Bug type: crash
Component: InstCombine
Bug location: llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp: InstCombinerImpl::SimplifyDemandedUseBits
Issue title: llvm crash: Assertion `!LHSKnown.hasConflict() && "Bits known to be one AND zero?"' failed.
Labels: release:backport
llvm:instcombine
crash-on-valid
Reported by: shao-hua-li

llvm crashes in `instcombine`

Bisected to d77067d08a3f56dc2d0e6c95bd2852c943df743a, which was committed by @nikic 

Compiler explorer: https://godbolt.org/z/e4jrvf5Wr

```console
% cat reduced.ll
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define i32 @main(i1 %.b.i) {
entry:
  %add.i = select i1 %.b.i, i64 0, i64 4294967293
  %add8.i = shl i64 %add.i, 32
  %sext.2.i = add i64 %add8.i, 8836839514384105472
  %cmp11.2.i = icmp ult i64 %sext.2.i, -34359738368
  br i1 %cmp11.2.i, label %return.loopexit.i, label %for.inc.2.i

for.inc.2.i:                                      ; preds = %entry
  %sext.4.i = or i64 %add8.i, 8836839522974040064
  %conv9.4.i = ashr i64 %sext.4.i, 1
  %cmp11.4.i = icmp ult i64 %conv9.4.i, 0
  br i1 %cmp11.4.i, label %return.loopexit.i, label %return.loopexit.i

return.loopexit.i:                                ; preds = %for.inc.2.i, %for.inc.2.i, %entry
  ret i32 0
}
%
% opt -disable-output -passes=instcombine reduced.ll
opt: /tmp/tmpzoi34eaf/tmporhhh5ti/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp:246: llvm::Value* llvm::InstCombinerImpl::SimplifyDemandedUseBits(llvm::Value*, llvm::APInt, llvm::KnownBits&, unsigned int, llvm::Instruction*): Assertion `!LHSKnown.hasConflict() && "Bits known to be one AND zero?"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/opt -disable-output -passes=instcombine reduced.ll
 #0 0x00007f7698f4558f llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0x93858f)
 #1 0x00007f7698f42ab4 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007f7698222090 (/lib/x86_64-linux-gnu/libc.so.6+0x43090)
 #3 0x00007f769822200b raise /build/glibc-wuryBv/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #4 0x00007f7698201859 abort /build/glibc-wuryBv/glibc-2.31/stdlib/abort.c:81:7
 #5 0x00007f7698201729 get_sysdep_segment_value /build/glibc-wuryBv/glibc-2.31/intl/loadmsgcat.c:509:8
 #6 0x00007f7698201729 _nl_load_domain /build/glibc-wuryBv/glibc-2.31/intl/loadmsgcat.c:970:34
 #7 0x00007f7698212fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #8 0x00007f769a44445d llvm::InstCombinerImpl::SimplifyDemandedUseBits(llvm::Value*, llvm::APInt, llvm::KnownBits&, unsigned int, llvm::Instruction*) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0x1e3745d)
 #9 0x00007f769a444d25 llvm::InstCombinerImpl::SimplifyDemandedInstructionBits(llvm::Instruction&, llvm::KnownBits&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0x1e37d25)
#10 0x00007f769a4459c5 llvm::InstCombinerImpl::SimplifyDemandedInstructionBits(llvm::Instruction&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0x1e389c5)
#11 0x00007f769a38cdc3 llvm::InstCombinerImpl::visitOr(llvm::BinaryOperator&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0x1d7fdc3)
#12 0x00007f769a3537b1 llvm::InstCombinerImpl::run() (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0x1d467b1)
#13 0x00007f769a355002 combineInstructionsOverFunction(llvm::Function&, llvm::InstructionWorklist&, llvm::AAResults*, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::TargetTransformInfo&, llvm::DominatorTree&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::ProfileSummaryInfo*, llvm::LoopInfo*, llvm::InstCombineOptions const&) (.isra.0) InstructionCombining.cpp:0:0
#14 0x00007f769a355fbb llvm::InstCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0x1d48fbb)
#15 0x00007f769bea5916 llvm::detail::PassModel<llvm::Function, llvm::InstCombinePass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0x3898916)
#16 0x00007f769916239d llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0xb5539d)
#17 0x00007f769be9e506 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0x3891506)
#18 0x00007f7699160c2d llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0xb53c2d)
#19 0x00007f769bea5556 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0x3898556)
#20 0x00007f769915eb5d llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/../lib/libLLVM-18git.so+0xb51b5d)
#21 0x000055c7b779e395 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/opt+0x26395)
#22 0x000055c7b7791e8a main (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/opt+0x19e8a)
#23 0x00007f7698203083 __libc_start_main /build/glibc-wuryBv/glibc-2.31/csu/../csu/libc-start.c:342:3
#24 0x000055c7b7792a5e _start (/zdata/shaoli/compilers/ccbuilder-compilers/clang-d77067d08a3f56dc2d0e6c95bd2852c943df743a/bin/opt+0x1aa5e)
[1]    880216 abort       -disable-output -passes=instcombine reduced.ll
%
```

