[SystemZ] Implement isGuaranteedNotToBeUndefOrPoisonForTargetNode()

[jonpa]

Summary

Returning true from this method for PCREL_WRAPPER and PCREL_OFFSET avoids problems when a PCREL_OFFSET node ends up with a freeze operand, which is not handled or expected by the backend.

Fixes #60107

There are probably other SystemZISD nodes that could go in here, but I am not quite sure how this is supposed to work: It seems to me that some kind of undef/poison value is recognized and at some point a freeze instruction is inserted in the IR. Then the DAGCombiner optimizes it away because there is a target node that now says that it is never undef..? This is contradictory but probably still worthwhile somehow, but I can't quite figure out how..?

[uweigand]

There are probably other SystemZISD nodes that could go in here, but I am not quite sure how this is supposed to work: It seems to me that some kind of undef/poison value is recognized and at some point a freeze instruction is inserted in the IR. Then the DAGCombiner optimizes it away because there is a target node that now says that it is never undef..? This is contradictory but probably still worthwhile somehow, but I can't quite figure out how..?

Here's the documentation of the FREEZE node:

// FREEZE - FREEZE(VAL) returns an arbitrary value if VAL is UNDEF (or
// is evaluated to UNDEF), or returns VAL otherwise. Note that each
// read of UNDEF can yield different value, but FREEZE(UNDEF) cannot.

So the way I understand that is that various code transformations are only correct if multiple evaluations of a value always yield the same result. Now, since this property does not hold for undef values, you'd have to prove the value cannot be undef in order to perform the transformation. That may be difficult or impossible in general. Therefore, you can use a FREEZE node instead, which prevents this from happening.

Now, it is on the code generator to handle FREEZE efficiently. But one obvious observation is that *if* the inner value of FREEZE *actually* can be proven to never be undef, then the FREEZE is a no-op and can just be removed. This is what common code already does, but sometimes it fails with target nodes, because it doesn't understand what those nodes do and therefore cannot perform this optimization. This target hook helps with that.

So in general, every target node where we unconditionally know it never returns undef should go in isGuaranteedNotToBeUndefOrPoisonForTargetNode, and every target node where we at least conditionally know that, in the case where none of the *arguments* to the target node are undef, the result is never undef either, should go in canCreateUndefOrPoisonForTargetNode.

These require reasoning about the properties of our various target nodes, so I think it's fine if this goes in in stages over time. But this patch at least is obviously correct, and if it fixes some failures, it should go it now.

[jonpa]

Thanks for explanation!

llvm/lib/Target/SystemZ/SystemZISelLowering.h

void computeKnownBitsForTargetNode(const SDValue Op,
                                      unsigned Depth = 0) const override;
 
   /// Determine the number of bits in the operation that are sign bits.
   unsigned ComputeNumSignBitsForTargetNode(SDValue Op,
                                            const APInt &DemandedElts,
                                            const SelectionDAG &DAG,
                                            unsigned Depth) const override;
 
+  bool isGuaranteedNotToBeUndefOrPoisonForTargetNode(
+      SDValue Op, const APInt &DemandedElts, const SelectionDAG &DAG,
+      bool PoisonOnly, unsigned Depth) const override;
+
   ISD::NodeType getExtendForAtomicOps() const override {
     return ISD::ANY_EXTEND;
   }
   ISD::NodeType getExtendForAtomicCmpSwapArg() const override {
     return ISD::ZERO_EXTEND;
   }
 
   bool supportSwiftError() const override {

llvm/lib/Target/SystemZ/SystemZISelLowering.cpp

if (Opcode == ISD::INTRINSIC_WO_CHAIN) {
     default:
       break;
     }
   }
 
   return 1;
 }
 
+bool SystemZTargetLowering::
+isGuaranteedNotToBeUndefOrPoisonForTargetNode(SDValue Op,
+         const APInt &DemandedElts, const SelectionDAG &DAG,
+         bool PoisonOnly, unsigned Depth) const {
+  switch (Op->getOpcode()) {
+  case SystemZISD::PCREL_WRAPPER:
+  case SystemZISD::PCREL_OFFSET:
+    return true;
+  }
+  return false;
+}
+
 unsigned
 SystemZTargetLowering::getStackProbeSize(const MachineFunction &MF) const {
   const TargetFrameLowering *TFI = Subtarget.getFrameLowering();
   unsigned StackAlign = TFI->getStackAlignment();
   assert(StackAlign >=1 && isPowerOf2_32(StackAlign) &&
          "Unexpected stack alignment");
   // The default stack probe size is 4096 if the function has no
   // stack-probe-size attribute.

llvm/test/CodeGen/SystemZ/freeze.ll

+; RUN: llc -mtriple=s390x-linux-gnu -mcpu=zEC12 < %s  | FileCheck %s
+;
+; Check that DAGCombiner doesn't cause a crash by eventually producing a
+; PCREL_OFFSET node with a freeze operand.
+
+@a = dso_local global [6 x [6 x [3 x i8]]] zeroinitializer, align 2
+@b = dso_local local_unnamed_addr global i32 0, align 4
+
+define void @fun(i8 noundef zeroext %g) {
+; CHECK-LABEL: fun
+entry:
+  %agg.tmp.ensured.sroa.0 = alloca i8, align 2
+  %conv = zext i8 %g to i64
+  %0 = inttoptr i64 %conv to ptr
+  %.fr = freeze ptr getelementptr inbounds ([6 x [6 x [3 x i8]]], ptr @a, i64 0, i64 1, i64 2, i64 1)
+  %cmp = icmp eq ptr %.fr, %0
+  %1 = load i8, ptr getelementptr inbounds ([6 x [6 x [3 x i8]]], ptr @a, i64 0, i64 5, i64 4, i64 2), align 2
+  %conv2 = zext i8 %1 to i32
+  br i1 %cmp, label %for.cond.us, label %for.cond
+
+for.cond.us:                                      ; preds = %entry, %for.cond.us
+  store i32 %conv2, ptr @b, align 4
+  ret void
+
+for.cond:                                         ; preds = %entry, %for.cond
+  store i32 0, ptr @b, align 4
+  ret void
+}