JIT does not hoist bound check outside a loop

[hez2010]

Repro (needs features/ref-fields branch of roslyn to compile):

using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;

void Foo(ref Color color, uint index)
{
    for (var i = 0; i < 100; i++)
    {
        color.Raw[index] = 3;
    }
}

var color = new Color { R = 1, G = 2, B = 3, A = 4 };
Foo(ref color, 1);
Console.WriteLine(color.G);

[StructLayout(LayoutKind.Explicit)]
struct Color
{
    [FieldOffset(0)] public byte R;
    [FieldOffset(1)] public byte G;
    [FieldOffset(2)] public byte B;
    [FieldOffset(3)] public byte A;

    [FieldOffset(0)] public int Rgba;

    public ColorView<byte> Raw => new(ref this);
    public ColorView<short> SRaw => new(ref this);
}

ref struct ColorView<T> where T : unmanaged
{
    private ref Color color;
    public ColorView(ref Color color)
    {
        this.color = ref color;
    }
    private static ref T Throw() => throw new IndexOutOfRangeException();
    
    public ref T this[uint index]
    {
        [MethodImpl(MethodImplOptions.AggressiveInlining)]
        get
        {
            unsafe
            {
                return ref sizeof(T) * index >= sizeof(Color) ? 
                    ref Throw() : 
                    ref Unsafe.Add(ref Unsafe.AsRef<T>(Unsafe.AsPointer(ref color)), index);
            }
        }
    }
}

Codegen for Foo:

G_M17293_IG01:
       sub      rsp, 40
                                                ;; size=4 bbWeight=0    PerfScore 0.00
G_M17293_IG02:
       xor      eax, eax
                                                ;; size=2 bbWeight=1    PerfScore 0.25
G_M17293_IG03:
       cmp      edx, 4
       jae      SHORT G_M17293_IG05
       mov      r8d, edx
       mov      r9, rcx
       add      r8, r9
       mov      byte  ptr [r8], 3
       inc      eax
       cmp      eax, 100
       jl       SHORT G_M17293_IG03
                                                ;; size=25 bbWeight=4    PerfScore 18.00
G_M17293_IG04:
       add      rsp, 40
       ret
                                                ;; size=5 bbWeight=1    PerfScore 1.25
G_M17293_IG05:
       call     [ColorView`1:Throw():byref]
       int3
                                                ;; size=7 bbWeight=0    PerfScore 0.00

I expect to see the bound check to be hosited outside the loop.

category:cq
theme:bounds-checks
skill-level:expert
cost:medium
impact:medium

Tagging subscribers to this area: @JulieLeeMSFT
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Repro (needs features/ref-fields branch of roslyn to compile):

using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;

void Foo(ref Color color, uint index)
{
    for (var i = 0; i < 100; i++)
    {
        color.Raw[index] = 3;
    }
}

var color = new Color { R = 1, G = 2, B = 3, A = 4 };
Foo(ref color, 1);
Console.WriteLine(color.G);

[StructLayout(LayoutKind.Explicit)]
struct Color
{
    [FieldOffset(0)] public byte R;
    [FieldOffset(1)] public byte G;
    [FieldOffset(2)] public byte B;
    [FieldOffset(3)] public byte A;

    [FieldOffset(0)] public int Rgba;

    public ColorView<byte> Raw => new(ref this);
    public ColorView<short> SRaw => new(ref this);
}

ref struct ColorView<T> where T : unmanaged
{
    private ref Color color;
    public ColorView(ref Color color)
    {
        this.color = ref color;
    }
    private static ref T Throw() => throw new IndexOutOfRangeException();
    
    public ref T this[uint index]
    {
        [MethodImpl(MethodImplOptions.AggressiveInlining)]
        get
        {
            unsafe
            {
                return ref sizeof(T) * index >= sizeof(Color) ? 
                    ref Throw() : 
                    ref Unsafe.Add(ref Unsafe.AsRef<T>(Unsafe.AsPointer(ref color)), index);
            }
        }
    }
}

Codegen for Foo:

G_M17293_IG01:
       sub      rsp, 40
                                                ;; size=4 bbWeight=0    PerfScore 0.00
G_M17293_IG02:
       xor      eax, eax
                                                ;; size=2 bbWeight=1    PerfScore 0.25
G_M17293_IG03:
       cmp      edx, 4
       jae      SHORT G_M17293_IG05
       mov      r8d, edx
       mov      r9, rcx
       add      r8, r9
       mov      byte  ptr [r8], 3
       inc      eax
       cmp      eax, 100
       jl       SHORT G_M17293_IG03
                                                ;; size=25 bbWeight=4    PerfScore 18.00
G_M17293_IG04:
       add      rsp, 40
       ret
                                                ;; size=5 bbWeight=1    PerfScore 1.25
G_M17293_IG05:
       call     [ColorView`1:Throw():byref]
       int3
                                                ;; size=7 bbWeight=0    PerfScore 0.00

I expect to see the bound check to be hosited outside the loop.

Author:	hez2010
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[AndyAyersMS]

cc @BruceForstall

This sort of "hoisting" is actually done by loop cloning, but cloning does not understand what you're doing is equivalent to a bounds check; it is literally looking for array accesses.

More generally cloning could be triggered by any loop-variant predicate where the variance is a simple "linear" function of the induction variable (so that it is possible to predict in advance of the loop, if the limits are known, the range of conditions that will be checked, and it suffices to check the low and high limits to determine the range of values of the predicate). But we don't do that sort of thing today.