You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
JIT: (bug) range analysis treats int<->float casts as value-preserving #134452
Range analysis reuses the cast source range for casts to/from floating-point types, ignoring rounding and saturation. This leads to wrong relop folding and a removed bounds check (out-of-bounds read).
Minimal Repro
usingSystem;usingSystem.Runtime.CompilerServices;publicclassProgram{publicstaticvoidMain(){Console.WriteLine(Test(16777219));Console.WriteLine(Test2(-5));try{Console.WriteLine(Test3(newbyte[16777220],16777219));}catch(IndexOutOfRangeException){Console.WriteLine("IOORE");}}[MethodImpl(MethodImplOptions.NoInlining|MethodImplOptions.AggressiveOptimization)]staticintTest(intx){if(x>=0&&x<=16777219){inty=(int)(float)x;// 16777220if(y>16777219)return1;}return0;}[MethodImpl(MethodImplOptions.NoInlining|MethodImplOptions.AggressiveOptimization)]staticintTest2(intx){if(x<0){uintu=(uint)(double)x;// saturates to 0if(u==0)return1;}return0;}[MethodImpl(MethodImplOptions.NoInlining|MethodImplOptions.AggressiveOptimization)]staticintTest3(byte[]arr,intx){if(arr.Length==16777220&&x>=0&&x<=16777219)returnarr[(int)(float)x];// index 16777220 -> must throwreturn-1;}}
Expected
1
1
IOORE
Actual
0
0
0
Test3 has no bounds check and reads arr[16777220].
Regression?
Yes, regressed in .NET 11: .NET 9 and 10 are correct; .NET 11 RC2 and main are affected (win-x64).
Notes
In GetRangeFromAssertionsWorker (VNF_Cast case), result = castOpRange is only valid for integral-to-integral casts; for float/double source or target the source range doesn't bound the result.
Also TYP_UINT is mapped to the TYP_INT range, so [INT_MIN..-1] is propagated to a value that is actually 0.
Activity
dotnet-policy-service commentedon Sep 22, 2026
Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.
JIT: Fix several range check correctness bugs (#134466)
EgorBo commentedon Oct 13, 2026
Fixed by #134466