[NinoFloris]

Blocked by #136865, and #136940

A trivial change, though unrestricted it exposed an exact-type assertion issue that would leave redundant type tests and unbox helpers with this PR. So I excluded TYP_REF locals for now. I could follow up with the exact-type assertion fix to enable them too. Including TYP_REF would double the number of diffs in this PR.

The immediate practical benefit for enabling CSE is redundant bounds-check elimination when a guard and an inlined Span.Slice read the same length from an address exposed span.

Contributes to unblocking: #119689
Extracted from: #136739

Example, simplified from DnsEncodedName.Equals:

bool Equals(ReadOnlySpan<char> name)
{
    if (!Ascii.IsValid(name))
    {
        // ToString remains uninlined and receives 'name' as its ref this.
        // 'name' is now address-exposed, including its length field.
        name = s_idnMapping.GetAscii(name.ToString());
    }

    foreach (ReadOnlySpan<byte> label in EnumerateLabels())
    {
        // Reads the address-exposed 'name.Length'.
        if (label.Length > name.Length)
            return false;

        // The widened Slice check is eliminated here today. The split form
        // retains a redundant check because CSE rejects the repeated reads
        // of address-exposed 'name.Length'.
        if (!Ascii.EqualsIgnoreCase(label, name.Slice(0, label.Length)))
            return false;

        name = name.Slice(label.Length);
    }

    return name.IsEmpty;
}

[azure-pipelines]

Azure Pipelines:
Successfully started running 5 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[NinoFloris]

Decent diffs, some tp cost (+0.01% to +0.04%) which was more than made up for by #136738.

Some regressions come from register allocation choosing an extra callee-saved register because an unrelated call lies between uses, even though the value isn’t live across that call, adding unnecessary saves and restores. If that’s a blocker, I can submit a small ~15 line RA patch that addresses it. In local ARM64 PMI, that patch improves 1,343 methods and regresses 146, saving about 14 KB overall.

[NinoFloris]

Both Windows x86 and x64 retain ThrowArgumentOutOfRangeException because the span is stack-passed on x86 and passed through an implicit byref on windows x64 ABIs. These memory-based length loads lack range annotations that promoted locals receive. Addressed in #136865

[Copilot]

🟡 Changes recommended

The change can allow direct volatile-field reads from address-exposed promoted structs to be collapsed into one cached value, violating volatile-read semantics; volatile indirections must be preserved and a regression test added.

1 open issue

• Promoted volatile struct reads lose volatility and may be CSE'd · New

What changed in this PR

Enables common subexpression elimination (CSE) for non-object-reference, address-exposed locals in RyuJIT, helping eliminate redundant bounds checks in guarded span slicing.

Changes:

• Allows eligible local reads to be reused through CSE temporaries while excluding TYP_REF.
• Adds tests for guarded slicing, intervening writes, and volatile reads.
• Configures isolated, optimized test execution with disassembly checks.

File	Description
src/​tests/​JIT/​opt/​CSE/​AddressExposedLoads.csproj	Configures optimized execution and disassembly validation.
src/​tests/​JIT/​opt/​CSE/​AddressExposedLoads.cs	Tests span bounds checks, writes, and volatile reads.
src/​coreclr/​jit/​optcse.cpp	Enables CSE for eligible address-exposed local reads.

_{Review effort: Balanced}

[NinoFloris]

I can make it even better, this already happens on main :) Issue incoming.

[NinoFloris]

#136936