JIT: Bounds checks not removed after casting a Span<T> with a known length to another type

[Thealexbarney]

The JIT doesn't completely eliminate the bounds checks in either of these functions.

public static short GetValue()
{
    ReadOnlySpan<byte> span = new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
    return MemoryMarshal.Cast<byte, short>(span)[1];
}

public static short GetValueS(ref byte a)
{
    ReadOnlySpan<byte> span = MemoryMarshal.CreateReadOnlySpan(ref a, 6);
    return MemoryMarshal.Cast<byte, short>(span)[1];
}

It's able to recognize that the new span has a known length, but doesn't remove the comparison between constants.

G_M41738_IG01:
       sub      rsp, 40
       nop      

G_M41738_IG02:
       mov      eax, 3
       cmp      eax, 1
       jbe      SHORT G_M41738_IG05
       mov      rax, 0xD1FFAB1E
       movsx    rax, word  ptr [rax]

G_M41738_IG03:
       add      rsp, 40
       ret      

G_M41738_IG04:
       call     CORINFO_HELP_OVERFLOW
       int3     

G_M41738_IG05:
       call     CORINFO_HELP_RNGCHKFAIL
       int3     

; Total bytes of code 46

-------------------------------------
G_M41737_IG01:
       sub      rsp, 40
       nop      

G_M41737_IG02:
       mov      eax, 3
       cmp      eax, 1
       jbe      SHORT G_M41737_IG05
       movsx    rax, word  ptr [rcx+2]

G_M41737_IG03:
       add      rsp, 40
       ret      

G_M41737_IG04:
       call     CORINFO_HELP_OVERFLOW
       int3     

G_M41737_IG05:
       call     CORINFO_HELP_RNGCHKFAIL
       int3     

; Total bytes of code 37

Returning a byte instead of casting to a short results in no bounds checks.

G_M41729_IG01:
       nop      

G_M41729_IG02:
       mov      rax, 0xD1FFAB1E
       movzx    rax, byte  ptr [rax]

G_M41729_IG03:
       ret      

; Total bytes of code 19

-------------------------------------
G_M41728_IG01:
       nop      

G_M41728_IG02:
       movzx    rax, byte  ptr [rcx+1]

G_M41728_IG03:
       ret      

; Total bytes of code 10

category:cq
theme:bounds-checks
skill-level:expert
cost:medium

[gfoidl]

Aside from the issue, a note of caution:

return MemoryMarshal.Cast<byte, short>(span)[1];

is not endianess-safe, i.e. as little-endian user on big-endian machines you won't get the expected short value.
(That's also the reason why the ROS-static data trick by the C# compiler only works with byte, bool).

[jakobbotsch]

Codegen on main:

; Method Program:GetValue():short
G_M6304_IG01:
       sub      rsp, 40
						;; size=4 bbWeight=1    PerfScore 0.25

G_M6304_IG02:
       mov      rax, 0xD1FFAB1E      ; data for <PrivateImplementationDetails>:B0F66ADC83641586656866813FD9DD0B8EBB63796075661BA45D1AA8089E1D44
       movsx    rax, word  ptr [rax+02H]
						;; size=15 bbWeight=1    PerfScore 4.25

G_M6304_IG03:
       add      rsp, 40
       ret      
						;; size=5 bbWeight=1    PerfScore 1.25

G_M6304_IG04:
       call     CORINFO_HELP_OVERFLOW
       int3     
						;; size=6 bbWeight=0    PerfScore 0.00
; Total bytes of code: 30

; Method Program:GetValueS(byref):short
G_M36409_IG01:
       sub      rsp, 40
						;; size=4 bbWeight=1    PerfScore 0.25

G_M36409_IG02:
       movsx    rax, word  ptr [rcx+02H]
						;; size=5 bbWeight=1    PerfScore 4.00

G_M36409_IG03:
       add      rsp, 40
       ret      
						;; size=5 bbWeight=1    PerfScore 1.25

G_M36409_IG04:
       call     CORINFO_HELP_OVERFLOW
       int3     
						;; size=6 bbWeight=0    PerfScore 0.00
; Total bytes of code: 20

Looks fixed.