[IPSCCP][FuncSpec] Protect against metadata access from call args.

[davemgreen]

Fixes an issue reported from #114964, where metadata arguments were looked at to consider constants.

[llvmbot]

@llvm/pr-subscribers-llvm-transforms

@llvm/pr-subscribers-function-specialization

Author: David Green (davemgreen)

Changes

Fixes an issue reported from #114964, where metadata arguments were looked at to consider constants.

---

Full diff: https://github.com/llvm/llvm-project/pull/124284.diff

2 Files Affected:

• (modified) llvm/lib/Transforms/IPO/FunctionSpecialization.cpp (+2)
• (added) llvm/test/Transforms/FunctionSpecialization/solver-constant-strictfpmetadata.ll (+17)

diff --git a/llvm/lib/Transforms/IPO/FunctionSpecialization.cpp b/llvm/lib/Transforms/IPO/FunctionSpecialization.cpp
index 449d64d1614ff1..fa01156315741d 100644
--- a/llvm/lib/Transforms/IPO/FunctionSpecialization.cpp
+++ b/llvm/lib/Transforms/IPO/FunctionSpecialization.cpp
@@ -415,6 +415,8 @@ Constant *InstCostVisitor::visitCallBase(CallBase &I) {
 
   for (unsigned Idx = 0, E = I.getNumOperands() - 1; Idx != E; ++Idx) {
     Value *V = I.getOperand(Idx);
+    if (isa<MetadataAsValue>(V))
+      continue;
     Constant *C = findConstantFor(V);
     if (!C)
       return nullptr;
diff --git a/llvm/test/Transforms/FunctionSpecialization/solver-constant-strictfpmetadata.ll b/llvm/test/Transforms/FunctionSpecialization/solver-constant-strictfpmetadata.ll
new file mode 100644
index 00000000000000..99224b4efba6bc
--- /dev/null
+++ b/llvm/test/Transforms/FunctionSpecialization/solver-constant-strictfpmetadata.ll
@@ -0,0 +1,17 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 5
+; RUN: opt -passes=ipsccp -force-specialization -S < %s | FileCheck %s
+
+define float @test(ptr %this, float %cm, i1 %0) strictfp {
+; CHECK-LABEL: define float @test(
+; CHECK-SAME: ptr [[THIS:%.*]], float [[CM:%.*]], i1 [[TMP0:%.*]]) #[[ATTR0:[0-9]+]] {
+; CHECK-NEXT:  [[ENTRY:.*:]]
+; CHECK-NEXT:    [[CMP:%.*]] = call i1 @llvm.experimental.constrained.fcmps.f32(float [[CM]], float 0.000000e+00, metadata !"ole", metadata !"fpexcept.strict")
+; CHECK-NEXT:    [[CALL295:%.*]] = call float @test.specialized.1(ptr null, float 0.000000e+00, i1 false)
+; CHECK-NEXT:    ret float 0.000000e+00
+;
+entry:
+  %cmp = call i1 @llvm.experimental.constrained.fcmps.f32(float %cm, float 0.000000e+00, metadata !"ole", metadata !"fpexcept.strict") #0
+  %call295 = call float @test(ptr null, float 0.000000e+00, i1 false) #0
+  ret float 0.000000e+00
+}
+

[labrinea]

Should perhaps ConstantFoldCall be handling this?

[davemgreen]

I believe it is the findConstantFor -> getLatticeValueFor call that causes the problem, as the value is not in the lattice.

[labrinea]

Then should the isa(V) be moved inside findConstantFor?

if (isa<MetadataAsValue>(V))
  return nullptr;
if (auto *C = dyn_cast<Constant>(V))
  return C;
...

Would a metadata operand be possible to appear in anything else other than a call? If not, then let's leave it as is.

[davemgreen]

I was wondering that - but calls should be the most common place. For other operations like load / stores the metadata will be an extra operands, not one of the ones we are already looking at like the Value or Pointer.
I believe this is where they are excluded for normal SCCP:

llvm-project/llvm/lib/Transforms/Utils/SCCPSolver.cpp

Line 1796 in 544a3cb

if (A.get()->getType()->isMetadataTy())