Fix possible overflow in optAssertionPropGlobal_RelOp

src/coreclr/jit/assertionprop.cpp

@@ -3982,8 +3982,12 @@ void Compiler::optAssertionProp_RangeProperties(ASSERT_VALARG_TP assertions,
 
             int cns = static_cast<int>(tree->gtGetOp2()->AsIntCon()->IconValue());
 
-            if ((rng.LowerLimit().IsConstant() && !rng.LowerLimit().AddConstant(cns)) ||
-                (rng.UpperLimit().IsConstant() && !rng.UpperLimit().AddConstant(cns)))
+            bool loOverflows = false;
+            bool hiOverflows = false;
+            rng.LowerLimit().AddConstant(cns, &loOverflows);
+            rng.UpperLimit().AddConstant(cns, &hiOverflows);
+
+            if (loOverflows || hiOverflows)
             {
                 // Add cns to both bounds if they are constants. Make sure the addition doesn't overflow.
                 return;
@@ -4473,20 +4477,24 @@ GenTree* Compiler::optAssertionPropGlobal_RelOp(ASSERT_VALARG_TP assertions,
 
             if (peeledOffset != 0)
             {
-                Range peeledOffsetRng = Range(Limit(Limit::keConstant, peeledOffset));
-                Range peeledOp1Rng    = Range(Limit(Limit::keUnknown));
+                Range peeledOp1Rng = Range(Limit(Limit::keUnknown));
                 if (RangeCheck::TryGetRangeFromAssertions(this, peeledOp1VN, assertions, &peeledOp1Rng))
                 {
-                    // Subtract handles overflow internally.
-                    rng2 = RangeOps::Subtract(rng2, peeledOffsetRng);
+                    bool loOverflows = false;
+                    bool hiOverflows = false;
+                    peeledOp1Rng.LowerLimit().AddConstant(peeledOffset, &loOverflows);
+                    peeledOp1Rng.UpperLimit().AddConstant(peeledOffset, &hiOverflows);
 
-                    RangeOps::RelationKind kind =
-                        RangeOps::EvalRelop(tree->OperGet(), tree->IsUnsigned(), peeledOp1Rng, rng2);
-                    if ((kind != RangeOps::RelationKind::Unknown))
+                    if (!loOverflows && !hiOverflows)
                     {
-                        newTree = kind == RangeOps::RelationKind::AlwaysTrue ? gtNewTrue() : gtNewFalse();
-                        newTree = gtWrapWithSideEffects(newTree, tree, GTF_ALL_EFFECT);
-                        return optAssertionProp_Update(newTree, tree, stmt);
+                        RangeOps::RelationKind kind =
+                            RangeOps::EvalRelop(tree->OperGet(), tree->IsUnsigned(), peeledOp1Rng, rng2);
+                        if ((kind != RangeOps::RelationKind::Unknown))
+                        {
+                            newTree = kind == RangeOps::RelationKind::AlwaysTrue ? gtNewTrue() : gtNewFalse();
+                            newTree = gtWrapWithSideEffects(newTree, tree, GTF_ALL_EFFECT);
+                            return optAssertionProp_Update(newTree, tree, stmt);
+                        }
                     }
                 }
             }

src/coreclr/jit/rangecheck.h

@@ -133,8 +133,12 @@ struct Limit
     {
         return type == keBinOpArray;
     }
-    bool AddConstant(int i)
+    bool AddConstant(int i, bool* overflows = nullptr)
     {
+        if (overflows != nullptr)
+        {
+            *overflows = false;
+        }
         switch (type)
         {
             case keDependent:
@@ -143,6 +147,10 @@ struct Limit
             case keConstant:
                 if (IntAddOverflows(cns, i))
                 {
+                    if (overflows != nullptr)
+                    {
+                        *overflows = true;
+                    }
                     return false;
                 }
                 cns += i;

src/tests/JIT/Regression/JitBlue/Runtime_122288/Runtime_122288.cs

@@ -0,0 +1,37 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+// Generated by Fuzzlyn v3.3 on 2025-12-07 15:16:42
+// Run on X64 Windows
+// Seed: 1178100487102642388-vectort,vector128,vector256,x86aes,x86avx,x86avx2,x86avx512bw,x86avx512bwvl,x86avx512cd,x86avx512cdvl,x86avx512dq,x86avx512dqvl,x86avx512f,x86avx512fvl,x86avx512fx64,x86bmi1,x86bmi1x64,x86bmi2,x86bmi2x64,x86fma,x86lzcnt,x86lzcntx64,x86pclmulqdq,x86popcnt,x86popcntx64,x86sse,x86ssex64,x86sse2,x86sse2x64,x86sse3,x86sse41,x86sse41x64,x86sse42,x86sse42x64,x86ssse3,x86x86base
+// Reduced from 246.6 KiB to 0.4 KiB in 00:07:26
+// Debug: Prints 1 line(s)
+// Release: Prints 0 line(s)
+
+using System;
+using Xunit;
+
+public class Runtime_122288
+{
+    private class C0
+    {
+        public byte F0;
+        public uint F2;
+    }
+
+    [Fact]
+    public static void TestEntryPoint()
+    {
+        var vr7 = new C0[]
+        {
+            new C0()
+        };
+        if (1 >= (2147483646 + (ushort)(vr7[0].F2 - 1)))
+        {
+        }
+        else
+        {
+            throw new InvalidOperationException();
+        }
+    }
+}