Bug type: miscompilation
Component: InstCombine
Bug location: llvm/lib/Transforms/InstCombine/InstCombineCalls.cpp: InstCombinerImpl::visitCallInst
Issue title: [InstCombine] Miscompilation at O1
Labels: miscompilation
llvm:instcombine
floating-point
generated by fuzzer
Reported by: dtcxzyw

Reproducer: https://alive2.llvm.org/ce/z/BPpLg_
```llvm
; bin/opt -passes="instcombine<no-verify-fixpoint>" test.ll -S
define i32 @src(i32 %i.0.i.i) {
entry:
  %conv102.i.i = sext i32 %i.0.i.i to i64
  %add.i128.i.i = add i64 %conv102.i.i, 1177359834
  %tobool104.i.i = icmp ne i64 %add.i128.i.i, 0
  %conv108.i.i = zext i1 %tobool104.i.i to i16
  %mul.i.i.i = mul i16 -5, %conv108.i.i
  %conv111.i.i = sext i16 %mul.i.i.i to i32
  %0 = bitcast i32 %conv111.i.i to float
  %1 = fcmp uno float %0, 0.000000e+00
  %2 = call float @llvm.copysign.f32(float 0.000000e+00, float %0)
  %3 = select i1 %1, float 0.000000e+00, float %2
  %4 = bitcast float %3 to i32
  ret i32 %4
}
```
Output:
```llvm
define i32 @src(i32 %i.0.i.i) {
entry:
  %tobool104.i.i.not = icmp eq i32 %i.0.i.i, -1177359834
  %conv111.i.i = select i1 %tobool104.i.i.not, i32 0, i32 -1177359834
  %0 = bitcast i32 %conv111.i.i to float
  %1 = fcmp uno float %0, 0.000000e+00
  %2 = call float @llvm.copysign.f32(float 0.000000e+00, float %0)
  %3 = select i1 %1, float 0.000000e+00, float %2
  %4 = bitcast float %3 to i32
  ret i32 %4
}
```
```
Transformation doesn't verify!

ERROR: Value mismatch

Example:
i32 %i.0.i.i = #x00000000 (0)

Source:
i64 %conv102.i.i = #x0000000000000000 (0)
i64 %add.i128.i.i = #x00000000462d15da (1177359834)
i1 %tobool104.i.i = #x1 (1)
i16 %conv108.i.i = #x0001 (1)
i16 %mul.i.i.i = #xfffb (65531, -5)
i32 %conv111.i.i = #xfffffffb (4294967291, -5)
float %#0 = #xfffffffb (QNaN)
i1 %#1 = #x1 (1)
float %#2 = #x80000000 (-0.0)
float %#3 = #x00000000 (+0.0)
i32 %#4 = #x00000000 (0)

Target:
i1 %tobool104.i.i.not = #x0 (0)
i32 %conv111.i.i = #xb9d2ea26 (3117607462, -1177359834)
float %#0 = #xb9d2ea26 (-0.000402287754?)
i1 %#1 = #x0 (0)
float %#2 = #x80000000 (-0.0)
float %#3 = #x80000000 (-0.0)
i32 %#4 = #x80000000 (2147483648, -2147483648)
Source value: #x00000000 (0)
Target value: #x80000000 (2147483648, -2147483648)
```
llvm version: 94e21bcec061c1691cd0d5382e3c6f420e0386c4
Looks like it is triggered by https://github.com/llvm/llvm-project/pull/177942. cc @arsenm

Comments: author: arsenm
body: [Reduced](https://alive2.llvm.org/ce/z/Xsp_n_)

The only thing that seems to have changed is the negative constant on the select?
author: dtcxzyw
body: > The only thing that seems to have changed is the negative constant on the select?

Yeah. We cannot do it as `%i` has multiple users.

Fix patch:
commit 909041e4802c4b9a2223ca04099f35bf1dbbd460
Author: Matt Arsenault <Matthew.Arsenault@amd.com>
Date:   Tue Jan 27 18:21:44 2026 +0100

    InstCombine: Check one use before trying to simplify copysign sign (#178251)
    
    Fixes #178245

diff --git a/llvm/lib/Transforms/InstCombine/InstCombineCalls.cpp b/llvm/lib/Transforms/InstCombine/InstCombineCalls.cpp
index c34231a74c78..fbf69d871dfc 100644
--- a/llvm/lib/Transforms/InstCombine/InstCombineCalls.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstCombineCalls.cpp
@@ -3049,7 +3049,8 @@ Instruction *InstCombinerImpl::visitCallInst(CallInst &CI) {
     Type *SignEltTy = Sign->getType()->getScalarType();
 
     Value *CastSrc;
-    if (match(Sign, m_ElementWiseBitCast(m_OneUse(m_Value(CastSrc)))) &&
+    if (match(Sign,
+              m_OneUse(m_ElementWiseBitCast(m_OneUse(m_Value(CastSrc))))) &&
         CastSrc->getType()->isIntOrIntVectorTy() &&
         APFloat::hasSignBitInMSB(SignEltTy->getFltSemantics())) {
       KnownBits Known(SignEltTy->getPrimitiveSizeInBits());


Regression tests:
file: llvm/test/Transforms/InstCombine/copysign.ll
commands: opt -S -passes=instcombine<no-verify-fixpoint> < %s
tests: test_name: issue178245
test_body: ; bin/opt -passes="instcombine<no-verify-fixpoint>" test.ll -S
define i32 @src(i32 %i.0.i.i) {
entry:
  %conv102.i.i = sext i32 %i.0.i.i to i64
  %add.i128.i.i = add i64 %conv102.i.i, 1177359834
  %tobool104.i.i = icmp ne i64 %add.i128.i.i, 0
  %conv108.i.i = zext i1 %tobool104.i.i to i16
  %mul.i.i.i = mul i16 -5, %conv108.i.i
  %conv111.i.i = sext i16 %mul.i.i.i to i32
  %0 = bitcast i32 %conv111.i.i to float
  %1 = fcmp uno float %0, 0.000000e+00
  %2 = call float @llvm.copysign.f32(float 0.000000e+00, float %0)
  %3 = select i1 %1, float 0.000000e+00, float %2
  %4 = bitcast float %3 to i32
  ret i32 %4
}