Bug type: miscompilation
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: BoUpSLP::collectValuesToDemote
BoUpSLP::vectorizeTree
Issue title: [SLPVectorizer] Miscompilation at -O2
Labels: miscompilation
llvm:SLPVectorizer
Reported by: dtcxzyw

Reproducer: https://alive2.llvm.org/ce/z/Tw0oUm
```
; bin/opt -passes=slp-vectorizer test.ll -S
define i32 @src(i1 %.b, i8 %conv18, i32 %k.promoted61) {
  %not..b79 = xor i1 %.b, true
  %3 = zext i1 %not..b79 to i8
  %cmp.i51 = icmp eq i8 %3, 0
  %cond.i55.frozen = freeze i8 %3
  %.cmp = icmp ugt i8 %cond.i55.frozen, %conv18
  %.urem = select i1 %.cmp, i8 0, i8 %cond.i55.frozen
  %4 = sub nuw i8 %conv18, %.urem
  %cond.in.i = select i1 %cmp.i51, i8 %conv18, i8 %4
  %not..b80 = xor i1 %.b, true
  %5 = zext i1 %not..b80 to i8
  %cmp.i51.1 = icmp eq i8 %5, 0
  %cond.i55.frozen.1 = freeze i8 %5
  %.cmp.1 = icmp ugt i8 %cond.i55.frozen.1, %conv18
  %.urem.1 = select i1 %.cmp.1, i8 0, i8 %cond.i55.frozen.1
  %6 = sub nuw i8 %conv18, %.urem.1
  %cond.in.i.1 = select i1 %cmp.i51.1, i8 %conv18, i8 %6
  %not..b81 = xor i1 %.b, true
  %7 = zext i1 %not..b81 to i8
  %cmp.i51.2 = icmp eq i8 %7, 0
  %cond.i55.frozen.2 = freeze i8 %7
  %.cmp.2 = icmp ugt i8 %cond.i55.frozen.2, %conv18
  %.urem.2 = select i1 %.cmp.2, i8 0, i8 %cond.i55.frozen.2
  %8 = sub nuw i8 %conv18, %.urem.2
  %cond.in.i.2 = select i1 %cmp.i51.2, i8 %conv18, i8 %8
  %not..b = xor i1 %.b, true
  %9 = zext i1 %not..b to i8
  %cmp.i51.3 = icmp eq i8 %9, 0
  %cond.i55.frozen.3 = freeze i8 %9
  %.cmp.3 = icmp ugt i8 %cond.i55.frozen.3, %conv18
  %.urem.3 = select i1 %.cmp.3, i8 0, i8 %cond.i55.frozen.3
  %10 = sub nuw i8 %conv18, %.urem.3
  %cond.in.i.3 = select i1 %cmp.i51.3, i8 %conv18, i8 %10
  %conv26 = zext nneg i8 %cond.in.i to i32
  %or = or i32 %k.promoted61, %conv26
  %conv26.1 = zext nneg i8 %cond.in.i.1 to i32
  %or.1 = or i32 %or, %conv26.1
  %conv26.2 = zext nneg i8 %cond.in.i.2 to i32
  %or.2 = or i32 %or.1, %conv26.2
  %conv26.3 = zext nneg i8 %cond.in.i.3 to i32
  %or.3 = or i32 %or.2, %conv26.3
  ret i32 %or.3
}
```
```
define i32 @src(i1 %.b, i8 %conv18, i32 %k.promoted61) {
  %1 = insertelement <4 x i1> poison, i1 %.b, i32 0
  %2 = shufflevector <4 x i1> %1, <4 x i1> poison, <4 x i32> zeroinitializer
  %3 = xor <4 x i1> %2, <i1 true, i1 true, i1 true, i1 true>
  %4 = zext <4 x i1> %3 to <4 x i8>
  %5 = icmp eq <4 x i8> %4, zeroinitializer
  %6 = freeze <4 x i1> %3
  %7 = sext <4 x i1> %6 to <4 x i8>
  %8 = insertelement <4 x i8> poison, i8 %conv18, i32 0
  %9 = shufflevector <4 x i8> %8, <4 x i8> poison, <4 x i32> zeroinitializer
  %10 = icmp ugt <4 x i8> %7, %9
  %11 = select <4 x i1> %10, <4 x i8> zeroinitializer, <4 x i8> %7
  %12 = sub nuw <4 x i8> %9, %11
