Arm64: Fix handling of IP0 & IP1

These are sometimes mandated to be allocated to certain nodes, but they were not in the list of allocatable registers (REG_VAR_ORDER). This led to special handling in LSRA, which, it turns out, was incomplete. This resulted in failures for JitStressRegs=0x200.
Based on the discussion in #14607, this adds IP0 to RBM_CALLEE_TRASH_NOGC, and fixes the REG_VAR_ORDER.

Fix #14607, Fix #16359, Fix #17861

3 files changed, 10 insertions, 13 deletions

diff --git a/src/jit/codegenarmarch.cpp b/src/jit/codegenarmarch.cpp
index f5053f7beb..9f0c75e00b 100644
--- a/src/jit/codegenarmarch.cpp
+++ b/src/jit/codegenarmarch.cpp
@@ -2398,6 +2398,7 @@ void CodeGen::genCallInstruction(GenTreeCall* call)
 #if 0 && defined(_TARGET_ARM64_)
         // Use this path if you want to load an absolute call target using 
         //  a sequence of movs followed by an indirect call (blr instruction)
+        // If this path is enabled, we need to ensure that REG_IP0 is assigned during Lowering.
 
         // Load the call target address in x16
         instGen_Set_Reg_To_Imm(EA_8BYTE, REG_IP0, (ssize_t) addr);
diff --git a/src/jit/lsra.cpp b/src/jit/lsra.cpp
index f6f749ffa0..5ecdee51e4 100644
--- a/src/jit/lsra.cpp
+++ b/src/jit/lsra.cpp
@@ -3366,15 +3366,8 @@ bool LinearScan::isSpillCandidate(Interval*     current,
 #endif
     {
         RefPosition* nextPhysRegPosition = physRegRecord->getNextRefPosition();
-#ifdef _TARGET_ARM64_
-        // On ARM64, we may need to actually allocate IP0 and IP1 in some cases, but we don't include it in
-        // the allocation order for tryAllocateFreeReg.
-        if ((physRegRecord->regNum != REG_IP0) && (physRegRecord->regNum != REG_IP1))
-#endif // _TARGET_ARM64_
-        {
-            assert((nextPhysRegPosition != nullptr) && (nextPhysRegPosition->nodeLocation == refLocation) &&
-                   (candidateBit != refPosition->registerAssignment));
-        }
+        assert((nextPhysRegPosition != nullptr) && (nextPhysRegPosition->nodeLocation == refLocation) &&
+               (candidateBit != refPosition->registerAssignment));
         return false;
     }
 
diff --git a/src/jit/target.h b/src/jit/target.h
index 9771f9a5d9..3cbdca0f56 100644
--- a/src/jit/target.h
+++ b/src/jit/target.h
@@ -1286,9 +1286,12 @@ typedef unsigned char   regNumberSmall;
   #define RBM_ALLFLOAT            (RBM_FLT_CALLEE_SAVED | RBM_FLT_CALLEE_TRASH)
   #define RBM_ALLDOUBLE            RBM_ALLFLOAT
 
-  #define REG_VAR_ORDER            REG_R9,REG_R10,REG_R11,REG_R12,REG_R13,REG_R14,REG_R15,\
-                                   REG_R8,REG_R7,REG_R6,REG_R5,REG_R4,REG_R3,REG_R2,REG_R1,REG_R0,\
-                                   REG_R19,REG_R20,REG_R21,REG_R22,REG_R23,REG_R24,REG_R25,REG_R26,REG_R27,REG_R28,\
+  // REG_VAR_ORDER is: (CALLEE_TRASH & ~CALLEE_TRASH_NOGC), CALLEE_TRASH_NOGC, CALLEE_SAVED
+  #define REG_VAR_ORDER            REG_R0, REG_R1, REG_R2, REG_R3, REG_R4, REG_R5, \
+                                   REG_R6, REG_R7, REG_R8, REG_R9, REG_R10,        \
+                                   REG_R11, REG_R13, REG_R14,                      \
+                                   REG_R12, REG_R15, REG_IP0, REG_IP1,             \
+                                   REG_CALLEE_SAVED_ORDER
 
   #define REG_VAR_ORDER_FLT        REG_V16, REG_V17, REG_V18, REG_V19, \
                                    REG_V20, REG_V21, REG_V22, REG_V23, \
@@ -1373,7 +1376,7 @@ typedef unsigned char   regNumberSmall;
   #define REG_WRITE_BARRIER_SRC_BYREF    REG_R13
   #define RBM_WRITE_BARRIER_SRC_BYREF    RBM_R13
 
-  #define RBM_CALLEE_TRASH_NOGC          (RBM_R12|RBM_R15|RBM_IP1|RBM_DEFAULT_HELPER_CALL_TARGET)
+  #define RBM_CALLEE_TRASH_NOGC          (RBM_R12|RBM_R15|RBM_IP0|RBM_IP1|RBM_DEFAULT_HELPER_CALL_TARGET)
 
   // Registers killed by CORINFO_HELP_ASSIGN_REF and CORINFO_HELP_CHECKED_ASSIGN_REF.
   #define RBM_CALLEE_TRASH_WRITEBARRIER         (RBM_R14|RBM_CALLEE_TRASH_NOGC)