`- while (true)`
	`568`	`+ while ((uint)i < (uint)entries.Length)`
`578`	`569`	`{`
`579`		`- // Should be a while loop https://github.com/dotnet/runtime/issues/9422`
`580`		`- // Test uint in if rather than loop condition to drop range check for following array access`
`581`		`- if ((uint)i >= (uint)entries.Length)`
`582`		`- {`
`583`		`- break;`
`584`		`- }`
`585`		`-`
`586`	`570`	`if (entries[i].hashCode == hashCode && comparer.Equals(entries[i].key, key))`
`587`	`571`	`{`
`588`	`572`	`if (behavior == InsertionBehavior.OverwriteExisting)`
`@@ -690,15 +674,8 @@ internal static class CollectionsMarshalHelper`
`690`	`674`	`comparer == null)`
`691`	`675`	`{`
`692`	`676`	`// ValueType: Devirtualize with EqualityComparer<TKey>.Default intrinsic`
`693`		`- while (true)`
	`677`	`+ while ((uint)i < (uint)entries.Length)`
`694`	`678`	`{`
`695`		`- // Should be a while loop https://github.com/dotnet/runtime/issues/9422`
`696`		`- // Test uint in if rather than loop condition to drop range check for following array access`
`697`		`- if ((uint)i >= (uint)entries.Length)`
`698`		`- {`
`699`		`- break;`
`700`		`- }`
`701`		`-`
`702`	`679`	`if (entries[i].hashCode == hashCode && EqualityComparer<TKey>.Default.Equals(entries[i].key, key))`
`703`	`680`	`{`
`704`	`681`	`exists = true;`
`@@ -720,15 +697,8 @@ internal static class CollectionsMarshalHelper`
`720`	`697`	`else`
`721`	`698`	`{`
`722`	`699`	`Debug.Assert(comparer is not null);`
`723`		`- while (true)`
	`700`	`+ while ((uint)i < (uint)entries.Length)`
`724`	`701`	`{`
`725`		`- // Should be a while loop https://github.com/dotnet/runtime/issues/9422`
`726`		`- // Test uint in if rather than loop condition to drop range check for following array access`
`727`		`- if ((uint)i >= (uint)entries.Length)`
`728`		`- {`
`729`		`- break;`
`730`		`- }`
`731`		`-`
`732`	`702`	`if (entries[i].hashCode == hashCode && comparer.Equals(entries[i].key, key))`
`733`	`703`	`{`
`734`	`704`	`exists = true;`