JIT: (xplat) address CR issues

also merge to latest.

lib/Backend/GlobOpt.cpp

@@ -4878,7 +4878,7 @@ GlobOpt::OptInstr(IR::Instr *&instr, bool* isInstrRemoved)
     }
 
     // Change LdFld on arrays, strings, and 'arguments' to LdLen when we're accessing the .length field
-    if (instr->GetSrc1() && instr->GetSrc1()->IsSymOpnd() && instr->m_opcode == Js::OpCode::ProfiledLdFld || instr->m_opcode == Js::OpCode::LdFld || instr->m_opcode == Js::OpCode::ScopedLdFld)
+    if ((instr->GetSrc1() && instr->GetSrc1()->IsSymOpnd() && instr->m_opcode == Js::OpCode::ProfiledLdFld) || instr->m_opcode == Js::OpCode::LdFld || instr->m_opcode == Js::OpCode::ScopedLdFld)
     {
         IR::Opnd * opnd = instr->GetSrc1();
         Sym *sym = opnd->AsSymOpnd()->m_sym;

lib/Backend/amd64/LowererMDArch.cpp

@@ -926,29 +926,36 @@ LowererMDArch::LowerCall(IR::Instr * callInstr, uint32 argCount)
 #define _V_ARG_INDEX(index) _vindex[(index) - 1]
 #endif
 
+    // xplat NOTE: Lower often loads "known args" with LoadHelperArgument() and
+    // variadic JS runtime args with LowerCallArgs(). So the full args length is
+    //      this->helperCallArgsCount + argCount
+    // "argCount > 0" indicates we have variadic JS runtime args and needs to
+    // manually home registers on xplat.
+    const bool shouldHomeParams = argCount > 0;
+
     while (argsLeft > 0)
     {
         IR::Opnd * helperSrc = this->helperCallArgs[this->helperCallArgsCount - argsLeft];
         uint16 index = _V_ARG_INDEX(argsLeft);
         StackSym * helperSym = m_func->m_symTable->GetArgSlotSym(index);
         helperSym->m_type = ExtendHelperArg(helperSrc->GetType());
         Lowerer::InsertMove(
-            this->GetArgSlotOpnd(index, helperSym, /*isHelper*/true),
+            this->GetArgSlotOpnd(index, helperSym, /*isHelper*/!shouldHomeParams),
             helperSrc,
             callInstr);
         --argsLeft;
     }
 
 #ifndef _WIN32
     // Manually home args
-    if (argCount > 0)
+    if (shouldHomeParams)
     {
         static const RegNum s_argRegs[IntArgRegsCount] = {
     #define REG_INT_ARG(Index, Name)  Reg ## Name,
     #include "RegList.h"
         };
 
-        const int callArgCount = static_cast<int>(argCount) + this->helperCallArgsCount;
+        const int callArgCount = this->helperCallArgsCount + static_cast<int>(argCount);
         const int argRegs = min(callArgCount, static_cast<int>(IntArgRegsCount));
         for (int i = argRegs - 1; i >= 0; i--)
         {

lib/Runtime/Language/Arguments.h

@@ -27,13 +27,16 @@
 
 inline Js::Var* _get_va(void* addrOfReturnAddress, int n)
 {
+    // All args are right after ReturnAddress by custom calling convention
     Js::Var* pArgs = reinterpret_cast<Js::Var*>(addrOfReturnAddress) + 1;
     return pArgs + n;
 }
 
 inline int _count_args(Js::CallInfo callInfo)
 {
-    return 2;  // for typical JsMethod with 2 known args "function, callInfo"
+    // This is to support typical runtime "ARGUMENTS(args, callInfo)" usage.
+    // Only "callInfo" listed, but we have 2 known args "function, callInfo".
+    return 2;
 }
 template <class T1>
 inline int _count_args(const T1&, Js::CallInfo callInfo)