JIT: Missed `i >= 0` assertion

[BoyBaykiller]

After the first loop i should have a lower bound of 0 and consequently avoid bounds check. It currently is Unknown and for some reason even wrapping it in if (i >= 0) doesnt change that. https://godbolt.org/z/n9cP1abje

public static int Unrolled(Span<int> arr)
{
    int sum = 0;
    int i = 0;
    for (; i < arr.Length - 3; i += 4)
    {
        //sum += arr[i + 0];
        //sum += arr[i + 1];
        //sum += arr[i + 2];
        //sum += arr[i + 3];
    }

    // Computed Range for i => <Unknown, $c3 + -1>
    for (; i < arr.Length; i++)
    {
        sum += arr[i]; // Bounds check
    }

    return sum;
}

Program:Unrolled(System.Span`1[int]):int (FullOpts):
       push     rbp
       mov      rbp, rsp
       xor      eax, eax
       xor      ecx, ecx
       lea      edx, [rsi-0x03]
       test     edx, edx
       jle      SHORT G_M38392_IG05
       align    [0 bytes for IG03]
G_M38392_IG03:  ;; offset=0x000F
       add      ecx, 4
       cmp      ecx, edx
       jl       SHORT G_M38392_IG03
       jmp      SHORT G_M38392_IG05
       align    [8 bytes for IG04]
G_M38392_IG04:  ;; offset=0x0020
       cmp      ecx, esi
       jae      SHORT G_M38392_IG07
       mov      edx, ecx
       add      eax, dword ptr [rdi+4*rdx]
       inc      ecx
G_M38392_IG05:  ;; offset=0x002B
       cmp      ecx, esi
       jl       SHORT G_M38392_IG04
       pop      rbp
       ret      
G_M38392_IG07:  ;; offset=0x0031
       call     CORINFO_HELP_RNGCHKFAIL
       int3     

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[EgorBo]

Thanks, it's an interesting case. Seems like we have everything we need to calculate the range precisely.

[EgorBo]

Seems like the issue is in RangeOps::Merge

Merging ranges <$c3 + -2, $c3 + 0> <$c3 + -3, $c3 + -1>:<Unknown, $c3 + 0>
      Computed Range [000074] => <Unknown, $c3 + 0>
   }