Allow constant propagation for negated constant-vectors and ints.

This CL improves on the previous fix for oss-fuzz:26789 by actually
propagating the negation from the PrefixExpression inside the
constructor, which unblocks further optimizations.

Interestingly, this fix also exposes a further missing optimization--we
optimize away comparisons of constant-vectors for floats, but fail to
do the same for ints.

Change-Id: I9d4cb92b10452a74db96ff264322cdc8a8f2a41f
Bug: oss-fuzz:26830, oss-fuzz:26789, skia:10908
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/332263
Commit-Queue: John Stiles <[email protected]>
Reviewed-by: Brian Osman <[email protected]>
Auto-Submit: John Stiles <[email protected]>

Author: johnstiles-google

gn/sksl.gni

@@ -88,6 +88,7 @@ skia_sksl_sources = [
   "$_src/sksl/ir/SkSLNop.h",
   "$_src/sksl/ir/SkSLNullLiteral.h",
   "$_src/sksl/ir/SkSLPostfixExpression.h",
+  "$_src/sksl/ir/SkSLPrefixExpression.cpp",
   "$_src/sksl/ir/SkSLPrefixExpression.h",
   "$_src/sksl/ir/SkSLProgram.h",
   "$_src/sksl/ir/SkSLProgramElement.h",

src/sksl/ir/SkSLPrefixExpression.cpp

@@ -0,0 +1,46 @@
+/*
+ * Copyright 2020 Google LLC
+ *
+ * Use of this source code is governed by a BSD-style license that can be
+ * found in the LICENSE file.
+ */
+
+#include "src/sksl/ir/SkSLPrefixExpression.h"
+
+#include "src/sksl/ir/SkSLConstructor.h"
+
+namespace SkSL {
+
+std::unique_ptr<Expression> PrefixExpression::constantPropagate(const IRGenerator& irGenerator,
+                                                                const DefinitionMap& definitions) {
+    if (this->isNegationOfCompileTimeConstant()) {
+        if (this->operand()->is<FloatLiteral>()) {
+            // Converts -floatLiteral(1) to floatLiteral(-1).
+            return std::make_unique<FloatLiteral>(irGenerator.fContext, fOffset,
+                                                  -this->operand()->as<FloatLiteral>().value());
+        }
+        if (this->operand()->is<IntLiteral>()) {
+            // Converts -intLiteral(1) to intLiteral(-1).
+            return std::make_unique<IntLiteral>(irGenerator.fContext, fOffset,
+                                                -this->operand()->as<IntLiteral>().value());
+        }
+        if (this->operand()->is<Constructor>()) {
+            // We've found a negated constant vector, e.g.:
+            //     -float4(float3(floatLiteral(1)), floatLiteral(2))
+            // To optimize this, the outer negation is removed and each argument is negated:
+            //     float4(-float3(floatLiteral(1)), -floatLiteral(2))
+            // After another optimization pass:
+            //     float4(float3(-floatLiteral(1)), floatLiteral(-2))
+            // Steady state is reached after another optimization pass:
+            //     float4(float3(floatLiteral(-1)), floatLiteral(-2))
+            std::unique_ptr<Expression> result = this->operand()->clone();
+            for (std::unique_ptr<Expression>& arg : result->as<Constructor>().arguments()) {
+                arg = std::make_unique<PrefixExpression>(Token::Kind::TK_MINUS, std::move(arg));
+            }
+            return result;
+        }
+    }
+    return nullptr;
+}
+
+}  // namespace SkSL

src/sksl/ir/SkSLPrefixExpression.h

@@ -40,11 +40,15 @@ class PrefixExpression final : public Expression {
         return fOperand;
     }
 
-    bool isCompileTimeConstant() const override {
+    bool isNegationOfCompileTimeConstant() const {
         return this->getOperator() == Token::Kind::TK_MINUS &&
                this->operand()->isCompileTimeConstant();
     }
 
+    bool isCompileTimeConstant() const override {
+        return this->isNegationOfCompileTimeConstant();
+    }
+
     bool hasProperty(Property property) const override {
         if (property == Property::kSideEffects &&
             (this->getOperator() == Token::Kind::TK_PLUSPLUS ||
@@ -55,16 +59,7 @@ class PrefixExpression final : public Expression {
     }
 
     std::unique_ptr<Expression> constantPropagate(const IRGenerator& irGenerator,
-                                                  const DefinitionMap& definitions) override {
-        if (this->operand()->kind() == Expression::Kind::kFloatLiteral) {
-            return std::unique_ptr<Expression>(new FloatLiteral(
-                                                     irGenerator.fContext,
-                                                     fOffset,
-                                                     -this->operand()->as<FloatLiteral>().value()));
-
-        }
-        return nullptr;
-    }
+                                                  const DefinitionMap& definitions) override;
 
