Regression: Unnecessary bounds check generated for Span/ReadOnlySpan

[rameel]

The same unnecessary bounds check previously reported for string (issue #115793, fixed in PR #115980) is also present for Span and ReadOnlySpan

Repro: Godbolt

static bool Is(ReadOnlySpan<char> prefix, ReadOnlySpan<char> path)
{
    if ((uint)prefix.Length < (uint)path.Length)
        return (path[prefix.Length] == '/');

    return false;
}

trunk-20250528+ab3d27fd24:

       push     rbp
       mov      rbp, rsp
       cmp      esi, ecx
       jl       SHORT G_M18054_IG05
       xor      eax, eax
       pop      rbp
       ret      
G_M18054_IG05:  ;; offset=0x000C
       cmp      esi, ecx
       jae      SHORT G_M18054_IG07
       mov      eax, esi
       cmp      word  ptr [rdx+2*rax], 47
       sete     al
       movzx    rax, al
       pop      rbp
       ret      
G_M18054_IG07:  ;; offset=0x001F
       call     CORINFO_HELP_RNGCHKFAIL
       int3

coreclr 9.0.2+80aa709f5d:

       cmp      esi, ecx
       jb       SHORT G_M18054_IG05
       xor      eax, eax
       ret      
G_M18054_IG05:  ;; offset=0x0007
       mov      eax, esi
       cmp      word  ptr [rdx+2*rax], 47
       sete     al
       movzx    rax, al
       ret      

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[EgorBo]

Thanks for filing issues like this! Let me check, Spans are a bit special in JIT

[EgorBo]

Looks like it was regressed by this transformation:

runtime/src/coreclr/jit/morph.cpp

Lines 7894 to 7899 in cb502bd

	// Normalize unsigned comparisons to signed if both operands a known to be never negative.
	if (tree->IsUnsigned() && varTypeIsIntegral(op1) && op1->IsNeverNegative(this) &&
	op2->IsNeverNegative(this))
	{
	tree->ClearUnsigned();
	}

Unfortunately, there is no simple fix for now and if I remove this transformation it will be a quite noticeable size regressions in other places.

[rameel]

Unfortunate. Is this the same reason in #115090 as well?

[EgorBo]

Unfortunate. Is this the same reason in #115090 as well?

That one is different, but also not trivial (we have a similar issue I believe, for span = span.Slice kinds of loops)