JIT: eliminate redundant bounds checks for span.Slice(span.Length - cns)

[EgorBo]

Closes #127486

For the snippet from the issue:

int Test(ReadOnlySpan<byte> span)
{
    if (span.Length >= sizeof(int))
    {
        return BinaryPrimitives.ReadInt32BigEndian(span.Slice(span.Length - sizeof(int)));
    }
    return -1;
}

-       sub      rsp, 40
-       mov      rcx, bword ptr [rdx]
-       mov      edx, dword ptr [rdx+0x08]
-       cmp      edx, 4
-       jge      SHORT G_M27777_IG05
+       mov      rax, bword ptr [rcx]
+       mov      ecx, dword ptr [rcx+0x08]
+       cmp      ecx, 4
+       jl       SHORT G_M6173_IG05
+       add      ecx, -4
+       add      rax, rcx
+       movbe    eax, dword ptr [rax]
+       ret
        mov      eax, -1
-       add      rsp, 40
        ret
-       lea      eax, [rdx-0x04]
-       cmp      eax, edx
-       ja       SHORT G_M27777_IG07
-       mov      r8d, eax
-       add      rcx, r8
-       sub      edx, eax
-       cmp      edx, 4
-       jl       SHORT G_M27777_IG08
-       movbe    eax, dword ptr [rcx]
-       add      rsp, 40
-       ret
-       call     [System.ThrowHelper:ThrowArgumentOutOfRangeException()]
-       int3
-       mov      ecx, 40
-       call     [System.ThrowHelper:ThrowArgumentOutOfRangeException(int)]
-       int3

Two changes:

• VN: add identity x - (x + a) == -a so that length - (length - cns) value-numbers to cns. This eliminates the BinaryPrimitives.ReadInt32BigEndian length check after Slice.
• RangeCheck: in GetRangeFromAssertionsWorker, recognize the correlated relop ADD(A, K) op A (constant K < 0) and fold it when A's lower bound is >= -K (so the add cannot wrap, signed or unsigned). This eliminates the Slice(start) (uint)start > (uint)_length check.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR improves CoreCLR JIT optimizations to eliminate redundant bounds checks in the common pattern span.Slice(span.Length - cns) by strengthening value numbering identities and range-check assertion reasoning, enabling subsequent checks (including in BinaryPrimitives.ReadInt32BigEndian) to fold away.

Changes:

• Extend VN math identities to recognize x - (x + a) / x - (a + x) as -a (non-floating, non-overflowing case).
• Enhance RangeCheck’s assertion-based relop folding by proving ADD(A, K) < A for negative K when A’s lower bound is high enough to prevent wraparound.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/coreclr/jit/valuenum.cpp	Adds a new subtraction identity and cleans up ADD/SUB VNFunc usage to improve VN simplification for length - (length - cns) patterns.
src/coreclr/jit/rangecheck.cpp	Adds correlated relop folding logic to eliminate the Slice(start) (uint)start > (uint)_length check when proven false via assertions.

[EgorBo]

PTAL @jakobbotsch @dotnet/jit-contrib Diffs

[EgorBo]

/ba-g filed #127500 for ios/android failure (there are hits in other PRs)