[msl] Add polyfill for unary negation

Unary negation of INT32_MIN is undefined behaviour in MSL, so polyfill
it by reinterpreting as a u32 and using bitwise complement.

Bug: 42251016
Change-Id: I080f7c374aff8b5899cdd833990299aa49119fa3
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/205916
Reviewed-by: Antonio Maiorano <amaiorano@google.com>
Commit-Queue: James Price <jrprice@google.com>
diff --git a/src/tint/lang/msl/writer/raise/BUILD.bazel b/src/tint/lang/msl/writer/raise/BUILD.bazel
index 3291fb7..e820aac 100644
--- a/src/tint/lang/msl/writer/raise/BUILD.bazel
+++ b/src/tint/lang/msl/writer/raise/BUILD.bazel
@@ -46,6 +46,7 @@
     "raise.cc",
     "shader_io.cc",
     "simd_ballot.cc",
+    "unary_polyfill.cc",
   ],
   hdrs = [
     "binary_polyfill.h",
@@ -55,6 +56,7 @@
     "raise.h",
     "shader_io.h",
     "simd_ballot.h",
+    "unary_polyfill.h",
   ],
   deps = [
     "//src/tint/api/common",
@@ -103,6 +105,7 @@
     "packed_vec3_test.cc",
     "shader_io_test.cc",
     "simd_ballot_test.cc",
+    "unary_polyfill_test.cc",
   ],
   deps = [
     "//src/tint/api/common",
diff --git a/src/tint/lang/msl/writer/raise/BUILD.cmake b/src/tint/lang/msl/writer/raise/BUILD.cmake
index 7d1c017..d872922 100644
--- a/src/tint/lang/msl/writer/raise/BUILD.cmake
+++ b/src/tint/lang/msl/writer/raise/BUILD.cmake
@@ -55,6 +55,8 @@
   lang/msl/writer/raise/shader_io.h
   lang/msl/writer/raise/simd_ballot.cc
   lang/msl/writer/raise/simd_ballot.h
+  lang/msl/writer/raise/unary_polyfill.cc
+  lang/msl/writer/raise/unary_polyfill.h
 )
 
 tint_target_add_dependencies(tint_lang_msl_writer_raise lib
@@ -110,6 +112,7 @@
   lang/msl/writer/raise/packed_vec3_test.cc
   lang/msl/writer/raise/shader_io_test.cc
   lang/msl/writer/raise/simd_ballot_test.cc
+  lang/msl/writer/raise/unary_polyfill_test.cc
 )
 
 tint_target_add_dependencies(tint_lang_msl_writer_raise_test test
diff --git a/src/tint/lang/msl/writer/raise/BUILD.gn b/src/tint/lang/msl/writer/raise/BUILD.gn
index 4b7e044..33e9d8f 100644
--- a/src/tint/lang/msl/writer/raise/BUILD.gn
+++ b/src/tint/lang/msl/writer/raise/BUILD.gn
@@ -59,6 +59,8 @@
       "shader_io.h",
       "simd_ballot.cc",
       "simd_ballot.h",
+      "unary_polyfill.cc",
+      "unary_polyfill.h",
     ]
     deps = [
       "${dawn_root}/src/utils:utils",
@@ -105,6 +107,7 @@
         "packed_vec3_test.cc",
         "shader_io_test.cc",
         "simd_ballot_test.cc",
+        "unary_polyfill_test.cc",
       ]
       deps = [
         "${dawn_root}/src/utils:utils",
diff --git a/src/tint/lang/msl/writer/raise/raise.cc b/src/tint/lang/msl/writer/raise/raise.cc
index 51506b3..56d1f6e 100644
--- a/src/tint/lang/msl/writer/raise/raise.cc
+++ b/src/tint/lang/msl/writer/raise/raise.cc
@@ -52,6 +52,7 @@
 #include "src/tint/lang/msl/writer/raise/packed_vec3.h"
 #include "src/tint/lang/msl/writer/raise/shader_io.h"
 #include "src/tint/lang/msl/writer/raise/simd_ballot.h"
+#include "src/tint/lang/msl/writer/raise/unary_polyfill.h"
 
 namespace tint::msl::writer {
 
@@ -135,6 +136,7 @@
     RUN_TRANSFORM(raise::PackedVec3, module);
     RUN_TRANSFORM(raise::SimdBallot, module);
     RUN_TRANSFORM(raise::ModuleScopeVars, module);
+    RUN_TRANSFORM(raise::UnaryPolyfill, module);
     RUN_TRANSFORM(raise::BinaryPolyfill, module);
     RUN_TRANSFORM(raise::BuiltinPolyfill, module);
 
