cmd/compile: Prove doesn't understand division of slice length

[Nigma1337]

What version of Go are you using (go version)?

$ go version
go version go1.19.3 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/magnus/.cache/go-build"
GOENV="/home/magnus/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/magnus/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/magnus/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/lib/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.19.3"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/magnus/go.mod"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1748103025=/tmp/go-build -gno-record-gcc-switches"

What did you do?

I took the length of an object, to split it into halves, and there were IsSliceInBounds checks

What did you expect to see?

The IsSliceInBounds checks eliminatied

What did you see instead?

They were not eliminated

Short program showing issue

package main

func SplitInHalf(s []int) (left, right []int) {
	middle := len(s) / 2
	left = s[:middle]
	right = s[middle:]
	return
}

func main() {}

$ go build -gcflags="-d=ssa/check_bce/debug=1" main.go

command-line-arguments

./main.go:5:10: Found IsSliceInBounds
./main.go:6:11: Found IsSliceInBounds

[gopherbot]

Change https://go.dev/cl/455095 mentions this issue: cmd/compile: teach prove about unsigned division, modulus and rhs

[zigo101]

This is a correct behavior. See #16595

Also see the "Example 3" section in https://go101.org/article/bounds-check-elimination.html

[zigo101]

Ah, it looks this is a different problem.
What about the length of s is zero?

[update] Sorry, the bounds should be eliminated here.

[Jorropo]

I've seen your:

[update] Sorry, the bounds should be eliminated here.

But I'm responding anyway for posterity and future readers. 🙂

This is a correct behavior. See #16595
Also see the "Example 3" section in https://go101.org/article/bounds-check-elimination.html

Thoses examples you linked are different, they incorrectly assume that slice[:i] should prove slice[i:].
This is wrong because go use [x,y) ranging, that means :i is one past the index that will be taken, while i: is the last index that will be taken. In other words i <= cap(slice) does not prove i < cap(slice).

Here we have a different issue, actually it reproduce just like this without this double left / right reslicing:

func SplitInHalfRight(s []int) (right []int) {
	middle := len(s) / 2
	right = s[middle:]
	return
}

It should BCE but it doesn't, hopefully this can convaince you, if we feed a 0 length slice in the original function we will get this after folding out all constants:

func SplitInHalf(s []int) (left, right []int) {
	middle := len(s) / 2 // 0 / 2 = 0
	left = s[:middle] // []int{}[0:0] -> []int{}
	right = s[middle:] // []int{}[0:0] -> []int{}
	return
}

In other words feeding an empty slice produce two empty slices.

---

This was easy to fix, I just had to teach the compiler that for unsigned divisions z := x / y and unsigned right shifts (which are really just divisions by powers of two) z := x >> y, z is always smaller or equal to x.

[prattmic]

cc @golang/compiler