Missing IndexOutOfRangeException in optimized code

[EgorBo]

using System;
using System.Runtime.CompilerServices;

Console.WriteLine(Test(new int[4], int.MinValue));

[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.AggressiveOptimization)]
static int Test(int[] array, int index)
{
 if ((uint)(index - int.MaxValue) < (uint)array.Length && index < array.Length)
 {
 ref int unused = ref array[index];
 return 1;
 }
 return 0;
}

Optimized: prints 1.
With DOTNET_JitMinOpts=1: throws IndexOutOfRangeException (expected).

.NET 11.0, win-x64.

unchecked(int.MinValue - int.MaxValue) is 1, so both guards pass, but index is still negative. The negative-offset case in MergeEdgeAssertionsWorker incorrectly infers index >= int.MaxValue and the bounds check is removed.

Copilot-generated.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[MihuBot]

I'm a bot. Here is a possible related and/or duplicate issue (I may be wrong):

• JIT: RangeCheck keeps a stale range when assertion tightening yields an empty range, causing bad conditional folding #132841