Bug type: miscompilation
Component: InstCombine
Bug location: llvm/lib/Transforms/InstCombine/InstCombineMulDivRem.cpp: simplifyIRemMulShl
Issue title: [InstCombine] Miscompilation in `simplifyIRemMulShl`
Labels: miscompilation
llvm:instcombine
Reported by: dtcxzyw

Alive2: https://alive2.llvm.org/ce/z/rdeehL
```

----------------------------------------
define i8 @srem_XY_XZ_with_CY_gt_CZ_no_nuw_out1(i8 noundef %X) {
#0:
  %BO0 = mul nsw i8 noundef %X, 127
  %BO1 = shl nsw i8 noundef %X, 7
  %r = srem i8 %BO1, %BO0
  ret i8 %r
}
=>
define i8 @srem_XY_XZ_with_CY_gt_CZ_no_nuw_out1(i8 noundef %X) {
#0:
  %r = sub nsw i8 0, noundef %X
  ret i8 %r
}
Transformation doesn't verify!

ERROR: Value mismatch

Example:
i8 noundef %X = #xff (255, -1)

Source:
i8 %BO0 = #x81 (129, -127)
i8 %BO1 = #x80 (128, -128)
i8 %r = #xff (255, -1)

Target:
i8 %r = #x01 (1)
Source value: #xff (255, -1)
Target value: #x01 (1)

Summary:
  0 correct transformations
  1 incorrect transformations
  0 failed-to-prove transformations
  0 Alive2 errors
```


Fix patch:
commit 24c2ba07ce65a5bf7d1113e05c517169d950b663
Author: Yingwei Zheng <dtcxzyw2333@gmail.com>
Date:   Sun Jan 5 01:20:54 2025 +0800

    [InstCombine] Drop NSW when converting `shl X, BW - 1` back into mul (#121633)
    
    `X <<s BW - 1` and `X *s INT_MIN` are not equivalent.
    Alive2: https://alive2.llvm.org/ce/z/MKKFrj
    Closes https://github.com/llvm/llvm-project/issues/121584

diff --git a/llvm/lib/Transforms/InstCombine/InstCombineMulDivRem.cpp b/llvm/lib/Transforms/InstCombine/InstCombineMulDivRem.cpp
index f85a3c936513..97a765ecfb6b 100644
--- a/llvm/lib/Transforms/InstCombine/InstCombineMulDivRem.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstCombineMulDivRem.cpp
@@ -2066,14 +2066,18 @@ static Instruction *simplifyIRemMulShl(BinaryOperator &I,
   bool ShiftByX = false;
 
   // If V is not nullptr, it will be matched using m_Specific.
-  auto MatchShiftOrMulXC = [](Value *Op, Value *&V, APInt &C) -> bool {
+  auto MatchShiftOrMulXC = [](Value *Op, Value *&V, APInt &C,
+                              bool &PreserveNSW) -> bool {
     const APInt *Tmp = nullptr;
     if ((!V && match(Op, m_Mul(m_Value(V), m_APInt(Tmp)))) ||
         (V && match(Op, m_Mul(m_Specific(V), m_APInt(Tmp)))))
       C = *Tmp;
     else if ((!V && match(Op, m_Shl(m_Value(V), m_APInt(Tmp)))) ||
-             (V && match(Op, m_Shl(m_Specific(V), m_APInt(Tmp)))))
+             (V && match(Op, m_Shl(m_Specific(V), m_APInt(Tmp))))) {
       C = APInt(Tmp->getBitWidth(), 1) << *Tmp;
+      // We cannot preserve NSW when shifting by BW - 1.
+      PreserveNSW = Tmp->ult(Tmp->getBitWidth() - 1);
+    }
     if (Tmp != nullptr)
       return true;
 
@@ -2095,7 +2099,9 @@ static Instruction *simplifyIRemMulShl(BinaryOperator &I,
     return false;
   };
 
-  if (MatchShiftOrMulXC(Op0, X, Y) && MatchShiftOrMulXC(Op1, X, Z)) {
+  bool Op0PreserveNSW = true, Op1PreserveNSW = true;
+  if (MatchShiftOrMulXC(Op0, X, Y, Op0PreserveNSW) &&
+      MatchShiftOrMulXC(Op1, X, Z, Op1PreserveNSW)) {
     // pass
   } else if (MatchShiftCX(Op0, Y, X) && MatchShiftCX(Op1, Z, X)) {
     ShiftByX = true;
@@ -2108,7 +2114,7 @@ static Instruction *simplifyIRemMulShl(BinaryOperator &I,
   OverflowingBinaryOperator *BO0 = cast<OverflowingBinaryOperator>(Op0);
   // TODO: We may be able to deduce more about nsw/nuw of BO0/BO1 based on Y >=
   // Z or Z >= Y.
-  bool BO0HasNSW = BO0->hasNoSignedWrap();
+  bool BO0HasNSW = Op0PreserveNSW && BO0->hasNoSignedWrap();
   bool BO0HasNUW = BO0->hasNoUnsignedWrap();
   bool BO0NoWrap = IsSRem ? BO0HasNSW : BO0HasNUW;
 
@@ -2131,7 +2137,7 @@ static Instruction *simplifyIRemMulShl(BinaryOperator &I,
   };
 
   OverflowingBinaryOperator *BO1 = cast<OverflowingBinaryOperator>(Op1);
-  bool BO1HasNSW = BO1->hasNoSignedWrap();
+  bool BO1HasNSW = Op1PreserveNSW && BO1->hasNoSignedWrap();
   bool BO1HasNUW = BO1->hasNoUnsignedWrap();
   bool BO1NoWrap = IsSRem ? BO1HasNSW : BO1HasNUW;
   // (rem (mul X, Y), (mul nuw/nsw X, Z))


Regression tests:
file: llvm/test/Transforms/InstCombine/rem-mul-shl.ll
commands: opt < %s -passes=instcombine -S
tests: test_name: srem_XY_XZ_with_CY_gt_CZ_no_nuw_out
test_body: define <2 x i8> @srem_XY_XZ_with_CY_gt_CZ_no_nuw_out(<2 x i8> %X) {
  %BO0 = mul nsw <2 x i8> %X, splat (i8 10)
  %BO1 = shl nuw nsw <2 x i8> %X, splat (i8 3)
  %r = srem <2 x i8> %BO0, %BO1
  ret <2 x i8> %r
}

test_name: srem_XY_XZ_with_CY_gt_CZ_drop_nsw_commuted
test_body: define i8 @srem_XY_XZ_with_CY_gt_CZ_drop_nsw_commuted(i8 noundef %X) {
  %BO0 = mul nsw i8 %X, 127
  %BO1 = shl nsw i8 %X, 7
  %r = srem i8 %BO0, %BO1
  ret i8 %r
}

test_name: srem_XY_XZ_with_CY_gt_CZ_drop_nsw
test_body: define i8 @srem_XY_XZ_with_CY_gt_CZ_drop_nsw(i8 noundef %X) {
  %BO0 = mul nsw i8 %X, 127
  %BO1 = shl nsw i8 %X, 7
  %r = srem i8 %BO1, %BO0
  ret i8 %r
}

test_name: srem_XY_XZ_with_CY_gt_CZ_fail_missing_flag1
test_body: define i8 @srem_XY_XZ_with_CY_gt_CZ_fail_missing_flag1(i8 %X) {
  %BO0 = mul nuw nsw i8 %X, 10
  %BO1 = mul nuw i8 %X, 6
  %r = srem i8 %BO0, %BO1
  ret i8 %r
}