Bug type: miscompilation
Component: InstCombine
Bug location: llvm/lib/Transforms/InstCombine/InstCombineVectorOps.cpp: InstCombinerImpl::visitShuffleVectorInst
Issue title: Miscompile with opt -passes="instcombine"
Labels: miscompilation
llvm:instcombine
Reported by: mikaelholmen

llvm commit: 502bea25bdc07d1

Reproduce with:
```opt -passes="instcombine" bbi-95633_2.ll -S -o -```

Result:
```
define i16 @foo() {
entry:
  store i16 0, ptr @bit, align 2
  store i16 0, ptr getelementptr inbounds (i8, ptr @bit, i64 2), align 2
  store i16 0, ptr getelementptr inbounds (i8, ptr @bit, i64 4), align 2
  store i16 0, ptr getelementptr inbounds (i8, ptr @bit, i64 6), align 2
  store i16 2, ptr getelementptr inbounds (i8, ptr @bit, i64 8), align 2
  store i16 0, ptr getelementptr inbounds (i8, ptr @bit, i64 10), align 2
  ret i16 poison
}
```
Note the poison return value which I think is wrong.

Before commit e93d324adb4ff8
```
[InstCombine] Preserve poison in evaluateInDifferentElementOrder()

Don't unnecessarily replace poison with undef.
```
we instead got
```
define i16 @foo() {
entry:
  store i16 0, ptr @bit, align 2
  store i16 0, ptr getelementptr inbounds (%struct.bit, ptr @bit, i64 0, i32 1), align 2
  store i16 0, ptr getelementptr inbounds (%struct.bit, ptr @bit, i64 0, i32 2), align 2
  store i16 0, ptr getelementptr inbounds (%struct.bit, ptr @bit, i64 0, i32 3), align 2
  store i16 2, ptr getelementptr inbounds (%struct.bit, ptr @bit, i64 0, i32 4), align 2
  store i16 0, ptr getelementptr inbounds (%struct.bit, ptr @bit, i64 0, i32 5), align 2
  ret i16 1
}
```
where we return 1 instead of poison.

I tried to use Alive2 on the input/output in
 https://alive2.llvm.org/ce/z/1GVkRh
and it says
```
Transformation doesn't verify!

ERROR: Target is more poisonous than source
```

[bbi-95633_2.ll.gz](https://github.com/llvm/llvm-project/files/15387836/bbi-95633_2.ll.gz)


Comments: author: mikaelholmen
body: @nikic : Any idea about this?
author: artagnon
body: Here's a reduced test case:

```llvm
; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 5
; RUN: opt -passes=instcombine -S %s | FileCheck %s

