JIT: check operand def chains for overflow in RangeCheck::ComputeDoesOverflow

[EgorBo]

Fixes#132841

Diffs

The existing path "it never overflows" always looked weird to me, I guess GetRange used to fold branches finally uncovered that as a bug.

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
11 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR updates CoreCLR JIT range analysis overflow validation so that “non-overflowing” operators (e.g., GT_NEG) also consider overflow in their operand definition chains, and adds a regression test for the miscompile reported in #132841.

Changes:

• Update RangeCheck::ComputeDoesOverflow to recursively check operand def chains for GT_AND, GT_RSH, GT_RSZ, GT_UMOD, and GT_NEG.
• Add a new JIT regression test Runtime_132841 and include it in Regression_ro_2.csproj.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/coreclr/jit/rangecheck.cpp	Extend overflow checking to walk operand def chains for certain operators so range-derived folding doesn’t rely on overflow-unsafe facts.
src/tests/JIT/Regression/Regression_ro_2.csproj	Add the new regression test source file to the merged test project.
src/tests/JIT/Regression/JitBlue/Runtime_132841/Runtime_132841.cs	Add a targeted xUnit regression test reproducing the Math.Abs folding miscompile scenario.

[AndyAyersMS]

Validated this against the randomized generator that found #132841. Re-ran with identical seed bases before and after applying the JIT hunk here (x64 checked, tier0_min / fullopts / tier1_pgo / fullopts_no_poap):

Program shape	Seeds	Fail before	Fail after	Newly broken
Math.Abs guard folded to a throw	500	133	0	0
((-v) < 0) folded to a wrong value	500	222	0	0
Total	1,000	355	0	0

Plus 450 (and counting) trials on fresh seeds with the patch applied, all clean — that shape failed ~44% of the time before, so this is covering the whole generated distribution (ADD/MUL/SHL wraps × three guard forms × nine consumers), not just the two reduced repros.

The GT_NEG arm is what covers the wrong-value case I commented with on the issue. Since Runtime_132841.cs here only exercises the throwing variant, it might be worth adding that one too — it guards a different consumer shape (GT_NEG feeding a compare, rather than Math.Abs's internal int.MinValue guard), so a regression that only affected non-throwing consumers would slip past the current test.

[EgorBo]

@AndyAyersMS PTAL, had to restart CI to fix merge conflict in csproj. A few regressions, correctness related.

The existing path "it never overflows" always looked weird to me, I guess GetRange used to fold branches finally uncovered that as a bug.

[Copilot]

🟢 Approval recommended

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite

[EgorBo]

/ba-g infra