JIT: guard overflow in loop cloning offset limits by AndyAyersMS · Pull Request #133834 · dotnet/runtime

AndyAyersMS · 2026-09-13T23:38:17Z

Positive array length offsets can wrap negative and let the fast clone run
without bounds checks. Guard offsets that can overflow and add regression
coverage for decreasing loops.

Fixes #133823

Note

This pull request description was generated with GitHub Copilot.

Positive array length offsets can wrap negative and let the fast clone run without bounds checks. Guard offsets that can overflow and add regression coverage for decreasing loops. Fixes dotnet#133823 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 336fb408-8580-4f7b-b3e6-087280a6294a

azure-pipelines · 2026-09-13T23:39:00Z

Azure Pipelines: Successfully started running 5 pipeline(s). 11 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-09-13T23:39:59Z

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Copilot

🟢 Approval recommended

No unresolved review issues were identified.

Pull request overview

Guards JIT loop cloning against signed overflow in positive array-length offsets and adds regression coverage.

Changes:

Adds overflow detection for positive offset limits.
Tests decreasing loops using >, >=, and !=.

File summaries

File	Description
`src/tests/JIT/opt/Cloning/OffsetLimit.cs`	Adds positive-offset overflow regression tests.
`src/coreclr/jit/loopcloning.cpp`	Adds an overflow-aware fast-clone guard.

Review details

Files reviewed: 2/2 changed files
Comments generated: 0
Review effort level: Lite

AndyAyersMS · 2026-09-14T23:44:07Z

@dhartglassMSFT ptal
fyi @dotnet/jit-contrib

Smallish fix in cloning checks.

dhartglassMSFT · 2026-09-15T22:39:15Z

fyi one of the new tests fails on mono linux x64, I don't know whether we're keeping up with these, change LGTM otherwise:

=================================================================
	Managed Stacktrace:
=================================================================
	  at OffsetLimit:DecGtArrayLengthPlusMaxValue <0x00040>
	  at <unknown> <0xffffffff>
	  at Xunit.Assert:RecordException <0x00066>
	  at Xunit.Assert:Throws <0x00057>
	  at <unknown> <0xffffffff>
	  at <unknown> <0xffffffff>
	  at Program:<Main>$ <0x04aa4>
	  at <Module>:runtime_invoke_int_object <0x00091>
============================

AndyAyersMS · 2026-09-15T23:43:16Z

fyi one of the new tests fails on mono linux x64

I'll add an exclusion and ping you for reapproval.

Mono LLVM AOT crashes instead of throwing for the GT overflow case. Split it from the passing theory rows and track the failure in dotnet#134014. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 336fb408-8580-4f7b-b3e6-087280a6294a

Copilot

🟢 Approval recommended

No unresolved blocking issues were identified.

Review details

Files reviewed: 3/3 changed files
Comments generated: 0 new
Review effort level: Lite

AndyAyersMS · 2026-09-16T00:46:29Z

@dhartglassMSFT re-approve when you get a chance.

The first exclusion worked, but CI then hit the same crash in the GE case. Exclude all equivalent overflow rows under dotnet#134014. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 336fb408-8580-4f7b-b3e6-087280a6294a

AndyAyersMS · 2026-09-16T15:20:36Z

@dhartglassMSFT we needed more mono exclusions. Hopefully got them all this time.

Copilot

🔵 Needs a closer look

The safety-sensitive JIT change warrants final human review.

Review details

Files reviewed: 3/3 changed files
Comments generated: 0 new
Review effort level: Lite

Positive array length offsets can wrap negative and let the fast clone run without bounds checks. Guard offsets that can overflow and add regression coverage for decreasing loops. Fixes dotnet#133823 > [!NOTE] > This pull request description was generated with GitHub Copilot. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 336fb408-8580-4f7b-b3e6-087280a6294a

AndyAyersMS · 2026-09-21T15:50:26Z

/backport to release/11.0

github-actions · 2026-09-21T15:50:36Z

Started backporting to release/11.0 (link to workflow run)

