A thing to watch out for with this value is that range check works on arbitrary BOUNDS_CHECK nodes, and in case of spans (and HWIs/SIMDs), the limit is int.MaxValue.

@SingleAccretion Does this observation imply an issue with this change, or you're just pointing out to be careful with range bounds?

Does this observation imply an issue with this change

Yes, it does.

For example, we must not remove a range check in a loop such as below:

private static int Problem(Span<int> a)
{
    int sum = 0;
    for (int i = 0; i < a.Length; i += 2) // 'i' will overflow for "a.Length == int.MaxValue".
    {
        sum += a[i];
    }

    return sum;
}

And I see we do with this change.

Maybe I'm missing something. When I compile your test (specifically:

using System;
using System.Runtime.CompilerServices;
namespace testns
{
    class testclass
    {
    [MethodImpl(MethodImplOptions.NoInlining)]
    private static int Problem(Span<int> a)
    {
        int sum = 0;
        for (int i = 0; i < a.Length; i += 2) // 'i' will overflow for "a.Length == int.MaxValue".
        {
            sum += a[i];
        }
        return sum;
    }
    static void Main(string[] args)
    {
        int[] a = new int[10] { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };
        int s = Problem(a);
        Console.WriteLine(s);
    }
    }
}

), I see a.Length expanded as

CALL int System.Span`1[Int32][System.Int32].get_Length

whereas this PR only affects GT_ARR_LENGTH nodes, and there are none in the test, so I don't see any diff for this case.

so I don't see any diff for this case

That is very surprising to me, there should be a diff with the removed check.

As a reference, I have checked out the change locally and obtained two dumps for Problem, one for the baseline and one for the diff: baselog.txt, difflog.txt, and I do see we remove the check in the diff, which corresponds to this change in range check's logic:

            int tmp = GetArrLength(limit.vn);
            if (tmp <= 0)
            {
-               tmp = ARRLEN_MAX;
+               tmp = CORINFO_Array_MaxLength;
            }

Ok, it was operator error: using a Debug S.P.C.dll prevents cross-module inlining, and I normally use a Debug build (if at all possible). Running with Checked (and a Debug JIT) repros the problem.

Seems like VN/AssertionProp doesn't keep array and non-array GT_BOUNDS_CHECK usage distinct. Maybe I can revert this line for now and come back to it later.