JIT fails to treat expression as non-negative after range check

[MihaZupan]

https://godbolt.org/z/Wv5bv99bb

public static short Test1(ref short searchSpace, int searchSpaceLength)
{
    if (searchSpaceLength < Vector128<short>.Count)
        return 42;
    
    return Unsafe.Add(ref searchSpace, searchSpaceLength - Vector128<short>.Count);
}

public static short Test2(ref short searchSpace, int searchSpaceLength)
{
    if (searchSpaceLength < Vector128<short>.Count)
        return 42;
    
    return Unsafe.Add(ref searchSpace, (uint)searchSpaceLength - (nuint)Vector128<short>.Count);
}

-add      esi, -8
-movsxd   rax, esi
-movsx    rax, word  ptr [rdi+2*rax]
+mov      eax, esi
+movsx    rax, word  ptr [rdi+2*rax-0x10]

This occurs in practice in a bunch of places throughput our IndexOf-like logic, e.g.

runtime/src/libraries/System.Private.CoreLib/src/System/SpanHelpers.Packed.cs

Line 431 in 7e5e573

ref short oneVectorAwayFromEnd = ref Unsafe.Add(ref searchSpace, length - Vector256<short>.Count);

runtime/src/libraries/System.Private.CoreLib/src/System/SearchValues/IndexOfAnyAsciiSearcher.cs

Line 347 in 7e5e573

ref short oneVectorAwayFromEnd = ref Unsafe.Add(ref searchSpace, searchSpaceLength - Vector256<short>.Count);

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.