Duplicate jmp-s in code gen

[iSazonov]

I measure an method (see attachment) with .Net 10.0.0-rc.1.25451.107, 10.0.25.45207 and BenchmarkDotNet 0.15.6
and assembler code looks weird:
.NET 10.0.0 (10.0.0-rc.1.25451.107, 10.0.25.45207), X64 RyuJIT x86-64-v3

...
M02_L02:
       mov       eax,r10d
       jmp       short M02_L00
M02_L03:
       mov       eax,r10d
       jmp       short M02_L00
M02_L04:
       mov       eax,r10d
       jmp       short M02_L00
...

Surrogates.zip

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

[BoyBaykiller]

Reproducible extracted from the link (needs DynamicPGO or DOTNET_JitSynthesizeCounts=1).
The 4 mov edx, r10d could all be moved into G_M51317_IG07 like shown in the diff:

int Utf16NextOrFFFD2(ReadOnlySpan<char> str, int offset, out uint cp)
{
    uint c = str[offset];
    offset += 1;

    // Is any surrogate?
    if ((c & 0xF800) == 0xD800)
    {
        uint c1 = c;
        c = 0xfffd; // Replacement character

        // Is leading surrogate and not at end?
        if ((c1 & 0x400) == 0 && offset < str.Length)
        {
            char c2 = str[offset];
            // Is also trailing surrogate!
            if ((c2 & 0xFC00) == 0xDC00)
            {
                c = (c1 << 10) - 0x35FDC00 + c2;
                offset += 1;
            }
        }
    }

    cp = c;
    return offset;
}

G_M51317_IG01:  ;; offset=0x0000
       sub      rsp, 40
						;; size=4 bbWeight=1 PerfScore 0.25
G_M51317_IG02:  ;; offset=0x0004
       mov      rax, bword ptr [rdx]
       mov      ecx, dword ptr [rdx+0x08]
       cmp      r8d, ecx
       jae      SHORT G_M51317_IG12
       mov      edx, r8d
       movzx    rdx, word  ptr [rax+2*rdx]
       inc      r8d
       mov      r10d, edx
       and      r10d, 0xF800
       cmp      r10d, 0xD800
       jne      SHORT G_M51317_IG07
						;; size=40 bbWeight=1 PerfScore 9.50
G_M51317_IG03:  ;; offset=0x002C
       mov      r10d, 0xFFFD
       test     edx, 0x400
-      jne      SHORT G_M51317_IG11
+      jne      SHORT G_M51317_IG07
						;; size=14 bbWeight=0.80 PerfScore 1.20
G_M51317_IG04:  ;; offset=0x003A
       cmp      r8d, ecx
-      jge      SHORT G_M51317_IG10
+      jne      SHORT G_M51317_IG07
						;; size=5 bbWeight=0.64 PerfScore 0.80
G_M51317_IG05:  ;; offset=0x003F
       cmp      r8d, ecx
       jae      SHORT G_M51317_IG12
       mov      ecx, r8d
       movzx    rax, word  ptr [rax+2*rcx]
       mov      ecx, eax
       and      ecx, 0xFC00
       cmp      ecx, 0xDC00
-      jne      SHORT G_M51317_IG09
+      jne      SHORT G_M51317_IG07
						;; size=28 bbWeight=0.51 PerfScore 2.69
G_M51317_IG06:  ;; offset=0x005B
       shl      edx, 10
       lea      r10d, [rdx+rax+0xFCA02400]
       inc      r8d
-      mov      edx, r10d
						;; size=17 bbWeight=0.41 PerfScore 0.82
G_M51317_IG07:  ;; offset=0x006C
+      mov      edx, r10d
       mov      dword ptr [r9], edx
       mov      eax, r8d
						;; size=6 bbWeight=1 PerfScore 1.25
G_M51317_IG08:  ;; offset=0x0072
       add      rsp, 40
       ret      
						;; size=5 bbWeight=1 PerfScore 1.25
-G_M51317_IG09:  ;; offset=0x0077
-       mov      edx, r10d
-       jmp      SHORT G_M51317_IG07
						;; size=5 bbWeight=0.10 PerfScore 0.23
-G_M51317_IG10:  ;; offset=0x007C
-       mov      edx, r10d
-       jmp      SHORT G_M51317_IG07
						;; size=5 bbWeight=0.13 PerfScore 0.29
-G_M51317_IG11:  ;; offset=0x0081
-       mov      edx, r10d
-       jmp      SHORT G_M51317_IG07
						;; size=5 bbWeight=0.16 PerfScore 0.36
G_M51317_IG12:  ;; offset=0x0086
       call     CORINFO_HELP_RNGCHKFAIL
       int3     
						;; size=6 bbWeight=0 PerfScore 0.00

---

I also notice at times that nearly-duplicate blocks can get generated. I have one function that ends up with 8 throw helpers from inlined vector indexers. I guess what I am thinking of needs general outlining support while the case presented in this issue probably doesn't.