JIT, interpreter, AOT preinit, and CoreLib: Saturate float/double conversions to small integral types

[Copilot]

Unchecked float/double → small integral type (sbyte, byte, short, ushort, char) conversions did not saturate at the small-type boundary. For example, (short)(double)32768.000000000007 produced -32768 instead of 32767, diverging from the saturating R → int contract introduced in .NET 9.

The JIT expands R → smallT as R → int → smallT. The inner R → int saturates, but the outer int → smallT only truncates low bits. The CoreCLR interpreter and the ILC type preinitializer had analogous bugs and were updated for parity with runtime behavior. In addition, CoreLib TryConvert paths for float/double to small integral types were updated to use direct casts on CoreCLR (while preserving existing MONO behavior under #if MONO).

Summary

Fixes saturating semantics for unchecked float/double → small integral type casts across all supported JIT targets (xarch, x86, arm64, RISC-V64, LoongArch64, ARM32, and WASM), the CoreCLR interpreter, and the NativeAOT type preinitializer, and applies corresponding CoreCLR-side TryConvert simplifications that rely on the corrected cast semantics. Mono runtime backends still need analogous updates and are tracked separately; the JIT regression test is [SkipOnMono] in the meantime.

Changes Made

• src/coreclr/jit/morph.cpp — fgMorphExpandCast: Added target-specific handling so R -> small saturates at destination bounds across supported architectures:
  • FEATURE_HW_INTRINSICS targets use float-domain min/max clamping before existing cast expansion.
  • WASM lowers min/max via GT_INTRINSIC.
  • ARM32, RISC-V64, and LoongArch64 use integer-domain saturation (R -> int32 followed by NI_PRIMITIVE_SaturateTo{Int8,Int16,UInt8,UInt16}), preserving NaN→0 semantics from the saturating R → int cast.
• JIT plumbing for the new NI_PRIMITIVE_SaturateTo{Int8,Int16,UInt8,UInt16} intrinsics and the WASM binary GT_INTRINSIC(MaxNative/MinNative) produced by morph:
  • gentree.cpp: added the four SaturateTo* cases to the unary GT_INTRINSIC cost switch in gtSetEvalOrder, added a TARGET_WASM block to the binary GT_INTRINSIC cost switch for MaxNative/MinNative, and added dump labels for the four SaturateTo* IDs (fixes the 'Unknown binary GT_INTRINSIC operator' assert seen on e.g. System.Half:op_Explicit(System.Half):byte).
  • importercalls.cpp IsTargetIntrinsic: added the four SaturateTo* IDs to the ARM, RISCV64, and LoongArch64 switches so rationalize.cpp's IsTargetIntrinsic assertion is satisfied.
  • valuenum.cpp fgValueNumberIntrinsic: added an explicit branch for the SaturateTo* IDs that gives the node an opaque unary VN, backed by new VNF_SaturateToInt8/Int16/UInt8/UInt16 entries in valuenumfuncs.h, so VN no longer hits the assert(NI_System_Object_GetType) for these intrinsics.
  • valuenum.cpp EvalMathFuncBinary: extended the MaxNative/MinNative constant-folding (TYP_DOUBLE / TYP_FLOAT) and VNFunc selection (VNF_MaxNumber / VNF_MinNumber) cases to also apply on WASM, not just RISC-V64, so the binary GT_INTRINSIC produced by morph on WASM no longer hits unreached() here.
  • assertionprop.cpp IntegralRange::ForNode: taught range analysis the exact result range for each SaturateTo* intrinsic ([ByteMin, ByteMax], [ShortMin, ShortMax], [0, UByteMax], [0, UShortMax]).
• ARM32 codegen for SaturateTo*: new INS_ssat/INS_usat Thumb-2 instructions in instrsarm.h, encoding/disassembly support in emitarm.cpp, LSRA/codegen wiring in lsraarm.cpp and codegenarmarch.cpp.
• RISC-V64 / LoongArch64 codegen for SaturateTo*: branch-based clamp in codegenriscv64.cpp / codegenloongarch64.cpp, with LSRA support in lsrariscv64.cpp / lsraloongarch64.cpp.
• src/coreclr/vm/interpexec.cpp — ConvFpHelper: clamps to numeric_limits<TResult> (the destination type) instead of TIntermediate, so floating-point → small-integral conversions now saturate at the destination type's range.
• src/coreclr/tools/aot/ILCompiler.Compiler/Compiler/TypePreinit.cs: float-domain conv_i1/conv_i2/conv_u1/conv_u2 cases now explicitly saturate via Math.Clamp (NaN → 0), so AOT-baked statics match runtime behavior regardless of which host JIT runs ILC. Original simple-cast version is kept commented out with a TODO to restore once the fix has propagated through the toolchain.
• CoreLib TryConvert simplifications (Double.cs, Single.cs, SByte.cs, Int16.cs): float/double → small-integral TryConvertTo* / TryConvertFrom* paths now use a direct cast on CoreCLR, with the existing manual clamp preserved under #if MONO.
• Tests: re-enabled previously-disabled DoubleTests.GenericMath.ConvertToIntegerTest / SingleTests.GenericMath.ConvertToIntegerTest (issue (short)(double)32768.000000000007 produces invalid result #116823 suppressions removed), added a JitBlue regression test for the float/double → small-integral saturation contract (marked [SkipOnMono] pending Mono backend updates), and updated the interpreter test comment/coverage.

