Bug type: miscompilation
Component: InstCombine
Bug location: llvm/lib/Transforms/InstCombine/InstCombineVectorOps.cpp: InstCombinerImpl::visitShuffleVectorInst
Issue title: [InstCombine] folded select produces different result on a blended vector
Labels: miscompilation
llvm:instcombine
Reported by: bongjunj

Alive2 report: https://alive2.llvm.org/ce/z/73v-ug

```llvm
----------------------------------------
define <4 x i8> @sel_shuf_commute3.2(<4 x i8> %x, <4 x i8> %y, i1 %cmp) {
#0:
  %blend = shufflevector <4 x i8> { 0, 0, 0, 0 }, <4 x i8> %y, 0, 5, 2, 3
  %r = select i1 %cmp, <4 x i8> %y, <4 x i8> %blend
  %#1 = select <4 x i1> { 0, 1, 0, 1 }, <4 x i8> { 0, 1, 2, 3 }, <4 x i8> %r
  ret <4 x i8> %#1
}
=>
define <4 x i8> @sel_shuf_commute3.2(<4 x i8> %x, <4 x i8> %y, i1 %cmp) {
#0:
  %#1 = shufflevector <4 x i8> %y, <4 x i8> { poison, 1, poison, 3 }, 0, 5, 2, 7
  %#2 = select i1 %cmp, <4 x i8> %#1, <4 x i8> { 0, 1, 0, 3 }
  ret <4 x i8> %#2
}
Transformation doesn't verify!

ERROR: Target is more poisonous than source

Example:
<4 x i8> %x = < poison, poison, poison, poison >
<4 x i8> %y = < poison, poison, poison, poison >
i1 %cmp = poison

Source:
<4 x i8> %blend = < #x00 (0), poison, #x00 (0), #x00 (0) >
<4 x i8> %r = < poison, poison, poison, poison >
<4 x i8> %#1 = < poison, #x01 (1), poison, #x03 (3) >

Target:
<4 x i8> %#1 = < poison, #x01 (1), poison, #x03 (3) >
<4 x i8> %#2 = < poison, poison, poison, poison >
Source value: < poison, #x01 (1), poison, #x03 (3) >
Target value: < poison, poison, poison, poison >

Summary:
  0 correct transformations
  1 incorrect transformations
  0 failed-to-prove transformations
  0 Alive2 errors
```



Fix patch:
commit 27bf45aa36386136db179c494358670a994a98a5
Author: Yingwei Zheng <dtcxzyw2333@gmail.com>
Date:   Sun Nov 10 17:07:25 2024 +0800

    [InstCombine] Fix poison safety of folding shufflevector into select (#115483)
    
    We are allowed to fold shufflevector into select iff the condition is
    guaranteed not to be poison or the RHS is a poison.
    Alive2: https://alive2.llvm.org/ce/z/28zEWR
    
    Closes https://github.com/llvm/llvm-project/issues/115465.

diff --git a/llvm/lib/Transforms/InstCombine/InstCombineVectorOps.cpp b/llvm/lib/Transforms/InstCombine/InstCombineVectorOps.cpp
index 454fe5a91d37..ede89b099e8d 100644
--- a/llvm/lib/Transforms/InstCombine/InstCombineVectorOps.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstCombineVectorOps.cpp
@@ -2904,7 +2904,9 @@ Instruction *InstCombinerImpl::visitShuffleVectorInst(ShuffleVectorInst &SVI) {
     if (auto *SI = dyn_cast<SelectInst>(LHS)) {
       // We cannot do this fold for elementwise select since ShuffleVector is
       // not elementwise.
-      if (SI->getCondition()->getType()->isIntegerTy()) {
+      if (SI->getCondition()->getType()->isIntegerTy() &&
+          (isa<PoisonValue>(RHS) ||
+           isGuaranteedNotToBePoison(SI->getCondition()))) {
         if (Instruction *I = FoldOpIntoSelect(SVI, SI))
           return I;
       }


Regression tests:
file: llvm/test/Transforms/InstCombine/vec_shuffle.ll
commands: opt < %s -passes=instcombine -S
tests: test_name: shuf_cmp_may_be_poison
test_body: define <4 x i8> @shuf_cmp_may_be_poison(<4 x i8> %x, <4 x i8> %y, i1 %cmp) {
  %sel = select i1 %cmp, <4 x i8> %y, <4 x i8> <i8 0, i8 poison, i8 0, i8 poison>
  %shuf = shufflevector <4 x i8> %sel, <4 x i8> <i8 poison, i8 1, i8 poison, i8 3>, <4 x i32> <i32 0, i32 5, i32 2, i32 7>
  ret <4 x i8> %shuf
}

test_name: shuf_same_length_vec_select
test_body: define <4 x i32> @shuf_same_length_vec_select(<4 x i1> %cond) {
  %sel = select <4 x i1> %cond, <4 x i32> <i32 0, i32 1, i32 2, i32 3>, <4 x i32> <i32 4, i32 5, i32 6, i32 7>
  %shuf = shufflevector <4 x i32> %sel, <4 x i32> <i32 8, i32 9, i32 10, i32 11>, <4 x i32> <i32 2, i32 1, i32 3, i32 5>
  ret <4 x i32> %shuf
}