Track span.Length's negativity + remove unsound assumption from MergeEdgeAssertions#124387
Merged
EgorBo merged 4 commits intodotnet:mainfrom Feb 16, 2026
Merged
Track span.Length's negativity + remove unsound assumption from MergeEdgeAssertions#124387EgorBo merged 4 commits intodotnet:mainfrom
EgorBo merged 4 commits intodotnet:mainfrom
Conversation
…EdgeAssertions + support VNF_Not in GetRangeFromAssertions
github-actions
bot
added
the
area-CodeGen-coreclr
Contributor
|
Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch |
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request enhances range check analysis in the JIT compiler by:
- Adding support for tracking span.Length's non-negativity through assertions
- Adding support for VNF_NOT (logical not) operations in range analysis
- Removing unsound assumptions from MergeEdgeAssertions that incorrectly used checked bounds
- Adding debug-only assertions to AssertionDsc to catch mode confusion between local and global assertion propagation
Changes:
- Added RangeOps::Not() for logical negation on constant boolean ranges
- Added VNF_NOT case to GetRangeFromAssertions with proper range computation
- Removed unsafe code in MergeEdgeAssertions that made unsound assumptions about checked bounds
- Added debug-only m_compiler fields to AssertionDscOp1/Op2 with mode-checking assertions in getters
- Removed unused O2K_INVALID enum value
- Added CreateEmptyAssertion factory to ensure proper initialization of debug fields
- Added GT_LCL_VAR case in optAssertionGen to generate assertions for never-negative locals
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| src/coreclr/jit/rangecheck.h | Added RangeOps::Not() method for logical negation on boolean ranges |
| src/coreclr/jit/rangecheck.cpp | Added VNF_NOT support in GetRangeFromAssertions; removed unsound assumptions in MergeEdgeAssertions |
| src/coreclr/jit/compiler.h | Added debug assertions to AssertionDsc with CreateEmptyAssertion factory; removed O2K_INVALID |
| src/coreclr/jit/assertionprop.cpp | Added GT_LCL_VAR case for never-negative locals; updated factory method calls to pass compiler |
Member
Author
|
PTAL @jakobbotsch I remember you pointed me to that assumption. cc @dotnet/jit-contrib |
Member
Author
|
Managed to come up with a bug-repro that this PR fixes: #124404 |
This was referenced Feb 13, 2026
Open
jakobbotsch
reviewed
Feb 16, 2026
jakobbotsch
reviewed
Feb 16, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
src/coreclr/jit/rangecheck.cpp:712
- RangeOps::Not() method does not exist. This code calls RangeOps::Not(r1) but the RangeOps struct in rangecheck.h only defines methods like Negate, Add, Subtract, Multiply, etc. There is no Not method implemented. This will cause a compilation error. You need to either implement RangeOps::Not() or remove the VNF_NOT case from this switch statement.
jakobbotsch
approved these changes
Feb 16, 2026
Member
Author
|
/ba-g filed #124487 for the failure |
iremyux
pushed a commit
to iremyux/dotnet-runtime
that referenced
this pull request
Mar 2, 2026
…EdgeAssertions (dotnet#124387) This PR does: - Remove an unsound assumption from MergeEdgeAssertions (IsVnCheckedBound = non-negative). - `IsVnCheckedBound` just consults with a global VN hash of VNs ever participating in BoundsCheck's length arg. While in reality we can only rely on such VNs in certain contexts, e.g. after BoundsCheck nodes. Fixes dotnet#124404 - Track span.Length's non-negativity via assertions (won't work for non-promoted spans). - This is needed to mitigate some of the regressions from (1) - Support VNF_Not unary op in GetRangeFromAssertions - Add more debug checks to AssertionDsc [Diffs](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1293753&view=ms.vss-build-web.run-extensions-tab) - some regressions from the removed IsVnCheckedBound hack and now non-promoted Spans are less likely to be recognized. Likely to be fixed when the legacy promotion is gone?