     SKSL_FLOAT getFVecComponent(int index) const override {
         SkASSERT(this->getOperator() == Token::Kind::TK_MINUS);

tests/sksl/shared/NegatedVectorLiteral.sksl

@@ -1,5 +1,24 @@
+void test_half() {
+    half one = 1;
+    half two = 2;
+
+    sk_FragColor.r = (half4(-1) == -half4(-half2(-1), half2(1))) ? 1 : 0;
+    sk_FragColor.g = (half4(1) != -half4(1)) ? 1 : 0;
+    sk_FragColor.b = (-half4(two) == half4(-two, half3(-two))) ? 1 : 0;
+    sk_FragColor.a = (-half2(-one, one + one) == -half2(one - two, two)) ? 1 : 0;
+}
+
+void test_int() {
+    int one = 1;
+    int two = 2;
+
+    sk_FragColor.r = (int4(-1) == -int4(-int2(-1), int2(1))) ? 1 : 0;
+    sk_FragColor.g = (int4(1) != -int4(1)) ? 1 : 0;
+    sk_FragColor.b = (-int4(two) == int4(-two, int3(-two))) ? 1 : 0;
+    sk_FragColor.a = (-int2(-one, one + one) == -int2(one - two, two)) ? 1 : 0;
+}
+
 void main() {
-    sk_FragColor.r = (half4(1) == half4(-half2(-1), half2(1))) ? 1 : 0;
-    sk_FragColor.g = (half4(1) == -half4(1)) ? 1 : 0;
-    sk_FragColor.b = (half4(0) == -half4(0)) ? 1 : 0;
+    test_half();
+    test_int();
 }

tests/sksl/shared/golden/NegatedVectorLiteral.glsl

@@ -1,7 +1,18 @@
 
 out vec4 sk_FragColor;
 void main() {
-    sk_FragColor.x = 1.0;
-    sk_FragColor.y = float(vec4(1.0) == -vec4(1.0) ? 1 : 0);
-    sk_FragColor.z = float(vec4(0.0) == -vec4(0.0) ? 1 : 0);
+    {
+        sk_FragColor.x = 1.0;
+        sk_FragColor.y = 1.0;
+        sk_FragColor.z = 1.0;
+        sk_FragColor.w = 1.0;
+    }
+
+    {
+        sk_FragColor.x = float(ivec4(-1) == ivec4(ivec2(-1), ivec2(-1)) ? 1 : 0);
+        sk_FragColor.y = float(ivec4(1) != ivec4(-1) ? 1 : 0);
+        sk_FragColor.z = float(ivec4(-2) == ivec4(-2, ivec3(-2)) ? 1 : 0);
+        sk_FragColor.w = float(ivec2(1, -2) == ivec2(1, -2) ? 1 : 0);
+    }
+
 }

tests/sksl/shared/golden/NegatedVectorLiteral.metal

@@ -9,8 +9,19 @@ struct Outputs {
 fragment Outputs fragmentMain(Inputs _in [[stage_in]], bool _frontFacing [[front_facing]], float4 _fragCoord [[position]]) {
     Outputs _outputStruct;
     thread Outputs* _out = &_outputStruct;
-    _out->sk_FragColor.x = 1.0;
-    _out->sk_FragColor.y = float(all(float4(1.0) == -float4(1.0)) ? 1 : 0);
-    _out->sk_FragColor.z = float(all(float4(0.0) == -float4(0.0)) ? 1 : 0);
+    {
+        _out->sk_FragColor.x = 1.0;
+        _out->sk_FragColor.y = 1.0;
+        _out->sk_FragColor.z = 1.0;
+        _out->sk_FragColor.w = 1.0;
+    }
+
+    {
+        _out->sk_FragColor.x = float(all(int4(-1) == int4(int2(-1), int2(-1))) ? 1 : 0);
+        _out->sk_FragColor.y = float(any(int4(1) != int4(-1)) ? 1 : 0);
+        _out->sk_FragColor.z = float(all(int4(-2) == int4(-2, int3(-2))) ? 1 : 0);
+        _out->sk_FragColor.w = float(all(int2(1, -2) == int2(1, -2)) ? 1 : 0);
+    }
+
     return *_out;
 }

tests/sksl/shared/golden/UnaryPositiveNegative.glsl

@@ -1,5 +1,5 @@
 
 out vec4 sk_FragColor;
 void main() {
-    sk_FragColor.xy = -vec2(1.0);
+    sk_FragColor.xy = vec2(-1.0);
 }

tests/sksl/shared/golden/UnaryPositiveNegative.metal

@@ -9,6 +9,6 @@ struct Outputs {
 fragment Outputs fragmentMain(Inputs _in [[stage_in]], bool _frontFacing [[front_facing]], float4 _fragCoord [[position]]) {
     Outputs _outputStruct;
     thread Outputs* _out = &_outputStruct;
-    _out->sk_FragColor.xy = -float2(1.0);
+    _out->sk_FragColor.xy = float2(-1.0);
     return *_out;
 }