  %13 = select <4 x i1> %5, <4 x i8> %9, <4 x i8> %12
  %14 = zext <4 x i8> %13 to <4 x i32>
  %15 = call i32 @llvm.vector.reduce.or.v4i32(<4 x i32> %14)
  %op.rdx = or i32 %15, %k.promoted61
  ret i32 %op.rdx
}
```
```
Transformation doesn't verify!

ERROR: Value mismatch

Example:
i1 %.b = #x0 (0)
i8 %conv18 = #x01 (1)
i32 %k.promoted61 = #x00000000 (0)

Source:
i1 %not..b79 = #x1 (1)
i8 %#1 = #x01 (1)
i1 %cmp.i51 = #x0 (0)
i8 %cond.i55.frozen = #x01 (1)
i1 %.cmp = #x0 (0)
i8 %.urem = #x01 (1)
i8 %#2 = #x00 (0)
i8 %cond.in.i = #x00 (0)
i1 %not..b80 = #x1 (1)
i8 %#3 = #x01 (1)
i1 %cmp.i51.1 = #x0 (0)
i8 %cond.i55.frozen.1 = #x01 (1)
i1 %.cmp.1 = #x0 (0)
i8 %.urem.1 = #x01 (1)
i8 %#4 = #x00 (0)
i8 %cond.in.i.1 = #x00 (0)
i1 %not..b81 = #x1 (1)
i8 %#5 = #x01 (1)
i1 %cmp.i51.2 = #x0 (0)
i8 %cond.i55.frozen.2 = #x01 (1)
i1 %.cmp.2 = #x0 (0)
i8 %.urem.2 = #x01 (1)
i8 %#6 = #x00 (0)
i8 %cond.in.i.2 = #x00 (0)
i1 %not..b = #x1 (1)
i8 %#7 = #x01 (1)
i1 %cmp.i51.3 = #x0 (0)
i8 %cond.i55.frozen.3 = #x01 (1)
i1 %.cmp.3 = #x0 (0)
i8 %.urem.3 = #x01 (1)
i8 %#8 = #x00 (0)
i8 %cond.in.i.3 = #x00 (0)
i32 %conv26 = #x00000000 (0)
i32 %or = #x00000000 (0)
i32 %conv26.1 = #x00000000 (0)
i32 %or.1 = #x00000000 (0)
i32 %conv26.2 = #x00000000 (0)
i32 %or.2 = #x00000000 (0)
i32 %conv26.3 = #x00000000 (0)
i32 %or.3 = #x00000000 (0)

Target:
<4 x i1> %#1 = < #x0 (0), poison, poison, poison >
<4 x i1> %#2 = < #x0 (0), #x0 (0), #x0 (0), #x0 (0) >
<4 x i1> %#3 = < #x1 (1), #x1 (1), #x1 (1), #x1 (1) >
<4 x i8> %#4 = < #x01 (1), #x01 (1), #x01 (1), #x01 (1) >
<4 x i1> %#5 = < #x0 (0), #x0 (0), #x0 (0), #x0 (0) >
<4 x i1> %#6 = < #x1 (1), #x1 (1), #x1 (1), #x1 (1) >
<4 x i8> %#7 = < #xff (255, -1), #xff (255, -1), #xff (255, -1), #xff (255, -1) >
<4 x i8> %#8 = < #x01 (1), poison, poison, poison >
<4 x i8> %#9 = < #x01 (1), #x01 (1), #x01 (1), #x01 (1) >
<4 x i1> %#10 = < #x1 (1), #x1 (1), #x1 (1), #x1 (1) >
<4 x i8> %#11 = < #x00 (0), #x00 (0), #x00 (0), #x00 (0) >
<4 x i8> %#12 = < #x01 (1), #x01 (1), #x01 (1), #x01 (1) >
<4 x i8> %#13 = < #x01 (1), #x01 (1), #x01 (1), #x01 (1) >
<4 x i32> %#14 = < #x00000001 (1), #x00000001 (1), #x00000001 (1), #x00000001 (1) >
i32 %#15 = #x00000001 (1)
i32 %op.rdx = #x00000001 (1)
Source value: #x00000000 (0)
Target value: #x00000001 (1)
```

llvm version: 69f7758ddba662b63667507f2c472c008909dd7e
cc @alexey-bataev 


Fix patch:
commit e56e9dd8adca2e86f22783bf5e745ee1ba7ead5f
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Fri Oct 18 13:32:41 2024 -0700

    [SLP]Fix minbitwidth emission and analysis for freeze instruction
    
    Need to add minbw emission and analysis for freeze instruction to fix
    incorrect signedness propagation.
    