danmoseley
added a commit
that referenced
this pull request
Mar 26, 2026
…lakiness (#126010) `SocketsHttpHandler_HttpClientHandlerTest.LargeUriAndHeaders_Works` was consistently timing out on Android because the test allocates 10M-character strings for the path, header name, and header value — too large for Android's HTTP stack within the allotted time. ## Changes - **`HttpClientHandlerTest.cs`**: Added Android-specific branch to the `length` calculation: ```csharp int length = IsWinHttpHandler ? 65_000 : PlatformDetection.IsAndroid ? 100_000 : 10_000_000; ``` This mirrors the existing WinHTTP size cap pattern and keeps non-Android platforms at the original 10M limit. <!-- START COPILOT ORIGINAL PROMPT --> <details> <summary>Original prompt</summary> ---- *This section details on the original issue you should resolve* <issue_title>[FAIL] System.Net.Http.Functional.Tests.SocketsHttpHandler_HttpClientHandlerTest.LargeUriAndHeaders_Works</issue_title> <issue_description>``` 02-16 16:47:52.072 10194 24326 I DOTNET : [FAIL] System.Net.Http.Functional.Tests.SocketsHttpHandler_HttpClientHandlerTest.LargeUriAndHeaders_Works 02-16 16:47:52.072 10194 24326 I DOTNET : System.TimeoutException : The operation has timed out. 02-16 16:47:52.072 10194 24326 I DOTNET : at System.Net.Http.Functional.Tests.HttpClientHandlerTest.LargeUriAndHeaders_Works() ``` ## Build Information Build: https://dev.azure.com/dnceng-public/cbb18261-c48f-4abb-8651-8cdcb5474649/_build/results?buildId=1296274 Build error leg or test failing: System.Net.Http.Functional.Tests.WorkItemExecution Pull request: #124387 <!-- Error message template --> ## Error Message Fill the error message using [step by step known issues guidance](https://github.com/dotnet/arcade/blob/main/Documentation/Projects/Build%20Analysis/KnownIssueJsonStepByStep.md). <!-- Use ErrorMessage for String.Contains matches. Use ErrorPattern for regex matches (single line/no backtracking). Set BuildRetry to `true` to retry builds with this error. Set ExcludeConsoleLog to `true` to skip helix logs analysis. --> ```json { "ErrorMessage": "[FAIL] System.Net.Http.Functional.Tests.SocketsHttpHandler_HttpClientHandlerTest.LargeUriAndHeaders_Works", "ErrorPattern": "", "BuildRetry": false, "ExcludeConsoleLog": false } ``` <!--Known issue error report start --> ### Report #### Summary |24-Hour Hit Count|7-Day Hit Count|1-Month Count| |---|---|---| |0|0|0| <!--Known issue error report end --> <!-- Known issue validation start --> ### Known issue validation **Build: 🔎** https://dev.azure.com/dnceng-public/public/_build/results?buildId=1296274 **Error message validated:** `[[FAIL] System.Net.Http.Functional.Tests.SocketsHttpHandler_HttpClientHandlerTest.LargeUriAndHeaders_Works`] **Result validation:** ✅ Known issue matched with the provided build. **Validation performed at:** 2/25/2026 7:27:26 AM UTC <!-- Known issue validation end --> <!--Known issue error report start --> ### Report |Build|Definition|Test|Pull Request| |---|---|---|---| |[1317839](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1317839)|dotnet/runtime|[System.Net.Http.Functional.Tests.WorkItemExecution](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1317839&view=ms.vss-test-web.build-test-results-tab&runId=37128658&resultId=117285)|dotnet/runtime#124516| |[1321007](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1321007)|dotnet/runtime|[System.Net.Http.Functional.Tests.WorkItemExecution](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1321007&view=ms.vss-test-web.build-test-results-tab&runId=36966144&resultId=190598)|dotnet/runtime#124801| |[1321402](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1321402)|dotnet/runtime|[System.Net.Http.Functional.Tests.WorkItemExecution](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1321402&view=ms.vss-test-web.build-test-results-tab&runId=36889816&resultId=186154)|| |[1320129](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1320129)|dotnet/runtime|[System.Net.Http.Functional.Tests.WorkItemExecution](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1320129&view=ms.vss-test-web.build-test-results-tab&runId=36858866&resultId=117308)|dotnet/runtime#124365| |[1320101](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1320101)|dotnet/runtime|[System.Net.Http.Functional.Tests.WorkItemExecution](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1320101&view=ms.vss-test-web.build-test-results-tab&runId=36858212&resultId=117308)|dotnet/runtime#125174| |[1320034](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1320034)|dotnet/runtime|[System.Net.Http.Functional.Tests.SocketsHttpHandler_HttpClientHandlerTest.LargeUriAndHeaders_Works](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1320034&view=ms.vss-test-web.build-test-results-tab&runId=36857302&resultId=118270)|dotnet/runtime#124720| |[1319961](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1319961)|dotnet/runtime|[System.Net.Http.Functional.Tests.WorkItemExecution](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1319961&view=ms.vss-test-web.build-test-results-tab&runId=36856122&resultId=118485)|dotnet/runtime#125146| |[1319852](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1319852)|dotnet/runtime|[System.Net.Http.Functional.Tests.WorkItemExecution](https://dev.azure.com/dnceng-public/public/_build/results?buildId=1319852&view=ms.vss-test-web.build-test-results-tab... </details> <!-- START COPILOT CODING AGENT SUFFIX --> - Fixes #124487 <!-- START COPILOT CODING AGENT TIPS --> --- ⌨️ Start Copilot coding agent tasks without leaving your editor — available in [VS Code](https://gh.io/cca-vs-code-docs), [Visual Studio](https://gh.io/cca-visual-studio-docs), [JetBrains IDEs](https://gh.io/cca-jetbrains-docs) and [Eclipse](https://gh.io/cca-eclipse-docs). --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: danmoseley <6385855+danmoseley@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR does:
IsVnCheckedBoundjust consults with a global VN hash of VNs ever participating in BoundsCheck's length arg. While in reality we can only rely on such VNs in certain contexts, e.g. after BoundsCheck nodes. Fixes AVE instead of IndexOutOfRangeException #124404Diffs - some regressions from the removed IsVnCheckedBound hack and now non-promoted Spans are less likely to be recognized. Likely to be fixed when the legacy promotion is gone?