diff --git a/src/tint/lang/msl/writer/raise/unary_polyfill.cc b/src/tint/lang/msl/writer/raise/unary_polyfill.cc
new file mode 100644
index 0000000..219b29c
--- /dev/null
+++ b/src/tint/lang/msl/writer/raise/unary_polyfill.cc
@@ -0,0 +1,104 @@
+// Copyright 2024 The Dawn & Tint Authors
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its
+//    contributors may be used to endorse or promote products derived from
+//    this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "src/tint/lang/msl/writer/raise/unary_polyfill.h"
+
+#include <utility>
+
+#include "src/tint/lang/core/ir/builder.h"
+#include "src/tint/lang/core/ir/validator.h"
+
+using namespace tint::core::fluent_types;  // NOLINT
+
+namespace tint::msl::writer::raise {
+namespace {
+
+/// PIMPL state for the transform.
+struct State {
+    /// The IR module.
+    core::ir::Module& ir;
+
+    /// The IR builder.
+    core::ir::Builder b{ir};
+
+    /// The type manager.
+    core::type::Manager& ty{ir.Types()};
+
+    /// Process the module.
+    void Process() {
+        // Find the unary operators that need replacing.
+        Vector<core::ir::Unary*, 4> signed_int_negate_worklist;
+        for (auto* inst : ir.Instructions()) {
+            if (auto* unary = inst->As<core::ir::Unary>()) {
+                auto op = unary->Op();
+                auto* type = unary->Val()->Type();
+                if (op == core::UnaryOp::kNegation && type->IsSignedIntegerScalarOrVector()) {
+                    signed_int_negate_worklist.Push(unary);
+                }
+            }
+        }
+
+        // Replace the instructions that we found.
+        for (auto* signed_int_negate : signed_int_negate_worklist) {
+            SignedIntegerNegation(signed_int_negate);
+        }
+    }
+
+    /// Replace a signed integer negation to avoid undefined behavior.
+    /// @param unary the unary instruction
+    void SignedIntegerNegation(core::ir::Unary* unary) {
+        // Replace `-x` with `as_type<int>((~as_type<uint>(x)) + 1)`.
+        auto* signed_type = unary->Result(0)->Type();
+        auto* unsigned_type = ty.match_width(ty.u32(), signed_type);
+        b.InsertBefore(unary, [&] {
+            auto* unsigned_value = b.Bitcast(unsigned_type, unary->Val());
+            auto* complement = b.Complement(unsigned_type, unsigned_value);
+            auto* plus_one = b.Add(unsigned_type, complement, b.MatchWidth(u32(1), unsigned_type));
+            auto* result = b.Bitcast(signed_type, plus_one);
+            unary->Result(0)->ReplaceAllUsesWith(result->Result(0));
+        });
+        unary->Destroy();
+    }
+};
+
+}  // namespace
+
+Result<SuccessType> UnaryPolyfill(core::ir::Module& ir) {
+    auto result = ValidateAndDumpIfNeeded(ir, "UnaryPolyfill transform",
+                                          core::ir::Capabilities{
+                                              core::ir::Capability::kAllowPointersInStructures,
+                                          });
+    if (result != Success) {
+        return result.Failure();
+    }
+
+    State{ir}.Process();
+
+    return Success;
+}
+
+}  // namespace tint::msl::writer::raise
diff --git a/src/tint/lang/msl/writer/raise/unary_polyfill.h b/src/tint/lang/msl/writer/raise/unary_polyfill.h
new file mode 100644
index 0000000..60382c6
--- /dev/null
+++ b/src/tint/lang/msl/writer/raise/unary_polyfill.h
@@ -0,0 +1,48 @@
+// Copyright 2024 The Dawn & Tint Authors
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its
+//    contributors may be used to endorse or promote products derived from
+//    this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef SRC_TINT_LANG_MSL_WRITER_RAISE_UNARY_POLYFILL_H_
+#define SRC_TINT_LANG_MSL_WRITER_RAISE_UNARY_POLYFILL_H_
+
+#include "src/tint/utils/result/result.h"
+
+// Forward declarations.
+namespace tint::core::ir {
+class Module;
+}  // namespace tint::core::ir
+
+namespace tint::msl::writer::raise {
+
+/// UnaryPolyfill is a transform that replaces unary instructions with polyfills and calls to MSL
+/// backend intrinsic functions.
+/// @param module the module to transform
+/// @returns success or failure
+Result<SuccessType> UnaryPolyfill(core::ir::Module& module);
+
+}  // namespace tint::msl::writer::raise
+
+#endif  // SRC_TINT_LANG_MSL_WRITER_RAISE_UNARY_POLYFILL_H_
diff --git a/src/tint/lang/msl/writer/raise/unary_polyfill_test.cc b/src/tint/lang/msl/writer/raise/unary_polyfill_test.cc
new file mode 100644
index 0000000..11088d1
--- /dev/null
+++ b/src/tint/lang/msl/writer/raise/unary_polyfill_test.cc
@@ -0,0 +1,143 @@
+// Copyright 2024 The Dawn & Tint Authors
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+//
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// 3. Neither the name of the copyright holder nor the names of its
+//    contributors may be used to endorse or promote products derived from
+//    this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "src/tint/lang/msl/writer/raise/unary_polyfill.h"
+
+#include <utility>
+
+#include "gtest/gtest.h"
+#include "src/tint/lang/core/fluent_types.h"
+#include "src/tint/lang/core/ir/transform/helper_test.h"
+
+using namespace tint::core::fluent_types;     // NOLINT
+using namespace tint::core::number_suffixes;  // NOLINT
+
+namespace tint::msl::writer::raise {
+namespace {
+
+using MslWriter_UnaryPolyfillTest = core::ir::transform::TransformTest;
+
+TEST_F(MslWriter_UnaryPolyfillTest, Negation_F32) {
+    auto* value = b.FunctionParam<f32>("value");
+    auto* func = b.Function("foo", ty.f32());
+    func->SetParams({value});
+    b.Append(func->Block(), [&] {
+        auto* result = b.Negation<f32>(value);
+        b.Return(func, result);
+    });
+
+    auto* src = R"(
+%foo = func(%value:f32):f32 {
+  $B1: {
+    %3:f32 = negation %value
+    ret %3
+  }
+}
+)";
+    EXPECT_EQ(src, str());
+
+    auto* expect = src;
+
+    Run(UnaryPolyfill);
+
+    EXPECT_EQ(expect, str());
+}
+
+TEST_F(MslWriter_UnaryPolyfillTest, Negation_I32_Scalar) {
+    auto* value = b.FunctionParam<i32>("value");
+    auto* func = b.Function("foo", ty.i32());
+    func->SetParams({value});
+    b.Append(func->Block(), [&] {
+        auto* result = b.Negation<i32>(value);
+        b.Return(func, result);
+    });
+
+    auto* src = R"(
+%foo = func(%value:i32):i32 {
+  $B1: {
+    %3:i32 = negation %value
+    ret %3
+  }
+}
+)";
+    EXPECT_EQ(src, str());
+
+    auto* expect = R"(
+%foo = func(%value:i32):i32 {
+  $B1: {
+    %3:u32 = bitcast %value
+    %4:u32 = complement %3
+    %5:u32 = add %4, 1u
+    %6:i32 = bitcast %5
+    ret %6
+  }
+}
+)";
+
+    Run(UnaryPolyfill);
+
+    EXPECT_EQ(expect, str());
+}
+
+TEST_F(MslWriter_UnaryPolyfillTest, Negation_I32_Vector) {
+    auto* value = b.FunctionParam<vec4<i32>>("value");
+    auto* func = b.Function("foo", ty.vec4<i32>());
+    func->SetParams({value});
+    b.Append(func->Block(), [&] {
+        auto* result = b.Negation<vec4<i32>>(value);
+        b.Return(func, result);
+    });
+
+    auto* src = R"(
+%foo = func(%value:vec4<i32>):vec4<i32> {
+  $B1: {
+    %3:vec4<i32> = negation %value
+    ret %3
+  }
+}
+)";
+    EXPECT_EQ(src, str());
+
+    auto* expect = R"(
+%foo = func(%value:vec4<i32>):vec4<i32> {
+  $B1: {
+    %3:vec4<u32> = bitcast %value
+    %4:vec4<u32> = complement %3
+    %5:vec4<u32> = add %4, vec4<u32>(1u)
+    %6:vec4<i32> = bitcast %5
+    ret %6
+  }
+}
+)";
+
+    Run(UnaryPolyfill);
+
+    EXPECT_EQ(expect, str());
+}
+
+}  // namespace
+}  // namespace tint::msl::writer::raise
diff --git a/test/tint/expressions/unary/negate/negate.wgsl.expected.ir.msl b/test/tint/expressions/unary/negate/negate.wgsl.expected.ir.msl
index 63811fd..49c5369 100644
--- a/test/tint/expressions/unary/negate/negate.wgsl.expected.ir.msl
+++ b/test/tint/expressions/unary/negate/negate.wgsl.expected.ir.msl
@@ -2,9 +2,9 @@
 using namespace metal;
 
 int i(int x) {
-  return -(x);
+  return as_type<int>((~(as_type<uint>(x)) + 1u));
 }
 
 int4 vi(int4 x) {
-  return -(x);
+  return as_type<int4>((~(as_type<uint4>(x)) + uint4(1u)));
 }
diff --git a/test/tint/statements/decrement/split.wgsl.expected.ir.msl b/test/tint/statements/decrement/split.wgsl.expected.ir.msl
index 2a6572d..f3f9e83 100644
--- a/test/tint/statements/decrement/split.wgsl.expected.ir.msl
+++ b/test/tint/statements/decrement/split.wgsl.expected.ir.msl
@@ -3,5 +3,5 @@
 
 void tint_symbol() {
   int b = 2;
-  int c = as_type<int>((as_type<uint>(b) - as_type<uint>(-(b))));
+  int c = as_type<int>((as_type<uint>(b) - as_type<uint>(as_type<int>((~(as_type<uint>(b)) + 1u)))));
 }