<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/141892>141892</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [SimplifyCFG] Speculated load accesses a dead object
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            miscompilation,
            llvm:transforms,
            generated by fuzzer
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
            dtcxzyw
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          dtcxzyw
      </td>
    </tr>
</table>

<pre>
    Reproducer: https://alive2.llvm.org/ce/z/F8zhNx
```
define i32 @src() {
entry:
 %l_297 = alloca i32, align 4
  call void @llvm.lifetime.start.p0(i64 4, ptr %l_297)
  %tobool842.not.not = icmp eq i32 0, 0
  call void @llvm.lifetime.end.p0(i64 4, ptr %l_297)
  br i1 %tobool842.not.not, label %cleanup860, label %for.end856

for.end856:
  %0 = load i32, ptr %l_297, align 4
  br label %cleanup860

cleanup860:
  %cleanup.dest.slot.5 = phi i32 [ 0, %entry ], [ %0, %for.end856 ]
  ret i32 %cleanup.dest.slot.5
}

define i32 @tgt() {
entry:
  %l_297 = alloca i32, align 4
  call void @llvm.lifetime.start.p0(i64 4, ptr %l_297)
 %tobool842.not.not = icmp eq i32 0, 0
  call void @llvm.lifetime.end.p0(i64 4, ptr %l_297)
  %0 = load i32, ptr %l_297, align 4
  %spec.select = select i1 %tobool842.not.not, i32 0, i32 %0
  ret i32 %spec.select
}
```
```
Transformation doesn't verify!

ERROR: Source is more defined than target

Example:

Source:
ptr %l_297 = pointer(local, block_id=0, offset=0) / Address=#x100
i1 %tobool842.not.not = #x1 (1)
  >> Jump to %cleanup860
i32 %cleanup.dest.slot.5 = #x00000000 (0)

SOURCE MEMORY STATE
===================
NON-LOCAL BLOCKS:
Block 0 >    alive: true

LOCAL BLOCKS:
Block 2 >    size: 4 align: 4        alloc type: 1   alive: false    address: 256

Target:
ptr %l_297 = pointer(local, block_id=0, offset=0) / Address=#x100
i1 %tobool842.not.not = #x1 (1)
i32 %#0 = UB triggered!

TARGET MEMORY STATE
===================
LOCAL BLOCKS:
Block 2 >    size: 4 align: 4        alloc type: 1   alive: false    address: 256
```
llvm version: 5859863bab7fb1cd98b6028293cba6ba25f7d514

</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJzMVktv6zYT_TX0hohBjSRbWnghvy7wfbkx4PguurqgxJHNlhJVkkpj__qClOI4bdIXiqCGDIuPc-ZxhmNya-WxRVyQdEkAhKueL-dfCABJ1xPeu5M2i3FyUmpxXuyxM1r0FRoSF_TkXGdJXBDYEthyJZ8Qpko9NVNtjgS2FRLYXghst9nl9PBMWEFmbHxYIbCWLVIZAyUJs6YikBHIKZkvCSuwdebsuVlBCaTqO-RzSuI15UrpinsYgRXlSh5bmvhdtOJK0ScthecLbihZo5MNTq3jxk07RiCTs4QmHto5c2UmkAcKAqnTpdYqS2Daaue_waqsmo7iz8Fb5tHsz0xiK_6CwdJQGb1r1iMUL1H51Uohb_sum7E307U23k6WznxuWXEzHjLnN7EQgNJcvCTtrSNvk1iad60G-pvxK_04ORVo3dQq7aZpMNid5KBtuhwyRiANolKSrsM4XQb3xrVX38MGz27QDRTvWvE-zdeDZ29ryR3dh7X0ecX06bX0t7UmkNoOq6lFhdXg2_j6BzV59XpUhv1WqhvKV4luzv3t-8Hw1tbaNNxJ3VKh0bYE5o4-oZH1mUA06LvZ73d733IedW8qpNLSRhukg-6CuhNvqePmiG4EPPOmUziITlgx4IbhbUqGUtWydWgIZL4alA-uVLr66bsUJF6HYHVdW3TDKKcEtrQQwqC1JF4TiJ8j5sP5IG3BSNhFCWTRVa94Q-IN_V_fdNTp3x24jyv_ysfGj6dlA62Pdfdtv9rQr5uvu_0P9PFQHDZ-IV7_w4cVD7uHu_vdqriny_vd6v-PQx6XPkeUhThYHtq_l8iZHgdHPoLACLHyEhDJAD-2rwOlK-rOXViObtlrriz6iZf0FxRe2t9hKID_kMijhgTi4WR-W1Jn5PGIBsW1uA_F_svm8G_q9bmJvznPvm35s2ulDpxplubZLC55Oa_LqBJ5Vs4YZJDHVclnJYe0nos08u1oIhaxyOOcT3ARzZMsyaM4iienhagjjHnGojTCWVnzGHOWJnGViLkQWONELoBBylLIWcKiNJ7Ok7rKoxnOszJiPEpIwrDhUl3vJhNpbY-LKImyHCbh_86Od6BG2ko3nVShI_mrEKwIgEeSuHAv_cpeV47YouEOBS3PtO4vF19j4QJlFh51V_ZH6zu6tM6-euCkU-He9SibTsn6vNp-IemaPnZY9SrwhTbOqwqtRUs5FcgF1eWPWLlJb9Ti7fXrKN2pL6eVbghsg7vDz11ntIcQ2IaoLYHtGPjTAn4NAAD__3BT2To">