[InstCombine] miscompilation folding `or`

[bongjunj]

The following lines are executed:

llvm-project/llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp

Lines 3897 to 3903 in 948249d

	ConstantInt *CI;
	if (Op0->hasOneUse() && !match(Op1, m_ConstantInt()) &&
	match(Op0, m_Or(m_Value(A), m_ConstantInt(CI)))) {
	Value *Inner = Builder.CreateOr(A, Op1);
	Inner->takeName(Op0);
	return BinaryOperator::CreateOr(Inner, CI);
	}

Alive2 report: https://alive2.llvm.org/ce/z/wCsYN9

----------------------------------------
define i1 @or_simplify_ule.2(i8 %y_in, i8 %rhs_in, i1 %c) {
#0:
  %y = or i8 %y_in, 1
  %rhs = and i8 %rhs_in, 254
  %#1 = sub i8 %y_in, 3
  %lbo = or i8 %y, %#1
  %r = icmp ule i8 %lbo, %rhs
  ret i1 %r
}
=>
define i1 @or_simplify_ule.2(i8 %y_in, i8 %rhs_in, i1 %c) {
#0:
  %rhs = and i8 %rhs_in, 254
  %#1 = add i8 %y_in, 253
  %y = or i8 %y_in, %#1
  %r = icmp ule i8 %y, %rhs
  ret i1 %r
}
Transformation doesn't verify!

ERROR: Target's return value is more undefined

Example:
i8 %y_in = undef
i8 %rhs_in = #x00 (0)
i1 %c = poison

Source:
i8 %y = #x01 (1)	[based on undef value]
i8 %rhs = #x00 (0)
i8 %#1 = #xfd (253, -3)	[based on undef value]
i8 %lbo = #xfd (253, -3)
i1 %r = #x0 (0)

Target:
i8 %rhs = #x00 (0)
i8 %#1 = #x00 (0)
i8 %y = #x00 (0)
i1 %r = #x1 (1)
Source value: #x0 (0)
Target value: #x1 (1)


----------------------------------------
define i8 @or_simplify_ugt.2(i8 %y_in, i8 %rhs_in) {
#0:
  %#1 = add i8 %rhs_in, 3
  %y = or i8 %#1, 1
  %rhs = and i8 %rhs_in, 254
  %lbo = or i8 %y, %rhs
  ret i8 %lbo
}
=>
define i8 @or_simplify_ugt.2(i8 %y_in, i8 %rhs_in) {
#0:
  %#1 = add i8 %rhs_in, 3
  %y = or i8 %#1, %rhs_in
  ret i8 %y
}
Transformation doesn't verify!

ERROR: Value mismatch

Example:
i8 %y_in = poison
i8 %rhs_in = undef

Source:
i8 %#1 = #x03 (3)	[based on undef value]
i8 %y = #x03 (3)
i8 %rhs = #x00 (0)	[based on undef value]
i8 %lbo = #x03 (3)

Target:
i8 %#1 = #x04 (4)
i8 %y = #x04 (4)
Source value: #x03 (3)
Target value: #x04 (4)

Summary:
  0 correct transformations
  2 incorrect transformations
  0 failed-to-prove transformations
  0 Alive2 errors

[nikic]

@dtcxzyw To avoid diluting the value of the high-priority miscompilation tag, I'm retagging low-priority/won't-fix undef-only issues as miscompilation:undef.

@bongjunj Could you please restrict fuzzing to issues that reproduce under -disable-undef-input and don't contain undef values in the IR? Miscompilations involving undef are sometimes interesting, but it seems to be quite rare for these fuzzer-generated test cases.

[bongjunj]

@dtcxzyw To avoid diluting the value of the high-priority miscompilation tag, I'm retagging low-priority/won't-fix undef-only issues as miscompilation:undef.

@bongjunj Could you please restrict fuzzing to issues that reproduce under -disable-undef-input and don't contain undef values in the IR? Miscompilations involving undef are sometimes interesting, but it seems to be quite rare for these fuzzer-generated test cases.

Sounds great and I will.