JIT: New lowering target evaluation optimization can move nodes past flags consumers

[jakobbotsch]

// Generated by Fuzzlyn v3.3 on 2025-12-07 15:34:33
// Run on X64 Windows
// Seed: 13671550190528746418-vectort,vector128,vector256,x86aes,x86avx,x86avx2,x86avx512bw,x86avx512bwvl,x86avx512cd,x86avx512cdvl,x86avx512dq,x86avx512dqvl,x86avx512f,x86avx512fvl,x86avx512fx64,x86bmi1,x86bmi1x64,x86bmi2,x86bmi2x64,x86fma,x86lzcnt,x86lzcntx64,x86pclmulqdq,x86popcnt,x86popcntx64,x86sse,x86ssex64,x86sse2,x86sse2x64,x86sse3,x86sse41,x86sse41x64,x86sse42,x86sse42x64,x86ssse3,x86x86base
// Reduced from 58.3 KiB to 0.6 KiB in 00:01:52
// Debug: Outputs True
// Release: Outputs False
using System.Runtime.Intrinsics;
using System.Runtime.Intrinsics.X86;

public class Program
{
    public static IRuntime s_rt;
    public static void Main()
    {
        s_rt = new Runtime();
        var vr18 = Vector128.Create<byte>(0);
        var vr19 = Vector128.Create<byte>(0);
        var vr28 = Sse41.TestZ(vr18, vr19);
        M8(vr28);
    }

    public static void M8(bool arg2)
    {
        s_rt.WriteLine(arg2);
    }
}

public interface IRuntime
{
    void WriteLine<T>(T value);
}

public class Runtime : IRuntime
{
    public void WriteLine<T>(T value) => System.Console.WriteLine(value);
}

We end up with

IN0008: 00002C vxorps   xmm0, xmm0, xmm0
IN0009: 000030 vxorps   xmm1, xmm1, xmm1
IN000a: 000034 vptest   xmm1, xmm0
IN000b: 000039 mov      rcx, rbx
IN000c: 00003C mov      rdx, 0x7FF88575A1C0      ; IRuntime
IN000d: 000046 mov      r8, 0x7FF88575A630      ; token handle
IN000e: 000050 call     [CORINFO_HELP_VIRTUAL_FUNC_PTR]
IN000f: 000056 sete     dl

which moved CORINFO_HELP_VIRTUAL_FUNC_PTR to happen between the vptest and sete.

cc @dotnet/jit-contrib

[dotnet-policy-service]

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.