[llvm] [InstCombine] Fold copysign of selects from sign comparison to sign operand (PR #196367)

Thu May 7 09:57:20 PDT 2026

dtcxzyw wrote:

The following correctness issue was found by [llvm-hackme](https://github.com/dtcxzyw/llvm-hackme).

<!-- llvm-hackme-state: bug_found -->
<!-- llvm-hackme-baseline: 90334cc57186d5620a8b18db2403da7a8ee8676e -->
<!-- llvm-hackme-head-sha: 382710fcc8930787280bd412703a648ff154d18d -->
<!-- llvm-hackme-patch-sha256: 22d4dffa72c05a4a7f02be48df8763c37c5991e2be8f36f0a835670b51b7ef5a -->
<!-- llvm-hackme-kind: crash -->

This comment is generated by an automated correctness checking service designed to help identify critical correctness bugs (opt crashes or Alive2 miscompilations) and improve PR review efficiency under limited reviewer bandwidth.

## Reproducer

**Kind**: crash

**IR Reproducer**:
```llvm
; RUN: opt /llvm-hackme/work/llvm-hackme/fuzz/correctness-13.reduced.ll -passes=instcombine<no-verify-fixpoint> -S
; Function Attrs: nocallback nocreateundeforpoison nofree nosync nounwind speculatable willreturn memory(none)

define float @fneg_mag(float %y) {
  %r = call float @llvm.copysign.f32(float 0.000000e+00, float %y)
  ret float %r
}

attributes #0 = { nocallback nocreateundeforpoison nofree nosync nounwind speculatable willreturn memory(none) }
```

