[llvm] [Instcombine] Ensure simplifyValueKnownNonZero adds instrs in dominance order. (PR #173703)

[Justin Lebar via llvm-commits]

https://github.com/jlebar created https://github.com/llvm/llvm-project/pull/173703

This was found by a fuzzer I'm working on.  The high-level design is to
randomly generate LLVM IR, run a pass on it, and then run the original
and new IR through the interpreter.  They should produce the same
results.  Right now I'm only fuzzing instcombine.


>From b162182b26255d5ef3d38042f92c4db02e9090d1 Mon Sep 17 00:00:00 2001
From: Justin Lebar <justin.lebar at gmail.com>
Date: Mon, 22 Dec 2025 16:53:48 -0500
Subject: [PATCH] [Instcombine] Ensure simplifyValueKnownNonZero adds instrs in
 dominance order.

This was found by a fuzzer I'm working on.  The high-level design is to
randomly generate LLVM IR, run a pass on it, and then run the original
and new IR through the interpreter.  They should produce the same
results.  Right now I'm only fuzzing instcombine.
---
 .../Transforms/InstCombine/InstCombineMulDivRem.cpp | 10 ++++++++++
 .../InstCombine/instcombine-dominance-fixup.ll      | 13 +++++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 llvm/test/Transforms/InstCombine/instcombine-dominance-fixup.ll

diff --git a/llvm/lib/Transforms/InstCombine/InstCombineMulDivRem.cpp b/llvm/lib/Transforms/InstCombine/InstCombineMulDivRem.cpp
index a9aacc707cc20..09f8d3cba64a2 100644
--- a/llvm/lib/Transforms/InstCombine/InstCombineMulDivRem.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstCombineMulDivRem.cpp
@@ -51,6 +51,16 @@ static Value *simplifyValueKnownNonZero(Value *V, InstCombinerImpl &IC,
   // code.
   if (!V->hasOneUse()) return nullptr;
 
+  // This helper can rewrite an instruction (including its operands) even when
+  // IC.Builder is currently set to the instruction being visited (e.g. a
+  // divide/remainder using V as a non-zero divisor). Ensure that any IR we
+  // create is inserted before the value we are about to rewrite, so it
+  // dominates all uses.
+  IRBuilderBase::InsertPointGuard Guard(IC.Builder);
+  if (auto *VI = dyn_cast<Instruction>(V))
+    if (VI->getParent())
+      IC.Builder.SetInsertPoint(VI);
+
   bool MadeChange = false;
 
   // ((1 << A) >>u B) --> (1 << (A-B))
diff --git a/llvm/test/Transforms/InstCombine/instcombine-dominance-fixup.ll b/llvm/test/Transforms/InstCombine/instcombine-dominance-fixup.ll
new file mode 100644
index 0000000000000..c5109055c189d
--- /dev/null
+++ b/llvm/test/Transforms/InstCombine/instcombine-dominance-fixup.ll
@@ -0,0 +1,13 @@
+; NOTE: This test ensures InstCombine preserves dominance even when it
+; reorders shifts through SimplifyDemandedBits/log2 folding.
+;
+; RUN: opt -passes=instcombine,verify -disable-output %s
+
+define i64 @f(i64 %0, i64 %1) {
+entry:
+  %2 = shl nuw i64 1, %1
+  %3 = lshr exact i64 %2, 1
+  %4 = shl nuw i64 %3, %1
+  %5 = srem i64 %0, %4
+  ret i64 %5
+}