Array indexed by exhaustive match still generates bounds checks

[Arnavion]

Given this enum that has two inner enums for a total of 3 + 2 = 5 variants, rustc fails to notice that the match output is always within arr's bounds and still generates bounds-checking code. Godbolt

pub enum Foo {
	A(A),
	B(B),
}

pub enum A {
	A0,
	A1,
	A2,
}

pub enum B {
	B0,
	B1,
}

#[inline(never)]
pub fn bar(foo: Foo, arr: &[u8; 5]) -> &u8 {
	let offset: usize = match foo {
		Foo::A(A::A0) => 0,
		Foo::A(A::A1) => 1,
		Foo::A(A::A2) => 2,
		Foo::B(B::B0) => 3,
		Foo::B(B::B1) => 4,
	};

    // assert!(offset < 5);

    // unsafe { std::hint::assert_unchecked(offset < 5); }

    &arr[offset]
}

example[23e2f44c5b459d05]::bar:
        mov     eax, esi
        movzx   ecx, al
        and     eax, 1
        add     rax, 3
        test    edi, edi
        cmove   rax, rcx
        cmp     rax, 4
        ja      .LBB0_2
        add     rdx, rax
        mov     rax, rdx
        ret
.LBB0_2:
        push    rax
        lea     rdx, [rip + .Lanon.940678c4d07b326533e6ce0e838fb652.1]
        mov     esi, 5
        mov     rdi, rax
        call    qword ptr [rip + core[720a9a04bcce8565]::panicking::panic_bounds_check@GOTPCREL]

.Lanon.940678c4d07b326533e6ce0e838fb652.0:
        .asciz  "/app/example.rs"

.Lanon.940678c4d07b326533e6ce0e838fb652.1:
        .quad   .Lanon.940678c4d07b326533e6ce0e838fb652.0
        .asciz  "\017\000\000\000\000\000\000\000\037\000\000\000\006\000\000"

Commenting out any of the five variants removes the bounds check. This is the case even if commenting out, say, A2, so that the min and max values generated by the match are still 0..=4. In other words it seems the number of variants matters, not the values they map to.

Keeping all five variants and increasing the array size to 256 also eliminates the bounds check. In this case, changing the B1 arm to map to 255 still does not generate bounds checks. So it seems rustc does track the range of all five arms, but somehow the array length being 256 or less than 256 matters to it.

Flattening all five variants into one enum also eliminates the bounds check.

Uncommenting the assert! replaces the bounds check code with assert panic code, so there's no net benefit. Uncommenting the assert_unchecked eliminates the bounds check as expected.

Based on the compilers Godbolt provides, this regressed between 1.81.0 and 1.82.0. That is, 1.81.0 does not generate bounds checks but 1.82.0 does. These are old enough that I figured this doesn't deserve to be tagged as "regression". In any case it is not noticeable in benchmarks of my real code (more top-level variants and a lot more sub-variants) since the branch is predicted correctly.

I noticed #147831 , but given that that one regressed from 1.89 to 1.90, I assume it is not the same as this one.

Meta

rustc --version --verbose:

rustc 1.93.0-nightly (c871d09d1 2025-11-24)
binary: rustc
commit-hash: c871d09d1cc32a649f4c5177bb819646260ed120
commit-date: 2025-11-24
host: x86_64-unknown-linux-gnu
release: 1.93.0-nightly
LLVM version: 21.1.5

rustc 1.81.0 (eeb90cda1 2024-09-04)
binary: rustc
commit-hash: eeb90cda1969383f56a2637cbd3037bdf598841c
commit-date: 2024-09-04
host: x86_64-unknown-linux-gnu
release: 1.81.0
LLVM version: 18.1.7

rustc 1.82.0 (f6e511eec 2024-10-15)
binary: rustc
commit-hash: f6e511eec7342f59a25f7c0534f1dbea00d01b14
commit-date: 2024-10-15
host: x86_64-unknown-linux-gnu
release: 1.82.0
LLVM version: 19.1.1

[lukaslueg]

Adding #[repr(usize)] to either A or B makes the bounds-check disappear

[moxian]

Regression in nightly-2024-08-04. PRs in range:

 - #128361 (Migrate `link-cfg` and `rustdoc-default-output` `run-make` tests to rmake) by Oneirical
 - #128528 (Finish removing `has_cpuid`) by workingjubilee
 - #128576 (Update cargo) by weihanglo
 - #128356 (Migrate `cross-lang-lto-clang` and `cross-lang-lto-pgo-smoketest` `run-make` tests to rmake) by Oneirical
 - #128595 (Rollup of 7 pull requests) by matthiaskrgr
   - #126704 (Added SHA512, SM3, SM4 target-features and `sha512_sm_x86` feature gate)
   - #127586 (Add `#[must_use]` to some `into_raw*` functions.)
   - #128161 (nested aux-build in tests/rustdoc/ tests)
   - #128303 (Enable `std::io::copy` specialisation for `std::pipe::{PipeReader, PipeWriter}`)
   - #128368 (Formatting tweaks)
   - #128483 (Still more `cfg` cleanups)
   - #128557 (chore: use shorthand initializer)
 - #128404 (Revert recent changes to dead code analysis) by compiler-errors
 - #128370 (linker: Pass fewer search directories to the linker) by petrochenkov
 - #127324 (Simplify match based on the cast result of `IntToInt`) by DianQK
 - #128614 (Rollup of 7 pull requests) by matthiaskrgr
   - #127921 (Stabilize unsafe extern blocks (RFC 3484))
   - #128283 (bootstrap: fix bug preventing the use of custom targets)
   - #128530 (Implement `UncheckedIterator` directly for `RepeatN`)
   - #128551 (chore: refactor backtrace style in panic)
   - #128573 (Simplify `body` usage in rustdoc)
   - #128581 (Assert that all attributes are actually checked via `CheckAttrVisitor` and aren't accidentally usable on completely unrelated HIR nodes)
   - #128603 (Update run-make/used to use `any_symbol_contains`)

• Sounds like Simplify match based on the cast result of IntToInt #127324 ?

@rustbot label: +I-slow +A-mir-opt +S-has-bisection