The above test case was reduced from
```C
long a, i;
static long b = -4;
char c;
int d;
static int *e = &d, *h = &d;
static long *f = &b, *g = &b;
int j() {
  for (; a;) {
    c = 0;
    for (; c <= 6; c++) {
      unsigned long k = 1;
      i = -8;
      *h = i >= (int)k + (int)*f + c + 2057487030 + k;
      if (*e)
        break;
    }
    return 0;
  }
  *g = 0;
  return 0;
}
int main() { j(); }
```

Comments: author: dtcxzyw
body: Minimal reproduction: https://godbolt.org/z/5bzaqP65P
author: dtcxzyw
body: Reopen this issue to backport the fix to the 18.X release.


Fix patch:
commit cb8d83a77c25e529f58eba17bb1ec76069a04e90
Author: Yingwei Zheng <dtcxzyw2333@gmail.com>
Date:   Tue Feb 6 01:29:38 2024 +0800

    [InstCombine] Fix assertion failure in issue80597 (#80614)
    
    The assertion in #80597 failed when we were trying to compute known bits
    of a value in an unreachable BB.
    
    https://github.com/llvm/llvm-project/blob/859b09da08c2a47026ba0a7d2f21b7dca705864d/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp#L749-L810
    
    In this case, `SignBits` is 30 (deduced from instr info), but `Known` is
    `10000101010111010011110101000?0?00000000000000000000000000000000`
    (deduced from dom cond). Setting high bits of `lshr Known, 1` will lead
    to conflict.
    
    This patch masks out high bits of `Known.Zero` to address this problem.
    
    Fixes #80597.

diff --git a/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp b/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp
index a8a5f9831e15..79873a9b4cbb 100644
--- a/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp
@@ -802,6 +802,9 @@ Value *InstCombinerImpl::SimplifyDemandedUseBits(Value *V, APInt DemandedMask,
         return InsertNewInstWith(LShr, I->getIterator());
       } else if (Known.One[BitWidth-ShiftAmt-1]) { // New bits are known one.
         Known.One |= HighBits;
+        // SignBits may be out-of-sync with Known.countMinSignBits(). Mask out
+        // high bits of Known.Zero to avoid conflicts.
+        Known.Zero &= ~HighBits;
       }
     } else {
       computeKnownBits(I, Known, Depth, CxtI);


Regression tests:
file: llvm/test/Transforms/InstCombine/pr80597.ll
commands: opt -S -passes=instcombine < %s
tests: test_name: pr80597
test_body: define i64 @pr80597(i1 %cond) {
entry:
  %add = select i1 %cond, i64 0, i64 4294967293
  %add8 = shl i64 %add, 32
  %sext1 = add i64 %add8, 8836839514384105472
  %cmp = icmp ult i64 %sext1, -34359738368
  br i1 %cmp, label %if.then, label %if.else

if.else:                                          ; preds = %entry
  %sext2 = or i64 %add8, 8836839522974040064
  %ashr = ashr i64 %sext2, 1
  ret i64 %ashr

if.then:                                          ; preds = %entry
  ret i64 0
}