<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/92193>92193</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [DAGCombine][RISC-V] VSelect miscompile at -O1
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          patrick-rivos
      </td>
    </tr>
</table>

<pre>
    Reduced LLVM IR:
``` llvm ir
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

@g.var.0 = global i8 5
@g.arr.0 = global i32 0

define i8 @foo() {
entry:
  store i32 4, ptr @g.arr.0, align 32

  %g.var.0.val = load i8, ptr @g.var.0, align 1
 %loaded.arr = insertelement <4 x i8> <i8 1, i8 1, i8 1, i8 1>, i8 %g.var.0.val, i64 0

  %g.arr.elem.0 = load i32, ptr @g.arr.0, align 32
  %insert.0 = insertelement <4 x i32> zeroinitializer, i32 %g.arr.elem.0, i64 0
  %cmp.0 = icmp ult <4 x i32> %insert.0, <i32 1, i32 1, i32 1, i32 1>

  %shuffle.0 = shufflevector <4 x i32> %insert.0, <4 x i32> zeroinitializer, <4 x i32> zeroinitializer
  %or.0 = or <4 x i32> %shuffle.0, <i32 1, i32 1, i32 1, i32 1>

  %sel.0 = select <4 x i1> %cmp.0, <4 x i32> zeroinitializer, <4 x i32> %or.0

  %trunc.0 = trunc <4 x i32> %sel.0 to <4 x i8>

  %mul.0 = mul <4 x i8> %loaded.arr, %trunc.0
  %reduced.mul.0 = call i8 @llvm.vector.reduce.mul.v4i8(<4 x i8> %mul.0)

  ret i8 %reduced.mul.0
}
```

This should return 0 but instead returns 24 when invoking llc with -O1 or above.

Found via fuzzer.

Root of the issue is here:
https://github.com/llvm/llvm-project/blob/c5cd049566a795ba5de88dfbb2eb563cad4a9d8a/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp#L12145-L12146
We continue without invalidating `bool AllAddOne = true;` and `bool AllSubOne = true;`.

This means at the end of the loop both `AllAddOne=true` and `AllSubOne=true` which isn't possible.

I'll file a PR shortly.
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJykVl1vozgU_TXOyxUIbCDwkIe0aUYjzWpW7ar7bPBN8NbYyJh02l-_siGf7c5-SREf9r3nHB_f68CHQe414orkdyTfLPjoWmNXPXdWNi-RlQczLGoj3laPKMYGBXz79vwLfH0kbE2SDUnWpEimHyh16EDaadhxu0cHgjuu-JsZHRC2AUIpRh1ha4x6wtZFFi6RPD2ktCRsndIy0oxOY09-jNIrWGdlr_AIaeXQHIosGvWLNq86UlKPP6K9Hk9p8zVL9vGB2zgJmXtlaq5AlpBfzHN7O88oJJcwAndSo88jWbIzhnh9FZDl3TSP2tm3kz8AgzMWA0xG6D30zsKZyY9wJfca2JVWAELzWW184CooUoYLkOUVSog4o6RzOqG5j0bhaUKy1ANahwo71H437jP44cHYg3-RJaQe5dM7e5gfrzWFwSK7dmcW7hfnuWYvJ-WM_hMDAsKkds7-XLovkAd4R2uklk5yJd_RBk2M3oq4kRoomq4_4jddD6O6hb6Q4fO9S4zOtvzFA3v44MXQjrudwplqfjtg44z9W76fr_PnAWcF5ljRnzGe5P2fJaI6Lg8VNmcf05kkWP0f1jSL_0Do7KibmTI8f7KuoMmZq0r_ANSNR-XdqG6a4rKDgrQT7wWAnY7F-AzUcKXmw8GfiPG01fEUGOIOme_h8pYtQBBaXYu06ObOu6Kag5abm1P4Mvm3Vg4wtGZUwsOMVkMC9eh8Pznkx8EBaAavLWqQ-mBepN6DUg28StdC9D31VcNrc8D4EntrRi3gIDnsxvd3tFeTj8Y4MDtwLYIchtFfoUWLp1Oxda4f_BvdErrdS9eOddyYjtCtN22-Rb01f2DjCN3WytSEbpu8EUlW5UXBl1Ve81xgWYpdXVOs84I1XGS8EiW_wJE-794I_IKa0O1TqFBp9Gb9hdDtZv3l3nS11Gjjpu8JZd9SmmZ5FG7FpPZ3hMZoJ_WIwRYTPDxwJQV33i9SJLUxCtZKrYX4rvFYmUjYnf9v5FpcBj2N9ceg-MPedcj1ANwFI1GLo6fKmB5q41qPeeIkbBPAznQnpoup11Y2LchBE7p00JthkLW63tuvhC6Vgp1UCBx-ffQ1ZJ16ixdixUTFKr7AVbpM8yVLckoX7YqVteBYpru6wWWRFHyJDU0Rq5yJkpV8IVc0oVmSpxllWZnReMeqhOV1lRY5pU25JFmCHZcqDj1j7H4RCmdV0bRiC8VrVEP4SKFU4-tUVf7vPd8s7CrUSj3uB99zcnDDGcVJp8LXzXmjSb4h-d3j16f76JnkG3ieSgI6OTSm68Oqna_8xWjV6l9XapA2ELoN0v8MAAD__ynOsMI">