%struct.widget = type { i16, i16, i16, i16, i16, i16 }

; Miscompile. Correct output: 1, incorrect output: poison.
define i16 @pr92887(ptr %p, i16 %x, i16 %y) {
; CHECK-LABEL: define i16 @pr92887(
; CHECK-SAME: ptr [[P:%.*]], i16 [[X:%.*]], i16 [[Y:%.*]]) {
; CHECK-NEXT:    store i16 0, ptr [[P]], align 2
; CHECK-NEXT:    [[P_REPACK1:%.*]] = getelementptr inbounds i8, ptr [[P]], i64 2
; CHECK-NEXT:    store i16 0, ptr [[P_REPACK1]], align 2
; CHECK-NEXT:    [[P_REPACK2:%.*]] = getelementptr inbounds i8, ptr [[P]], i64 4
; CHECK-NEXT:    store i16 0, ptr [[P_REPACK2]], align 2
; CHECK-NEXT:    [[P_REPACK3:%.*]] = getelementptr inbounds i8, ptr [[P]], i64 6
; CHECK-NEXT:    store i16 0, ptr [[P_REPACK3]], align 2
; CHECK-NEXT:    [[P_REPACK4:%.*]] = getelementptr inbounds i8, ptr [[P]], i64 8
; CHECK-NEXT:    store i16 2, ptr [[P_REPACK4]], align 2
; CHECK-NEXT:    [[P_REPACK5:%.*]] = getelementptr inbounds i8, ptr [[P]], i64 10
; CHECK-NEXT:    store i16 0, ptr [[P_REPACK5]], align 2
; CHECK-NEXT:    ret i16 poison
;
  store %struct.widget { i16 0, i16 0, i16 0, i16 0, i16 2, i16 0 }, ptr %p
  %insert.y = insertelement <2 x i16> zeroinitializer, i16 %y, i64 0
  %insert.x = insertelement <2 x i16> %insert.y, i16 %x, i64 1
  %shufflevector = shufflevector <2 x i16> %insert.x, <2 x i16> zeroinitializer, <4 x i32> <i32 0, i32 1, i32 undef, i32 undef>
  %extract = extractelement <4 x i16> %shufflevector, i32 2 ; undef
  %and = and i16 %extract, 0 ; 0
  %gep = getelementptr %struct.widget, ptr %p, i32 0, i32 4
  %load = load i16, ptr %gep ; 2
  %or = or i16 %and, %load ; 2
  %ashr = ashr i16 %or, 1 ; 1
  ret i16 %ashr ; 1
}
```

EDIT: Sorry, Alive2 verifies the transformation as correct.
author: nikic
body: The problematic transform is:
```llvm
define i16 @src(<2 x i16> %v) {
  %v0 = extractelement <2 x i16> %v, i64 0
  %v0lo = and i16 %v0, 1
  %v1 = extractelement <2 x i16> %v, i64 1
  %v1lo = and i16 %v1, 1
  %ins1 = insertelement <4 x i16> poison, i16 %v0lo, i64 0
  %ins2 = insertelement <4 x i16> %ins1, i16 %v1lo, i64 1
  %shuf = shufflevector <4 x i16> %ins2, <4 x i16> <i16 poison, i16 poison, i16 undef, i16 undef>, <4 x i32> <i32 0, i32 1, i32 6, i32 7>
  %extract = extractelement <4 x i16> %shuf, i32 2
  ret i16 %extract
}
```
To:
```
define i16 @src(<2 x i16> %v) {
  %v0 = extractelement <2 x i16> %v, i64 0
  %v0lo = and i16 %v0, 1
  %v1 = extractelement <2 x i16> %v, i64 1
  %v1lo = and i16 %v1, 1
  %1 = insertelement <4 x i16> poison, i16 %v0lo, i64 0
  %shuf = insertelement <4 x i16> %1, i16 %v1lo, i64 1
  %extract = extractelement <4 x i16> %shuf, i32 2
  ret i16 %extract
}
```

At a glance, the problem is likely that https://github.com/llvm/llvm-project/blob/e93d324adb4ff80dcbf0e5b678ed3342350eb2de/llvm/lib/Transforms/InstCombine/InstCombineVectorOps.cpp#L2881 should be matching m_Poison, not m_Undef, otherwise it's not a real single-source shuffle.
author: mikaelholmen
body: Thanks for the quick fix!
I've verified that it solves the problem we saw.
author: nikic
body: As a bonus, fixed a similar miscompile in https://github.com/llvm/llvm-project/commit/ecd269e8305330c185bbedbd5a59e887122333ba.
author: nikic
body: Another one in https://github.com/llvm/llvm-project/commit/8f1c984325bd679b2634a6173db69548da87ac71.
author: nikic
body: And... one more in https://github.com/llvm/llvm-project/commit/d0e0205bfc5a147f8744a176a10f185af7520c26.
author: mikaelholmen
body: Nice, four fixes from just one issue! :)

Fix patch:
commit 263224e4481b0850539a93a272184aac4abe86d4
Author: Nikita Popov <npopov@redhat.com>
Date:   Tue May 21 14:57:19 2024 +0200

    [InstCombine] Require poison operand in canEvaluateShuffled transform
    
    This transform works on single-source shuffles, which require that
    the second operand is poison, not undef. Otherwise we may convert
    undef to poison.
    
    Fixes https://github.com/llvm/llvm-project/issues/92887.

diff --git a/llvm/lib/Transforms/InstCombine/InstCombineVectorOps.cpp b/llvm/lib/Transforms/InstCombine/InstCombineVectorOps.cpp
index 99f1f8eb34bb..745ccbfe9dc7 100644
--- a/llvm/lib/Transforms/InstCombine/InstCombineVectorOps.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstCombineVectorOps.cpp
@@ -2901,7 +2901,7 @@ Instruction *InstCombinerImpl::visitShuffleVectorInst(ShuffleVectorInst &SVI) {
   if (Instruction *I = foldIdentityPaddedShuffles(SVI))
     return I;
 
-  if (match(RHS, m_Undef()) && canEvaluateShuffled(LHS, Mask)) {
+  if (match(RHS, m_Poison()) && canEvaluateShuffled(LHS, Mask)) {
     Value *V = evaluateInDifferentElementOrder(LHS, Mask, Builder);
     return replaceInstUsesWith(SVI, V);
   }


Regression tests:
file: llvm/test/Transforms/InstCombine/vec_shuffle.ll
commands: opt < %s -passes=instcombine -S
tests: test_name: pr92887
test_body: define i16 @pr92887(<2 x i16> %v) {
  %v0 = extractelement <2 x i16> %v, i64 0
  %v0lo = and i16 %v0, 1
  %v1 = extractelement <2 x i16> %v, i64 1
  %v1lo = and i16 %v1, 1
  %ins1 = insertelement <4 x i16> poison, i16 %v0lo, i64 0
  %ins2 = insertelement <4 x i16> %ins1, i16 %v1lo, i64 1
  %shuf = shufflevector <4 x i16> %ins2, <4 x i16> <i16 poison, i16 poison, i16 undef, i16 undef>, <4 x i32> <i32 0, i32 1, i32 6, i32 7>
  %extract = extractelement <4 x i16> %shuf, i32 2
  ret i16 %extract
}

test_name: blend_elements_from_load
test_body: define <4 x i16> @blend_elements_from_load(ptr align 8 %_0) {
  %load = load <3 x i16>, ptr %_0, align 8
  %rv = shufflevector <3 x i16> <i16 0, i16 undef, i16 undef>, <3 x i16> %load, <4 x i32> <i32 0, i32 1, i32 3, i32 5>
  ret <4 x i16> %rv
}