JIT: fix bit-test switch lowering when the bit table is inverted

[EgorBo]

Fixes #131716

TryLowerSwitchToBitTest inverts the bit table on xarch when its upper 32 bits are all set, so that it still fits in a 32 bit immediate, and swaps the two targets. The swap only updated bbCase0/bbCase1, but everything after it consumes case0Edge/case1Edge - so SetCond wired the JCC to the wrong successor, and the dup-count fixup decremented bbRefs on the wrong blocks. Regressed by #116933, which replaced the fgRemoveAllRefPreds/fgAddRefPred pair (which re-derived the edges from the swapped blocks) with in-place dup-count adjustment.

Fix: swap the edges and derive the blocks afterwards.

The inversion can only trigger with exactly 64 bit table entries — below that, bits above bitCount are zero, so ~bitTable exceeds UINT32_MAX. That is why only 64-case switches were affected.

Before (64 cases, indices 1-3 -> 111):

mov      eax, 14
bt       rax, rcx
jae      SHORT G_M14444_IG06   ; wrong: bit set falls through to 222

After:

mov      eax, 14
bt       rax, rcx
jb       SHORT G_M14444_IG06   ; bit set -> 111

No SPMI asm diffs on benchmarks.run, libraries.pmi and libraries.crossgen2 (~660K contexts).

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Fixes a correctness issue in CoreCLR JIT switch-to-bit-test lowering on xarch when the bit table is inverted to fit a 32-bit immediate, ensuring the conditional branch and ref-count adjustments use the correct successor edges after inversion.

Changes:

• Update TryLowerSwitchToBitTest to swap case0Edge/case1Edge (not just destination blocks) when inverting the bit table, and derive bbCase0/bbCase1 after the swap.
• Add a JIT regression test covering the “exactly 64 cases + inverted bit table” scenario and a non-inverted control case.
• Include the new regression test in the Regression_ro_2 test project.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/coreclr/jit/lower.cpp	Fixes edge swapping during inverted bit-table lowering so SetCond and dup-count fixups target the correct successors.
src/tests/JIT/Regression/JitBlue/Runtime_131716/Runtime_131716.cs	Adds a regression test that reproduces the inverted-bit-table 64-case switch shape and validates correct dispatch.
src/tests/JIT/Regression/Regression_ro_2.csproj	Adds the new regression test source file to the project build.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.