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 22 changed files in this pull request and generated no new comments.

[tannergooding]

@copilot, some builds are failing with asserts similar to:

#2665 D:\a\_work\1\s\src\coreclr\jit\gentree.cpp (7244) - Assertion failed '!"Unknown binary GT_INTRINSIC operator"' in 'System.Half:op_Explicit(System.Half):byte' during 'Find oper order' (IL size 9; hash 0x039d4a98; FullOpts)

This is because the new intrinsics aren't being handled under all the applicable paths. You should look at something like NI_System_Math_Abs or NI_PRIMITIVE_LeadingZeroCount to find the various places that need the new IDs handled.

[Copilot]

@copilot, some builds are failing with asserts similar to:

#2665 D:\a\_work\1\s\src\coreclr\jit\gentree.cpp (7244) - Assertion failed '!"Unknown binary GT_INTRINSIC operator"' in...

Done. Audited the paths used by NI_PRIMITIVE_LeadingZeroCount / NI_System_Math_Abs and added handling for NI_PRIMITIVE_SaturateTo{Int8,Int16,UInt8,UInt16} (and the WASM binary MaxNative/MinNative from morph) in the spots that were asserting:

• gentree.cpp gtSetEvalOrder — added the four SaturateTo* cases to the unary GT_INTRINSIC cost switch (next to NI_System_Math_Abs), and added a #elif defined(TARGET_WASM) block to the binary GT_INTRINSIC cost switch for NI_System_Math_MaxNative / MinNative (this was the actual 'Unknown binary GT_INTRINSIC operator' site, since on WASM morph creates a binary GT_INTRINSIC for the float-domain clamp).
• gentree.cpp GTF dump — added dump labels for the four SaturateTo* IDs.
• importercalls.cpp IsTargetIntrinsic — added the four SaturateTo* IDs to the ARM, RISCV64, and LoongArch64 switches so rationalize.cpp's assert(IsTargetIntrinsic(...)) doesn't fire.
• valuenum.cpp fgValueNumberIntrinsic — added an explicit branch for the four SaturateTo* IDs that gives the node an opaque unary VN function (new VNF_SaturateToInt8/Int16/UInt8/UInt16 in valuenumfuncs.h), so the else assert(NI_System_Object_GetType) no longer fires for them.
• assertionprop.cpp IntegralRange::ForNode — taught range analysis the exact result range for each SaturateTo* ([ByteMin, ByteMax], [ShortMin, ShortMax], [0, UByteMax], [0, UShortMax]).

Verified by building clr.alljits for x64 (host), and cross-jit builds for loongarch64, riscv64, and the WASM cross-jit (clrjit_universal_wasm_x64); all green with no warnings.

[Copilot]

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated 5 comments.

[tannergooding]

@copilot there's still build failures due to the various math intrinsics not being handled, for example in EvalMathFuncBinary

[Copilot]

@copilot there's still build failures due to the various math intrinsics not being handled, for example in EvalMathFuncBinary

Fixed. Extended EvalMathFuncBinary in valuenum.cpp so that NI_System_Math_MaxNative / MinNative are also handled under WASM, not just RISC-V64:

• The two constant-folding switches (TYP_DOUBLE, TYP_FLOAT) now have #if defined(TARGET_RISCV64) || defined(TARGET_WASM) around the MaxNative/MinNative cases that fold via FloatingPointUtils::maximumNumber / minimumNumber.
• The non-constant VNFunc selection switch keeps the integer Max/MaxUnsigned/Min/MinUnsigned cases as #ifdef TARGET_RISCV64 (those don't apply to WASM) but moves MaxNative/MinNative → VNF_MaxNumber / VNF_MinNumber into a separate #if defined(TARGET_RISCV64) || defined(TARGET_WASM) block.

Verified by rebuilding clrjit_universal_wasm_x64 and the RISC-V64 cross-jit; both green with no warnings.

[tannergooding]

@copilot there are test failures here for Mono, it needs updated handling as well.

[Copilot]

Mono's small-int saturation fix touches every Mono codegen path that lowers OP_FCONV_TO_{I1,U1,I2,U2} / OP_RCONV_TO_{I1,U1,I2,U2} — mini-amd64.c, mini-x86.c, mini-arm.c, mini-arm64.c, mini-llvm.c, mini-ppc.c, mini-riscv.c, mini-s390x.c, mini-wasm.c, the interpreter (MINT_CONV_{I1,U1,I2,U2}_R{4,8} in interp.c), and the mono_fconv_{i1,i2,u1,u2} jit-icalls. That's a substantial expansion of this PR.

For now I've marked the Runtime_116823 regression test [SkipOnMono] referencing #116823 in the latest commit, so the JIT-side fix lands cleanly while the Mono runtime updates can be done as a follow-up. Let me know if you'd prefer I roll the Mono runtime updates into this PR instead.