Bug type: miscompilation
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: tryToReduce
Issue title: [SLPVectorizer] wrong vectorization to `reduce_or` due to poisonous value
Labels: miscompilation
llvm:SLPVectorizer
Reported by: bongjunj

Alive2 report: https://alive2.llvm.org/ce/z/f8PDZj

```llvm
----------------------------------------
define i1 @test1.2(i32 %x, i32 %a, i32 %b, i32 %c, i32 %d) {
#0:
  %cmp = icmp sgt i32 %x, 1
  %cmp2 = icmp sgt i32 %b, 1
  %cmp3 = icmp sgt i32 %c, 1
  %cmp4 = icmp sgt i32 %d, 1
  %sel2 = select i1 %cmp4, i1 1, i1 %cmp2
  %sel3 = select i1 %sel2, i1 1, i1 %cmp3
  %sel4 = select i1 %cmp, i1 1, i1 %cmp4
  %ret = or i1 %sel3, %sel4
  ret i1 %ret
}
=>
define i1 @test1.2(i32 %x, i32 %a, i32 %b, i32 %c, i32 %d) {
#0:
  %#1 = insertelement <4 x i32> poison, i32 %d, i32 0
  %#2 = insertelement <4 x i32> %#1, i32 %b, i32 1
  %#3 = insertelement <4 x i32> %#2, i32 %c, i32 2
  %#4 = insertelement <4 x i32> %#3, i32 %x, i32 3
  %#5 = icmp sgt <4 x i32> %#4, { 1, 1, 1, 1 }
  %#6 = reduce_or <4 x i1> %#5
  ret i1 %#6
}
Transformation doesn't verify!

ERROR: Target is more poisonous than source

Example:
i32 %x = #x00000000 (0)
i32 %a = poison
i32 %b = #x00000002 (2)
i32 %c = poison
i32 %d = #x00000000 (0)

Source:
i1 %cmp = #x0 (0)
i1 %cmp2 = #x1 (1)
i1 %cmp3 = poison
i1 %cmp4 = #x0 (0)
i1 %sel2 = #x1 (1)
i1 %sel3 = #x1 (1)
i1 %sel4 = #x0 (0)
i1 %ret = #x1 (1)

Target:
<4 x i32> %#1 = < #x00000000 (0), poison, poison, poison >
<4 x i32> %#2 = < #x00000000 (0), #x00000002 (2), poison, poison >
<4 x i32> %#3 = < #x00000000 (0), #x00000002 (2), poison, poison >
<4 x i32> %#4 = < #x00000000 (0), #x00000002 (2), poison, #x00000000 (0) >
<4 x i1> %#5 = < #x0 (0), #x1 (1), poison, #x0 (0) >
i1 %#6 = poison
Source value: #x1 (1)
Target value: poison

Summary:
  0 correct transformations
  1 incorrect transformations
  0 failed-to-prove transformations
  0 Alive2 errors
```


Fix patch:
commit 899336735aeb2b41a48b6ac2c895da5e0f22dbf0
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Mon Nov 4 06:02:06 2024 -0800

    [SLP]Be more pessimistic about poisonous reductions
    
    Consider all possible reductions ops as being non-poisoning boolean
    logical operations, which require freeze to be fully correct.
    
    https://alive2.llvm.org/ce/z/TKWDMP
    
    Fixes #114738

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index 427b8bd0e75a..3c6daf7b9fbb 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -19490,9 +19490,7 @@ public:
         // To prevent poison from leaking across what used to be sequential,
         // safe, scalar boolean logic operations, the reduction operand must be
         // frozen.
-        if ((isBoolLogicOp(RdxRootInst) ||
-             (AnyBoolLogicOp && VL.size() != TrackedVals.size())) &&
-            !isGuaranteedNotToBePoison(VectorizedRoot))
+        if (AnyBoolLogicOp && !isGuaranteedNotToBePoison(VectorizedRoot))
           VectorizedRoot = Builder.CreateFreeze(VectorizedRoot);
 
         // Emit code to correctly handle reused reduced values, if required.


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/reudction-or-non-poisoned.ll
commands: opt -S --passes=slp-vectorizer < %s
tests: test_name: test
test_body: define i1 @test(i32 %x, i32 %a, i32 %b, i32 %c, i32 %d) {
  %cmp = icmp sgt i32 %x, 1
  %cmp2 = icmp sgt i32 %b, 1
  %cmp3 = icmp sgt i32 %c, 1
  %cmp4 = icmp sgt i32 %d, 1
  %sel2 = select i1 %cmp4, i1 true, i1 %cmp2
  %sel3 = select i1 %sel2, i1 true, i1 %cmp3
  %sel4 = select i1 %cmp, i1 true, i1 %cmp4
  %ret = or i1 %sel3, %sel4
  ret i1 %ret
}