[MERGE #1657 @Penguinwizzard] Constrain conv_bool optimization to improve correctness.

Merge pull request #1657 from Penguinwizzard:fg_fix

Due to my recent change to the unsigned compare peep, the conv_bool
optimization was causing instructions to be generated in a way that
the some registers could have two overlapping lifetimes. This fixes
the issue by checking for these ByteCodeUses instructions, and then
placing the conv_bool after them.

Author: Penguinwizzard

lib/Backend/GlobOpt.cpp

@@ -12257,7 +12257,19 @@ GlobOpt::TypeSpecializeBinary(IR::Instr **pInstr, Value **pSrc1Val, Value **pSrc
 
                 varDst = IR::RegOpnd::New(intDst->m_sym->GetVarEquivSym(this->func), TyVar, this->func);
                 IR::Instr *convBoolInstr = IR::Instr::New(Js::OpCode::Conv_Bool, varDst, intDst, this->func);
-                instr->InsertAfter(convBoolInstr);
+                // In some cases (e.g. unsigned compare peep code), a comparison will use variables
+                // other than the ones initially intended for it, if we can determine that we would
+                // arrive at the same result. This means that we get a ByteCodeUses operation after
+                // the actual comparison. Since Inserting the Conv_bool just after the compare, and
+                // just before the ByteCodeUses, would cause issues later on with register lifetime
+                // calculation, we want to insert the Conv_bool after the whole compare instruction
+                // block.
+                IR::Instr *putAfter = instr;
+                while (putAfter->m_next && putAfter->m_next->m_opcode == Js::OpCode::ByteCodeUses)
+                {
+                    putAfter = putAfter->m_next;
+                }
+                putAfter->InsertAfter(convBoolInstr);
                 convBoolInstr->SetByteCodeOffset(instr);
 
                 this->ToVarRegOpnd(varDst, this->currentBlock);

test/Bugs/bug9080773.js

@@ -0,0 +1,24 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+function func(d0) {
+    i1 = ((d0) == (+((((((0x517ddbc)-(0xc7276b6f)+(-0x8000000))>>>(((0x0)))) >= (0x4866034e))))));
+    return i1 + d0;
+}
+
+var d1 = (1.015625);
+func(d1);
+func(d1);
+
+func(d1);
+func(d1);
+func(d1);
+func(d1);
+
+runningJITtedCode = true;
+func(d1);
+func(d1);
+
+WScript.Echo("PASSED");

test/Bugs/rlexe.xml

@@ -284,6 +284,12 @@
       <compile-flags> -bgjit- -simdjs -simd128typespec -mic:1 -lic:1 -off:simplejit</compile-flags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>bug9080773.js</files>
+      <compile-flags>-maxinterpretcount:1 -off:simplejit</compile-flags>
+    </default>
+  </test>
   <test>
     <default>
       <files>b208_asmjs.js</files>