[DirectX] Validator fails with Instructions should not read uninitialized value.

[farzonl]

In DML tests like NonzeroCoordinatesSingleLevel_256_b16c32_int_4.dat and QLinearConvDp4aCommonKS_3x1_ConvInt_s8s8_InputVec4.dat

Many select instructions have parameters with undef (in the validator, poison in Clang/LLVM IR) as either the second or third argument causing a bad read.

we see about 38 of these errrors below are all instances with prefix with the number of times seen:

x4: %35 = select i1 %34, i32 %28, i32 undef
x2: %42 = select i1 %41, i32 %25, i32 undef
x4 %48 = select i1 %47, i32 %43, i32 undef
x8: %70 = select i1 %69, i32 %44, i32 undef
x4: %71 = select i1 %70, i32 %45, i32 undef
x6: %79 = select i1 %78, i32 %30, i32 undef
x2: %92 = select i1 %91, i32 %29, i32 undef
x4: %93 = select i1 %92, i32 %29, i32 undef
x1: %1577 = select i1 %1396, i32 undef, i32 %1576
x1: %1571 = select i1 %1393, i32 undef, i32 %1570
x1: %1572 = select i1 %1393, i32 %1569, i32 undef
x1: %1577 = select i1 %1396, i32 undef, i32 %1576

Case 1 (Dynamic vector indexing)

The select with undef/poison from NonzeroCoordinatesSingleLevel_256_b16c32_int_4 is from extractelement with a non-const index, such as indexing a vector with a non-const variable. This is expected because it is undefined behavior if the non-constant index goes out of bounds, but it is does not pass the validator.

Reproduction: https://godbolt.org/z/shnW4P1hz

Case 2 (Out-of-bounds array access)

The select with undef/poison from QLinearConvDp4aCommonKS_3x1_ConvInt_s8s8_InputVec4.dat is a result of an out-of-bounds array access from an unrolled loop. The out-of-bounds array access resolves to a poison value, indicating undefined behavior.

Reproduction: https://godbolt.org/z/3veKbsjWY

Case ???

More cases may be uncovered as the bug continues to be investigated.

Will be interesting to see if some cases will have something to do with how we legalized freeze: #136043

Maybe freeze emulation was needed after all: 27dca03

Freeze is not utilized in case 1 or case 2, so freeze emulation would not fix these cases.

[bogner]

The select with the poison seems to be created in the scalarizer pass