Mono LLVM AOT crashes on overflowing array length loop limit

[AndyAyersMS]

Description

Mono LLVM AOT crashes instead of throwing IndexOutOfRangeException for a
decreasing array loop whose array.Length + int.MaxValue limit wraps negative.
The test was added in #133834 for a CoreCLR loop-cloning regression and exposes
a separate Mono LLVM AOT bounds-check/codegen issue.

static int Repro(int[] array, int[] limit)
{
    int sum = 0;
    for (int i = array.Length - 1; i > limit.Length + int.MaxValue; i--)
    {
        sum += array[i];
    }
    return sum;
}

Calling Repro(new int[4], new int[4]) should throw
IndexOutOfRangeException. In the llvmaot runtime variant it instead crashes
natively before xUnit can observe the exception.

Configuration

• Pipeline: linux-x64 Release AllSubsets_Mono_LLVMAot_RuntimeTests
• Runtime variant: llvmaot
• Helix work item: JIT.opt
• Test: OffsetLimit.DecGtArrayLengthPlusMaxValue
• Failure: SIGSEGV followed by SIGABRT, exit code 134
• Build: https://dev.azure.com/dnceng-public/public/_build/results?buildId=1594849

The current evidence is specific to Mono LLVM AOT. Mono JIT, interpreter, and
other AOT variants have not shown this failure.

Re-enable condition

Remove the IsMonoLLVMAOT ActiveIssue from the test after this loop throws
IndexOutOfRangeException under the llvmaot runtime variant.

Note

This issue was drafted with GitHub Copilot.

[dotnet-policy-service]

Tagging subscribers to this area: @steveisok, @vitek-karas
See info in area-owners.md if you want to be subscribed.