    Fixes #112460

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index 53632efe913e..e7b52fbdcc3b 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -14953,6 +14953,12 @@ Value *BoUpSLP::vectorizeTree(TreeEntry *E, bool PostponedPHIs) {
         return E->VectorizedValue;
       }
 
+      if (Op->getType() != VecTy) {
+        assert((It != MinBWs.end() || getOperandEntry(E, 0)->isGather() ||
+                MinBWs.contains(getOperandEntry(E, 0))) &&
+               "Expected item in MinBWs.");
+        Op = Builder.CreateIntCast(Op, VecTy, GetOperandSignedness(0));
+      }
       Value *V = Builder.CreateFreeze(Op);
       V = FinalShuffle(V, E);
 
@@ -17095,6 +17101,8 @@ bool BoUpSLP::collectValuesToDemote(
     return TryProcessInstruction(
         BitWidth, {getOperandEntry(&E, 0), getOperandEntry(&E, 1)});
   }
+  case Instruction::Freeze:
+    return TryProcessInstruction(BitWidth, getOperandEntry(&E, 0));
   case Instruction::Shl: {
     // If we are truncating the result of this SHL, and if it's a shift of an
     // inrange amount, we can always perform a SHL in a smaller type.


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/freeze-signedness-missed.ll
commands: opt -S --passes=slp-vectorizer < %s
tests: test_name: test
test_body: define i32 @test(i1 %.b, i8 %conv18, i32 %k.promoted61) {
  %not..b79 = xor i1 %.b, true
  %1 = zext i1 %not..b79 to i8
  %cmp.i51 = icmp eq i8 %1, 0
  %cond.i55 = freeze i8 %1
  %.cmp = icmp ugt i8 %cond.i55, %conv18
  %.urem = select i1 %.cmp, i8 0, i8 %cond.i55
  %2 = sub nuw i8 %conv18, %.urem
  %cond.in.i = select i1 %cmp.i51, i8 %conv18, i8 %2
  %not..b80 = xor i1 %.b, true
  %3 = zext i1 %not..b80 to i8
  %cmp.i51.1 = icmp eq i8 %3, 0
  %cond.i55.1 = freeze i8 %3
  %.cmp.1 = icmp ugt i8 %cond.i55.1, %conv18
  %.urem.1 = select i1 %.cmp.1, i8 0, i8 %cond.i55.1
  %4 = sub nuw i8 %conv18, %.urem.1
  %cond.in.i.1 = select i1 %cmp.i51.1, i8 %conv18, i8 %4
  %not..b81 = xor i1 %.b, true
  %5 = zext i1 %not..b81 to i8
  %cmp.i51.2 = icmp eq i8 %5, 0
  %cond.i55.2 = freeze i8 %5
  %.cmp.2 = icmp ugt i8 %cond.i55.2, %conv18
  %.urem.2 = select i1 %.cmp.2, i8 0, i8 %cond.i55.2
  %6 = sub nuw i8 %conv18, %.urem.2
  %cond.in.i.2 = select i1 %cmp.i51.2, i8 %conv18, i8 %6
  %not..b = xor i1 %.b, true
  %7 = zext i1 %not..b to i8
  %cmp.i51.3 = icmp eq i8 %7, 0
  %cond.i55.3 = freeze i8 %7
  %.cmp.3 = icmp ugt i8 %cond.i55.3, %conv18
  %.urem.3 = select i1 %.cmp.3, i8 0, i8 %cond.i55.3
  %8 = sub nuw i8 %conv18, %.urem.3
  %cond.in.i.3 = select i1 %cmp.i51.3, i8 %conv18, i8 %8
  %conv26 = zext nneg i8 %cond.in.i to i32
  %or = or i32 %k.promoted61, %conv26
  %conv26.1 = zext nneg i8 %cond.in.i.1 to i32
  %or.1 = or i32 %or, %conv26.1
  %conv26.2 = zext nneg i8 %cond.in.i.2 to i32
  %or.2 = or i32 %or.1, %conv26.2
  %conv26.3 = zext nneg i8 %cond.in.i.3 to i32
  %or.3 = or i32 %or.2, %conv26.3
  ret i32 %or.3
}