<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/98444>98444</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Wrong PHI simplification
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          bonjune
      </td>
    </tr>
</table>

<pre>
    ```ll
define i32 @fun0(i32 %val0, i32 %val1) {
entry:
  %val2 = icmp sle i32 %val1, 0
  br i1 %val2, label %end, label %rotbb

rotbb:                                            ; preds = %entry
  br label %end

end: ; preds = %rotbb, %entry
  %val7 = phi i32 [ %val0, %entry ], [ undef, %rotbb ]
  ret i32 %val7
}
```

This function is miscompiled into

```ll
define i32 @fun0(i32 %val0, i32 %val1) {
entry:
  %val2 = icmp slt i32 %val1, 1
  br i1 %val2, label %end, label %rotbb

rotbb:
  br label %end

end:
  ret i32 %val0
}
```


Below is a part of LLVM DEBUG messages by `opt`.
```
IC: Visiting:   %val7 = phi i32 [ %val0, %entry ], [ undef, %rotbb ]
IC: Replacing   %val7 = phi i32 [ %val0, %entry ], [ undef, %rotbb ]
    with i32 %val0
IC: Mod =   %val7 = phi i32 [ %val0, %entry ], [ undef, %rotbb ]
    New =   %val7 = phi i32 [ %val0, %entry ], [ undef, %rotbb ]
IC: ERASE   %val7 = phi i32 [ %val0, %entry ], [ undef, %rotbb ]
```

Alive2 report: https://alive2.llvm.org/ce/z/txbbpc

```ll
Transformation doesn't verify!

ERROR: Target is more poisonous than source

Example:
i32 %val0 = poison
i32 %val1 = #x00000001 (1)

Source:
i1 %val2 = #x0 (0)
  >> Jump to %rotbb
  >> Jump to %end
i32 %val7 = #x00000000 (0)      [based on undef value]

Target:
i1 %val2 = #x0 (0)
  >> Jump to %rotbb
  >> Jump to %end
Source value: #x00000000 (0)
Target value: poison

Summary:
  0 correct transformations
  1 incorrect transformations
  0 failed-to-prove transformations
  0 Alive2 errors
```


The simplifaction occurs by returning `CommonValue` by the source code below:

https://github.com/llvm/llvm-project/blob/d4e46f0e864e37085da0c5e56e4f6f278e2f7aee/llvm/lib/Analysis/InstructionSimplify.cpp#L5295-L5300
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJy8Vs1u4zYQfhr6QqxBjX590MFO7DZFti2SND1T0sjmQiIFknLiPn1B0rHlJO3uApsVDBrU_H-c-ShujNhKxJKkK5Jez_hod0qXlZJfRomzSjWHkmQs_LqOsGvClg22QiIVMVCSsHaUjEDhd5DueccIXNHzNiKwoCRfBVuUVh9IvAw7etQBSuJrKup-oKbDS-Mryl6UK01F9GLiJB2vsHMvUDYXe61sVQWzsIYX8ZJ-x0PiFR00NsZn56O45M_JXISfBHPbePnWPiQBV298hZJyrzfsRAAgXU0BfTGhJL32-3RFR9lgexR631549KnRToDMj_nlR_npUKd5P-yEoe0oayuUpMLQXpha9YPosKFCWjVV_tltYV-3RfQD2-KbD_V9dNm3oBvWFXbqyWHL6cC1paqlt7ePn-n1evXXL7RHY_gWDa0OlGRMDZZkbP6u05sr12OPwggr5Da09o_voxDlDoeO10JuPySGm7UnYXdvAQ3RP6vGR_uo2L_j04f5DxWs75b36w_x_26nLTuxR6AaB6Wti7-zdjCue2FDYMO9eN51-36u9JbApkYCm38IbOxzVQ31_475g-bStEr33LNEo9BIArmle9SiPRCIpubru7s_7lwKD1xv3cwY2iuNdFDCKKlGQ-2OS2rUqGu8MHzm_dDhaeQmvRHg8w5ey6Ij1cbPLDyOFwrHNVPf9yHayXV0wTfe2pmxk5m7C9YkXtPfxn6gVr3ikvfEJ_aYcPDr5CZRFiRdVdxgQ5UM5033vBvxfNABfI_iT8o8wHTMw91n72Z-TuusOT2co6-x7_kFxTNaK62xttRedJR5UYiokF9RYbTl7nL6ZNWnQas9_rficSZQa6XNV1n6YYfUiH7oRMvDbajqetSelzXaUUtHhiRjV6rvlXz0hWfMia0zDcjVqkFaOcI_1R3Wy3ncCrsbq3mtegIbN5XHP1fSF6wtgU3VqYrApkkwyVqGRZZgnLMibTirU0wzTNqshbxAaHOOOPEjnN1S8u5ghCGwuZHG6tHXdB8KPMzrYSAQ36awSD_dpjFjs6aMm0W84DMsoxxYVmTAktmuzKM4Rx5VKQJEDQcGWRHVPIZFVscFwEyUwCBheRSxAmJI5jEWeRunixryRQxpQhKGPRfdiX5mwpgRy0WRJMnMX77Gf40CSHQXpRmRALiPU116VKpxa0jCOmGsOXuxwnZY_q2V3NI_f715OT1R-0aYjborvxt1H9yBFpLbl_BvAAAA__9OYhjr">