dtcxzyw/llvm-apr-benchmark huggingface dataset:
Bug type: crash
Component: GlobalOpt
Bug location: llvm/lib/Transforms/IPO/GlobalOpt.cpp: allUsesOfLoadedValueWillTrapIfNull
Issue title: [GlobalOpt] Incorrect change of atomic type
Labels: ipo
release:backport
crash
Reported by: nikic

```llvm
; RUN: opt -S -passes=globalopt
@g = internal global ptr null, align 8

define void @init() {
  %alloc = call ptr @malloc(i64 48)
  store atomic ptr %alloc, ptr @g seq_cst, align 8
  ret void
} 

define i1 @check() {
  %val = load atomic ptr, ptr @g seq_cst, align 8
  %cmp = icmp eq ptr %val, null
  ret i1 %cmp
}

declare ptr @malloc(i64) allockind("alloc,uninitialized") allocsize(0)
```
Results in:
```
atomic memory access' size must be byte-sized
 i1  store atomic i1 true, ptr @g.init seq_cst, align 1
atomic memory access' size must be byte-sized
 i1  %g.init.val = load atomic i1, ptr @g.init seq_cst, align 1
LLVM ERROR: Broken module found, compilation aborted!
```



Fix patch:
commit 57530c23a53b5e003d389437637f61c5b9814e22
Author: Nikita Popov <npopov@redhat.com>
Date:   Thu Apr 24 15:15:47 2025 +0200

    [GlobalOpt] Do not promote malloc if there are atomic loads/stores (#137158)
    
    When converting a malloc stored to a global into a global, we will
    introduce an i1 flag to track whether the global has been initialized.
    
    In case of atomic loads/stores, this will result in verifier failures,
    because atomic ops on i1 are illegal. Even if we changed this to i8, I
    don't think it is a good idea to change atomic types in that way.
    
    Instead, bail out of the transform is we encounter any atomic
    loads/stores of the global.
    
    Fixes https://github.com/llvm/llvm-project/issues/137152.

diff --git a/llvm/lib/Transforms/IPO/GlobalOpt.cpp b/llvm/lib/Transforms/IPO/GlobalOpt.cpp
index cfba8dcc05b2..3771cccbde17 100644
--- a/llvm/lib/Transforms/IPO/GlobalOpt.cpp
+++ b/llvm/lib/Transforms/IPO/GlobalOpt.cpp
@@ -719,10 +719,14 @@ static bool allUsesOfLoadedValueWillTrapIfNull(const GlobalVariable *GV) {
     const Value *P = Worklist.pop_back_val();
     for (const auto *U : P->users()) {
       if (auto *LI = dyn_cast<LoadInst>(U)) {
+        if (!LI->isSimple())
+          return false;
         SmallPtrSet<const PHINode *, 8> PHIs;
         if (!AllUsesOfValueWillTrapIfNull(LI, PHIs))
           return false;
       } else if (auto *SI = dyn_cast<StoreInst>(U)) {
+        if (!SI->isSimple())
+          return false;
         // Ignore stores to the global.
         if (SI->getPointerOperand() != P)
           return false;


Regression tests:
file: llvm/test/Transforms/GlobalOpt/malloc-promote-atomic.ll
commands: opt -passes=globalopt -S < %s
tests: test_name: <module>
test_body: 
@g = internal global ptr null, align 8

define void @init() {
;
  %alloc = call ptr @malloc(i64 48)
  store atomic ptr %alloc, ptr @g seq_cst, align 8
  ret void
}

define i1 @check() {
;
  %val = load atomic ptr, ptr @g seq_cst, align 8
  %cmp = icmp eq ptr %val, null
  ret i1 %cmp
}

declare ptr @malloc(i64) allockind("alloc,uninitialized") allocsize(0)
Bug type: miscompilation
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: add
Issue title: [SLP] Miscompile when vectorizing `xor x, 0` with `and y, -1`
Labels: miscompilation
llvm:SLPVectorizer
Reported by: cardigan1008

In https://github.com/llvm/llvm-project/commit/1f82553e385f449efee92da3dca43facb4a1ee66, SLPVectorizer may incorrectly vectorize a pair of identity operations `xor x, 0` and `and y, -1` into a single vector and instruction. Because the identity constants differ (0 vs -1), SLP forms a mixed constant vector <0, -1> and emits:

```llvm
and <2 x i32> <x, y>, <0, -1>
```

This forces the first lane to `0` instead of `x`. When the original code stores results separately, this changes observable memory behavior (e.g. with `y = poison`).

