[MERGE #5232 @Penguinwizzard] Avoid hoisting speculation guards in simplejit

Merge pull request #5232 from Penguinwizzard:ponch_opt_nosimplejit

There are issues with region determination for try/catch/finally and
the blocks added for the speculation guard hoisting in simplejit (in
fulljit, regions are determined earlier and avoid this issue).

OS 17538614

Author: Penguinwizzard

lib/Backend/BackwardPass.cpp

@@ -2839,7 +2839,10 @@ BackwardPass::ProcessBlock(BasicBlock * block)
         if(IsCollectionPass())
         {
 #ifndef _M_ARM
-            if (this->collectionPassSubPhase == CollectionPassSubPhase::FirstPass)
+            if (
+                   this->collectionPassSubPhase == CollectionPassSubPhase::FirstPass
+                && !this->func->IsSimpleJit()
+                )
             {
                 // In the collection pass we do multiple passes over loops. In these passes we keep
                 // track of sets of symbols, such that we can know whether or not they are used in
@@ -3232,7 +3235,11 @@ BackwardPass::ProcessBlock(BasicBlock * block)
         if (this->tag == Js::DeadStorePhase)
         {
 #ifndef _M_ARM
-            if(block->loop && !this->isLoopPrepass)
+            if(
+                   block->loop
+                && !this->isLoopPrepass
+                && !this->func->IsSimpleJit()
+                )
             {
                 // In the second pass, we mark instructions that we go by as being safe or unsafe.
                 //
@@ -3602,12 +3609,17 @@ BackwardPass::ProcessBlock(BasicBlock * block)
     NEXT_INSTR_BACKWARD_IN_BLOCK_EDITING;
 
 #ifndef _M_ARM
-    if (this->tag == Js::DeadStorePhase
+    if (
+           this->tag == Js::DeadStorePhase
+        // We don't do the masking in simplejit due to reduced perf concerns and the issues
+        // with handling try/catch structures with late-added blocks
+        && !this->func->IsSimpleJit()
         // We don't need the masking blocks in asmjs/wasm mode
         && !block->GetFirstInstr()->m_func->GetJITFunctionBody()->IsAsmJsMode()
         && !block->GetFirstInstr()->m_func->GetJITFunctionBody()->IsWasmFunction()
         && !block->isDead
-        && !block->isDeleted)
+        && !block->isDeleted
+        )
     {
         FOREACH_PREDECESSOR_BLOCK(blockPred, block)
         {

test/FlowGraph/for_of_try_catch.js

@@ -0,0 +1,22 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+function test0() {
+    for(abcd of [])
+    {
+        try {
+        } catch(e) {
+        }
+        try {
+        } catch(e) {
+        }
+    }
+}
+
+test0();
+test0();
+test0();
+
+console.log("PASSED");

test/FlowGraph/rlexe.xml

@@ -9,13 +9,19 @@
   <test>
     <default>
       <files>weird1.js</files>
-      <compile-flags>-maxinterpretcount:1 -maxsimplejitruncount:1 -werexceptionsupport -oopjit- -off:bailonnoprofile -off:cachedScope</compile-flags>
+      <compile-flags>-maxinterpretcount:1 -maxsimplejitruncount:1 -oopjit- -off:bailonnoprofile -off:cachedScope</compile-flags>
     </default>
   </test>
   <test>
     <default>
       <files>weird2.js</files>
-      <compile-flags>-maxinterpretcount:1 -maxsimplejitruncount:1 -werexceptionsupport -bgjit- -loopinterpretcount:1 -oopjit- -off:simplejit -force:inline</compile-flags>
+      <compile-flags>-maxinterpretcount:1 -maxsimplejitruncount:1 -bgjit- -loopinterpretcount:1 -oopjit- -off:simplejit -force:inline</compile-flags>
+    </default>
+  </test>
+  <test>
+    <default>
+      <files>for_of_try_catch.js</files>
+      <compile-flags>-maxinterpretcount:1 -maxsimplejitruncount:1 -bgjit- -oopjit- -off:jitloopbody</compile-flags>
     </default>
   </test>
 </regress-exe>