JIT: perf regression from improved local struct copy prop

[AndyAyersMS]

See #74384 (comment)

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

Issue Details

---

See #74384 (comment)

Author:	AndyAyersMS
Assignees:	-
Labels:	area-CodeGen-coreclr, untriaged
Milestone:	-

[AndyAyersMS]

We now run asserion gen "early" for some block expansions, so we miss out on some assertions for some kinds of expansions.

In particular in the baseline jit we did:

fgMorphTree BB02, STMT00005 (before)
 [000026] IA--------- * ASG struct (init)
 [000025] n------N--- +--* BLK struct<8>
 [000023] ----------- | \--* ADDR byref 
 [000022] -------N--- | \--* LCL_VAR ref V03 loc2 
 [000024] ----------- \--* CNS_INT int 0
MorphInitBlock:
MorphBlock for dst tree, before:
 [000025] n----+-N--- * BLK struct<8>
 [000023] -----+----- \--* ADDR byref 
 [000022] D----+-N--- \--* LCL_VAR ref V03 loc2 
MorphBlock after:
 [000025] n----+-N--- * BLK struct<8>
 [000023] -----+----- \--* ADDR byref 
 [000022] D----+-N--- \--* LCL_VAR ref V03 loc2 
PrepareDst for [000025] have found a local var V03.
fgMorphOneAsgBlock (after):
 [000026] -A--------- * ASG ref 
 [000022] D----+-N--- +--* LCL_VAR ref V03 loc2 
 [000024] -----+----- \--* CNS_INT ref null
MorphInitBlock (after):
 [000026] -A--------- * ASG ref 
 [000022] D----+-N--- +--* LCL_VAR ref V03 loc2 
 [000024] -----+----- \--* CNS_INT ref null
GenTreeNode creates assertion:
 [000026] -A--------- * ASG ref 
In BB02 New Local Constant Assertion: V03 == null, index = #01

fgMorphTree BB02, STMT00005 (after)
 [000026] -A---+----- * ASG ref 
 [000022] D----+-N--- +--* LCL_VAR ref V03 loc2 
 [000024] -----+----- \--* CNS_INT ref null

fgMorphTree BB02, STMT00006 (before)
 [000029] --CXG------ * CALL help void HELPER.CORINFO_HELP_ARRADDR_ST
 [000020] ----------- arg0 +--* LCL_VAR ref V01 loc0 
 [000028] ----------- arg1 +--* CAST long <- int
 [000021] ----------- | \--* LCL_VAR int V02 loc1 
 [000027] ----------- arg2 \--* LCL_VAR ref V03 loc2 

Initializing arg info for 29.CALL:
Args for call [000029] CALL after AddFinalArgsAndDetermineABIInfo:
CallArg[[000020].LCL_VAR ref (By value), 1 reg: rcx, byteAlignment=8]
CallArg[[000028].CAST long (By value), 1 reg: rdx, byteAlignment=8]
CallArg[[000027].LCL_VAR ref (By value), 1 reg: r8, byteAlignment=8]

Morphing args for 29.CALL:

Assertion prop in BB02:
Constant Assertion: V03 == null, index = #01
 [000027] ----------- * CNS_INT ref null

Sorting the arguments:
Deferred argument ('rdx'):
 [000028] -----+----- * CAST long <- int
 [000021] -----+----- \--* LCL_VAR int V02 loc1 
Moved to late list
Deferred argument ('rcx'):
 [000020] -----+----- * LCL_VAR ref V01 loc0 
Moved to late list
Deferred argument ('r8'):
 [000027] -----+----- * CNS_INT ref null
Moved to late list

Register placement order: rdx rcx r8 
Args for [000029].CALL after fgMorphArgs:
CallArg[[000020].LCL_VAR ref (By value), 1 reg: rcx, byteAlignment=8, isLate, processed]
CallArg[[000028].CAST long (By value), 1 reg: rdx, byteAlignment=8, isLate, processed]
CallArg[[000027].CNS_INT ref (By value), 1 reg: r8, byteAlignment=8, isLate, processed]
OutgoingArgsStackSize is 32

fgMorphIndexAddr (before remorph):
 [000049] ---X------- * COMMA byref 
 [000042] ---X------- +--* BOUNDS_CHECK_Rng void 

In the current jit we don't get this assertion. This optimization happens later during assertion prop, but by then it is too late to hoist invariants. So, we end up with the following inner loop codegen where a load is not hoisted.

;; before
IN0007: 000013 align [13 bytes for IG03]
G_M31925_IG03: ; offs=000020H, size=0014H, bbWeight=4 PerfScore 16.00, gcrefRegs=00000001 {rax}, byrefRegs=00000000 {}, loop=IG03, BB02 [0001], byref, isz

IN0008: 000020 movsxd r8, ecx
IN0009: 000023 cmp r8, rdx
IN000a: 000026 jae SHORT G_M31925_IG05
IN000b: 000028 xor r9, r9
IN000c: 00002B mov gword ptr [rax+8*r8+10H], r9
IN000d: 000030 dec ecx
IN000e: 000032 jns SHORT G_M31925_IG03

;; after
G_M46622_IG03: ; offs=00000FH, size=001BH, bbWeight=4 PerfScore 25.00, gcrefRegs=00000001 {rax}, byrefRegs=00000000 {}, BB02 [0001], byref, isz

IN0005: 00000F movsxd rcx, edx
IN0006: 000012 mov r8d, dword ptr [rax+08H]
IN0007: 000016 cmp rcx, r8
IN0008: 000019 jae SHORT G_M46622_IG05
IN0009: 00001B movsxd rcx, edx
IN000a: 00001E xor r8, r8
IN000b: 000021 mov gword ptr [rax+8*rcx+10H], r8
IN000c: 000026 dec edx
IN000d: 000028 jns SHORT G_M46622_IG03

Seems like we perhaps should re-run assertion gen if we do field-by field or "one asg block" expansion.

Also seems odd that we don't try and detect this optimization in preorder -- we could avoid going through call morphing just to undo the call later on in morph. Anyways...

[AndyAyersMS]