**Stacktrace**:
```
opt: ../llvm-project-pr/llvm/include/llvm/Support/Casting.h:572: decltype(auto) llvm::cast(From*) [with To = llvm::Instruction; From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/opt -S -o /dev/null /tmp/tmpaz_t58nc.ll -passes=instcombine<no-verify-fixpoint>
1.	Running pass "function(instcombine<max-iterations=1;no-verify-fixpoint>)" on module "/tmp/tmpaz_t58nc.ll"
2.	Running pass "instcombine<max-iterations=1;no-verify-fixpoint>" on function "fneg_mag"
 #0 0x00007ffff7e146e2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Unix/Signals.inc:884:3
 #1 0x00007ffff7e111ac llvm::sys::RunSignalHandlers() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Signals.cpp:108:20
 #2 0x00007ffff7e113b1 SignalHandler(int, siginfo_t*, void*) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Unix/Signals.inc:448:14
 #3 0x00007ffff7a19520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007ffff7a6d9fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007ffff7a19476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007ffff79ff7f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007ffff79ff71b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x00007ffff7a10e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x00007fffef2887f5 (/llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/../lib/../lib/libLLVMInstCombine.so.23.0git+0x887f5)
#10 0x00007fffef28e9e4 (/llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/../lib/../lib/libLLVMInstCombine.so.23.0git+0x8e9e4)
#11 0x00007fffef2d8fa8 bool llvm::PatternMatch::match<llvm::Value, llvm::PatternMatch::ThreeOps_match<llvm::PatternMatchHelpers::match_combine_or<llvm::PatternMatch::BinaryOp_match<llvm::PatternMatch::CmpClass_match<llvm::PatternMatchHelpers::match_bind<llvm::Value>, llvm::PatternMatch::cstval_pred_ty<llvm::PatternMatch::is_pos_zero_fp, llvm::ConstantFP, true>, llvm::FCmpInst, false>, llvm::PatternMatchHelpers::match_bind<llvm::Value>, 29u, false>, llvm::PatternMatch::ThreeOps_match<llvm::PatternMatchHelpers::match_bind<llvm::Value>, llvm::PatternMatch::CmpClass_match<llvm::PatternMatchHelpers::match_bind<llvm::Value>, llvm::PatternMatch::cstval_pred_ty<llvm::PatternMatch::is_pos_zero_fp, llvm::ConstantFP, true>, llvm::FCmpInst, false>, llvm::PatternMatch::is_zero, 59u, false> >, llvm::PatternMatch::ap_match<llvm::APFloat>, llvm::PatternMatch::ap_match<llvm::APFloat>, 59u, false> >(llvm::Value*, llvm::PatternMatch::ThreeOps_match<llvm::PatternMatchHelpers::match_combine_or<llvm::PatternMatch::BinaryOp_match<llvm::PatternMatch::CmpClass_match<llvm::PatternMatchHelpers::match_bind<llvm::Value>, llvm::PatternMatch::cstval_pred_ty<llvm::PatternMatch::is_pos_zero_fp, llvm::ConstantFP, true>, llvm::FCmpInst, false>, llvm::PatternMatchHelpers::match_bind<llvm::Value>, 29u, false>, llvm::PatternMatch::ThreeOps_match<llvm::PatternMatchHelpers::match_bind<llvm::Value>, llvm::PatternMatch::CmpClass_match<llvm::PatternMatchHelpers::match_bind<llvm::Value>, llvm::PatternMatch::cstval_pred_ty<llvm::PatternMatch::is_pos_zero_fp, llvm::ConstantFP, true>, llvm::FCmpInst, false>, llvm::PatternMatch::is_zero, 59u, false> >, llvm::PatternMatch::ap_match<llvm::APFloat>, llvm::PatternMatch::ap_match<llvm::APFloat>, 59u, false> const&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PatternMatch.h:54:17
#12 0x00007fffef2d8fa8 llvm::InstCombinerImpl::visitCallInst(llvm::CallInst&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstCombineCalls.cpp:3114:15
#13 0x00007fffef2663c8 llvm::InstCombinerImpl::run() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp:5917:36
#14 0x00007fffef2679a3 combineInstructionsOverFunction(llvm::Function&, llvm::InstructionWorklist&, llvm::AAResults*, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::TargetTransformInfo&, llvm::DominatorTree&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::BranchProbabilityInfo*, llvm::ProfileSummaryInfo*, llvm::InstCombineOptions const&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp:6231:5
#15 0x00007fffef26880f llvm::InstCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp:6292:3
#16 0x00007ffff14fc766 llvm::detail::PassModel<llvm::Function, llvm::InstCombinePass, llvm::AnalysisManager<llvm::Function> >::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:94:3
#17 0x00007fffee0fc655 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function> >::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerImpl.h:80:18
#18 0x00007ffff58cae96 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function> >, llvm::AnalysisManager<llvm::Function> >::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:94:3
#19 0x00007fffee0fcae1 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/IR/PassManager.cpp:132:41
#20 0x00007ffff7f84a76 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:94:3
#21 0x00007fffee0f9ea0 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerImpl.h:80:18
#22 0x00007ffff7f91084 llvm::SmallPtrSetImplBase::~SmallPtrSetImplBase() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:89:5
#23 0x00007ffff7f91084 llvm::SmallPtrSetImpl<llvm::AnalysisKey*>::~SmallPtrSetImpl() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:368:35
#24 0x00007ffff7f91084 llvm::SmallPtrSet<llvm::AnalysisKey*, 2u>::~SmallPtrSet() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:527:7
#25 0x00007ffff7f91084 llvm::PreservedAnalyses::~PreservedAnalyses() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/Analysis.h:112:7
#26 0x00007ffff7f91084 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)> >, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/tools/opt/NewPMDriver.cpp:574:10
#27 0x00007ffff7f9ee1c optMain /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/tools/opt/optdriver.cpp:798:25
#28 0x00007ffff7a00d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#29 0x00007ffff7a00e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#30 0x0000555555555095 _start (/llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/opt+0x1095)
```

**Baseline Revision**: `90334cc57186d5620a8b18db2403da7a8ee8676e`
**PR Head SHA**: `382710fcc8930787280bd412703a648ff154d18d`
**Patch SHA256**: `22d4dffa72c05a4a7f02be48df8763c37c5991e2be8f36f0a835670b51b7ef5a`

https://github.com/llvm/llvm-project/pull/196367