Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Do you really want to apply this on such a scale?

How about Test(~4, new int[10}); where the behavior changes?

There must be some code relying on these simple checks to just work as expected.

This is a nice optimization under controlled circumstances like Span, but can break spectacular.

How about Test(~4, new int[10}); where the behavior changes?

What change?

~4 becomes -5. X < NN is therefore -5 < 10 which is true so it evaluates the second half where -5 >= 0 which would be false

It transforms that to (unsigned)x < NN. So we get 4294967291 < 10 which is false.

— In general x < NN && x >= 0 to X u< NN and x >= NN || x < 0 to X u>= NN are safe transforms provided the NN condition is met (which more specifically means the most significant bit isn’t set, including for unsigned), which is what the transform is limited against.

Speaking of, however, are we handling both forms of the comparison @EgorBo? That is both the && and the || variants to ensure either branching pattern works?

Test(int.MinValye+4) was the case I tried to write. Sorry for the confusion.
This optimization is simply assuming not the whole integer range is used.

You might get away with this if you are at the same time using a bigger types, which may just work on 64 bit depending on processor type. But we can't just break normal integer ranges.

That wouldn’t fail either, it is -2147483644 as signed and 2147483652 as unsigned which is less than 0 and greater than 10, respectively

This transform is safe for any two’s complement integer where NN is known to not have the most significant bit set (and therefore would be never negative if interpreted as a signed value).

Yes, under that assumption the >= 0 check is always true. But with the short sample code it is impossible to prove that it is net set. And using the array length is just any other positive integer as bound as it is not used to access the array. That doesn't say anything about the index integer.

But it looks like the changed code already does 'a fe'w more checks than this simple example code.

The length of an array is statically known to be “never negative” when interpreted as signed, it is an invariant of the runtime and is what makes this safe.

This PR is taking advantage of that invariant