Alive2 proof: https://alive2.llvm.org/ce/z/CtTFRH

Exposed from https://github.com/llvm/llvm-project/commit/1f82553e385f449efee92da3dca43facb4a1ee66, cc @alexey-bataev 


Fix patch:
commit 2541b1870e7c90236b4010eec9a020c048f8beea
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Wed Dec 31 07:22:08 2025 -0800

    [SLP]Mark and incompatible for 'xor %a, 0' operations
    
    Xor with 0 is incompatible with and, which resulst in all zero instead
    of %a
    
    https://alive2.llvm.org/ce/z/oEVETS
    
    Fixes #174041

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index 56f8188112d8..3d98d470387e 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -1217,7 +1217,7 @@ public:
         break;
       case Instruction::Xor:
         if (CIValue.isZero())
-          InterchangeableMask = XorBIT | OrBIT | AndBIT | SubBIT | AddBIT;
+          InterchangeableMask = XorBIT | OrBIT | SubBIT | AddBIT;
         break;
       default:
         if (CIValue.isZero())


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/X86/xor-with-zero-and-incompat.ll
commands: opt -S --passes=slp-vectorizer -mtriple=x86_64-unknown-linux-gnu < %s -slp-threshold=-100
tests: test_name: src_test_xor_and_identity_mismatch
test_body: define void @src_test_xor_and_identity_mismatch(i32 %a, i32 %b, ptr %dst) {
  %op1 = xor i32 %a, 0
  %op2 = and i32 %b, -1
  store i32 %op1, ptr %dst, align 4
  %gep = getelementptr i32, ptr %dst, i64 1
  store i32 %op2, ptr %gep, align 4
  ret void
}
Bug type: miscompilation
Component: InstructionSimplify
Bug location: llvm/lib/Analysis/InstructionSimplify.cpp: simplifyWithOpReplaced
Issue title: [InstSimplify] Miscompile with select of vectors and bitcast
Labels: test-suite
miscompilation
llvm:instcombine
Reported by: nikic

https://alive2.llvm.org/ce/z/xhCFyk

```llvm
define <4 x i32> @src(<2 x i64> %x, <4 x i32> %y) {
  %x.bc = bitcast <2 x i64> %x to <4 x i32>
  %y.bc = bitcast <4 x i32> %y to <2 x i64>
  %sub = sub <2 x i64> %x, %y.bc
  %sub.bc = bitcast <2 x i64> %sub to <4 x i32>
  %cmp = icmp eq <4 x i32> %y, %x.bc
  %sel = select <4 x i1> %cmp, <4 x i32> %sub.bc, <4 x i32> zeroinitializer
  ret <4 x i32> %sel
}

define <4 x i32> @tgt(<2 x i64> %x, <4 x i32> %y) {
  ret <4 x i32> zeroinitializer
}
```


Fix patch:
commit 97e3220d6312ae00bcbe08673f218bd0f705776b
Author: Nikita Popov <npopov@redhat.com>
Date:   Mon Jan 8 15:49:47 2024 +0100

    [InstSimplify] Consider bitcast as potential cross-lane operation
    
    The bitcast might change the number of vector lanes, in which case
    it will be a cross-lane operation.
    
    Fixes https://github.com/llvm/llvm-project/issues/77320.

diff --git a/llvm/lib/Analysis/InstructionSimplify.cpp b/llvm/lib/Analysis/InstructionSimplify.cpp
index 241bdd81b75a..d0c27cae0dff 100644
--- a/llvm/lib/Analysis/InstructionSimplify.cpp
+++ b/llvm/lib/Analysis/InstructionSimplify.cpp
@@ -4313,7 +4313,7 @@ static Value *simplifyWithOpReplaced(Value *V, Value *Op, Value *RepOp,
     // For vector types, the simplification must hold per-lane, so forbid
     // potentially cross-lane operations like shufflevector.
     if (!I->getType()->isVectorTy() || isa<ShuffleVectorInst>(I) ||
-        isa<CallBase>(I))
+        isa<CallBase>(I) || isa<BitCastInst>(I))
       return nullptr;
   }
 


Regression tests:
file: llvm/test/Transforms/InstSimplify/select.ll
commands: opt < %s -passes=instsimplify -S
tests: test_name: select_vector_cmp_with_bitcasts
test_body: define <4 x i32> @select_vector_cmp_with_bitcasts(<2 x i64> %x, <4 x i32> %y) {
  %x.bc = bitcast <2 x i64> %x to <4 x i32>
  %y.bc = bitcast <4 x i32> %y to <2 x i64>
  %sub = sub <2 x i64> %x, %y.bc
  %sub.bc = bitcast <2 x i64> %sub to <4 x i32>
  %cmp = icmp eq <4 x i32> %y, %x.bc
  %sel = select <4 x i1> %cmp, <4 x i32> %sub.bc, <4 x i32> zeroinitializer
  ret <4 x i32> %sel
}

test_name: select_or_disjoint_eq
test_body: define i8 @select_or_disjoint_eq(i8 %x, i8 %y) {
  %cmp = icmp eq i8 %x, %y
  %or = or disjoint i8 %x, %y
  %sel = select i1 %cmp, i8 %x, i8 %or
  ret i8 %sel
}