@AndyAyersMS

…4350) Backport of #133834 to release/11.0 /cc @AndyAyersMS ## Customer Impact - [ ] Customer reported - [x] Found internally Loop cloning can incorrectly remove array bounds checks when a positive `arr.Length + offset` loop limit overflows to a negative value. Safe C# can then perform an out-of-bounds read and terminate with a native access violation instead of throwing `IndexOutOfRangeException`. This reproduces on .NET 11 RC1 and RC2; .NET 10 is correct. See #133823. ## Regression - [x] Yes - [ ] No Introduced during the .NET 11 cycle by #129309, which extended loop cloning to handle span/stride and constant-offset limits. ## Testing Added regression coverage for decreasing loops with overflowing positive offsets. The test fails before the fix and verifies that the required bounds exception is preserved after the fix. The original PR also passed JIT CI; Mono exclusions were added because this is CoreCLR-specific loop-cloning coverage. ## Risk Low. The change is localized to loop-cloning condition derivation. It rejects offsets that cannot be represented safely instead of selecting the unchecked fast clone, so the fallback retains the existing bounds checks. Co-authored-by: Andy Ayers <andya@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 336fb408-8580-4f7b-b3e6-087280a6294a

Copilot AI lite review requested due to automatic review settings September 13, 2026 23:38

dotnet-policy-service Bot assigned AndyAyersMS Sep 13, 2026

Copilot started reviewing on behalf of AndyAyersMS September 13, 2026 23:38 View session

github-actions Bot added the area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI label Sep 13, 2026

Copilot AI reviewed Sep 13, 2026

View reviewed changes

This was referenced Sep 14, 2026

Test failure: GC/Features/HeapExpansion/bestfit-finalize/bestfit-finalize.cmd #132107

Open

github60486 failed with NRE at Program.ValidateRecursiveCurrentMethod(Int32 depth) #133798

Closed

AndyAyersMS requested a review from dhartglassMSFT September 14, 2026 23:43

AndyAyersMS mentioned this pull request Sep 15, 2026

Mono LLVM AOT crashes on overflowing array length loop limit #134014

Open

Copilot AI review requested due to automatic review settings September 15, 2026 23:59

Copilot started reviewing on behalf of AndyAyersMS September 16, 2026 00:00 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

dhartglassMSFT approved these changes Sep 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings September 16, 2026 15:20

Copilot started reviewing on behalf of AndyAyersMS September 16, 2026 15:20 View session

Copilot AI reviewed Sep 16, 2026

View reviewed changes

dhartglassMSFT enabled auto-merge (squash) September 16, 2026 22:18

dhartglassMSFT approved these changes Sep 16, 2026

View reviewed changes

dhartglassMSFT merged commit e58c6f8 into dotnet:main Sep 16, 2026
140 of 143 checks passed

dotnet-maestro Bot mentioned this pull request Sep 17, 2026

[main] Source code updates from dotnet/runtime dotnet/dotnet#9438

Merged

dotnet-milestone-bot Bot added this to the 12.0-preview1 milestone Sep 17, 2026

EgorBo mentioned this pull request Sep 18, 2026

JIT: (bug) Loop cloning drops bounds checks when an arr.Length + K loop limit overflows to a negative value #133823

Closed

github-actions Bot mentioned this pull request Sep 21, 2026

[release/11.0] JIT: guard overflow in loop cloning offset limits #134350

Merged

4 tasks

Navigation Menu

JIT: guard overflow in loop cloning offset limits - #133834

JIT: guard overflow in loop cloning offset limits#133834
dhartglassMSFT merged 3 commits into
dotnet:mainfrom
AndyAyersMS:fix-133823-loop-cloning-overflow

AndyAyersMS commented Sep 13, 2026

Uh oh!

azure-pipelines Bot commented Sep 13, 2026

Uh oh!

dotnet-policy-service Bot commented Sep 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

AndyAyersMS commented Sep 14, 2026

Uh oh!

dhartglassMSFT commented Sep 15, 2026

Uh oh!

AndyAyersMS commented Sep 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

AndyAyersMS commented Sep 16, 2026

Uh oh!

AndyAyersMS commented Sep 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

AndyAyersMS commented Sep 21, 2026

Uh oh!

github-actions Bot commented Sep 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

AndyAyersMS commented Sep 13, 2026

Uh oh!

azure-pipelines Bot commented Sep 13, 2026

Uh oh!

dotnet-policy-service Bot commented Sep 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

AndyAyersMS commented Sep 14, 2026

Uh oh!

dhartglassMSFT commented Sep 15, 2026

Uh oh!

AndyAyersMS commented Sep 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

AndyAyersMS commented Sep 16, 2026

Uh oh!

AndyAyersMS commented Sep 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Uh oh!

AndyAyersMS commented Sep 21, 2026

Uh oh!

github-actions Bot commented Sep 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants