comgr: prove zero tensor masks through local control flow

amd/comgr/src/comgr-hotswap-b0a0.cpp

@@ -4036,8 +4036,37 @@ std::optional<DirectControlFlowInfo> collectDirectBranchTargets(
       Info.Targets.insert(*Continuation);
     }
   }
-  for (const BoundedSetPcReturn &Return : BoundedReturns)
-    Info.BoundedIndirectTransfers.insert(Decoded[Return.InstIndex].Offset);
+  DenseSet<uint64_t> DecodedOffsets;
+  for (const InternalDecodedInst &DI : Decoded)
+    if (DI.DecodeSucceeded)
+      DecodedOffsets.insert(DI.Offset);
+  for (const BoundedSetPcReturn &Return : BoundedReturns) {
+    uint64_t ReturnOffset = Decoded[Return.InstIndex].Offset;
+    SmallVector<uint64_t, 2> LocalTargets;
+    for (uint64_t Target : Return.Targets) {
+      if (Target >= TextSize)
+        continue;
+      if (!DecodedOffsets.contains(Target)) {
+        log() << "hotswap: audited bounded return at 0x"
+              << utohexstr(ReturnOffset) << " has non-boundary local target 0x"
+              << utohexstr(Target) << "\n";
+        return std::nullopt;
+      }
+      LocalTargets.push_back(Target);
+    }
+    llvm::sort(LocalTargets);
+    LocalTargets.erase(std::unique(LocalTargets.begin(), LocalTargets.end()),
+                       LocalTargets.end());
+    auto Inserted =
+        Info.BoundedIndirectTargets.try_emplace(ReturnOffset, LocalTargets);
+    if (!Inserted.second && Inserted.first->second != LocalTargets) {
+      log() << "hotswap: conflicting audited target sets for bounded return at "
+               "0x"
+            << utohexstr(ReturnOffset) << "\n";
+      return std::nullopt;
+    }
+    Info.BoundedIndirectTransfers.insert(ReturnOffset);
+  }
   if (!IndirectControlFlowClosed && HasUnboundedIndirectEntries)
     Info.HasUnboundedIndirectEntries = true;
   return Info;

amd/comgr/src/comgr-hotswap-internal.h

@@ -1286,6 +1286,11 @@ struct DirectControlFlowInfo {
   // These do not make every instruction in their containing function a
   // potential indirect destination.
   llvm::DenseSet<uint64_t> BoundedIndirectTransfers;
+  // Exact .text-relative decoded-boundary targets for each proven finite
+  // register transfer, keyed by that transfer's decoded offset. An empty
+  // target vector means the transfer is proven to leave local .text.
+  llvm::DenseMap<uint64_t, llvm::SmallVector<uint64_t, 2>>
+      BoundedIndirectTargets;
   // A reachable indirect transfer can enter bytes that are not represented
   // by an original instruction or symbol, including synthetic source tails
   // created while planning gateways. Keep this distinct from unresolved call