[llvm] [SimplifyCFG] Add foldCondStoreToSelect optimization (PR #207654)

Sun Jul 5 23:06:12 PDT 2026

dtcxzyw wrote:

The following correctness issue was found by [llvm-hackme](https://github.com/dtcxzyw/llvm-hackme).

<!-- llvm-hackme-state: bug_found -->
<!-- llvm-hackme-baseline: 467390e7c08a5067355aa72d6262ff965d7fc9b4 -->
<!-- llvm-hackme-head-sha: eafe0f09205a0e5f526f48ddb4842a60f0e72ae7 -->
<!-- llvm-hackme-patch-sha256: 41b900f90880687da51d12e1757a795b6fd18cf6f93550f3439d8d544419a796 -->
<!-- llvm-hackme-kind: crash -->

This comment is generated by an automated correctness checking service designed to help identify critical correctness bugs (opt crashes or Alive2 miscompilations) and improve PR review efficiency under limited reviewer bandwidth.

The reproducer was generated by LLM.

This bug is a regression introduced by this PR. It does not reproduce on the baseline commit.

## Reproducer

**Kind**: crash

**IR Reproducer**:
```llvm
; RUN: opt -passes=simplifycfg<fold-cond-store-to-select> -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @phi_in_elsebb(i1 %cond1, i1 %cond2, ptr %base) {
HeadBB:
  br i1 %cond1, label %ThenBB, label %ElseBB

ThenBB:
  store i32 1, ptr %base
  br label %MergeBB

ElseBB:
  %phi = phi i32 [ 42, %HeadBB ]
  br i1 %cond2, label %ElseThenBB, label %ElseElseBB

ElseThenBB:
  store i32 10, ptr %base
  br label %MergeBB

ElseElseBB:
  store i32 20, ptr %base
  br label %MergeBB

MergeBB:
  ret void
}
```

**Stacktrace**:
```
[foldCondStore] firing in function: phi_in_elsebb
PHINode should have one entry for each predecessor of its parent basic block!
  %phi = phi i32 [ 42, %HeadBB ]
LLVM ERROR: Broken module found, compilation aborted!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/opt -S -o /dev/null /tmp/tmpabiundj7.ll -passes=simplifycfg<fold-cond-store-to-select>
1.	Running pass "verify" on module "/tmp/tmpabiundj7.ll"
 #0 0x00007ffff7e177f2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Unix/Signals.inc:881:22
 #1 0x00007ffff7e1449c llvm::sys::RunSignalHandlers() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Signals.cpp:108:20
 #2 0x00007ffff7e146a1 SignalHandler(int, siginfo_t*, void*) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Unix/Signals.inc:448:14
 #3 0x00007ffff7a19520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007ffff7a6d9fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007ffff7a19476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007ffff79ff7f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007ffff7c758f8 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::~basic_string() /usr/include/c++/11/bits/basic_string.h:672:19
 #8 0x00007ffff7c758f8 llvm::report_fatal_error(llvm::Twine const&, bool) (.cold) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/ErrorHandling.cpp:117:36
 #9 0x00007ffff7d1b2e5 (/llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/../lib/libLLVMSupport.so.23.0git+0x11b2e5)
#10 0x00007fffedf3a410 llvm::VerifierPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/IR/Verifier.cpp:8014:79
#11 0x00007ffff7f84d36 llvm::detail::PassModel<llvm::Module, llvm::VerifierPass, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:94:3
#12 0x00007fffedefe4b7 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerImpl.h:80:18
#13 0x00007ffff7f91a5b llvm::SmallPtrSetImplBase::~SmallPtrSetImplBase() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:89:5
#14 0x00007ffff7f91a5b llvm::SmallPtrSetImpl<llvm::AnalysisKey*>::~SmallPtrSetImpl() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:365:35
#15 0x00007ffff7f91a5b llvm::SmallPtrSet<llvm::AnalysisKey*, 2u>::~SmallPtrSet() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:532:7
#16 0x00007ffff7f91a5b llvm::PreservedAnalyses::~PreservedAnalyses() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/Analysis.h:112:7
#17 0x00007ffff7f91a5b llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)> >, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/tools/opt/NewPMDriver.cpp:572:10
#18 0x00007ffff7f9ee84 optMain /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/tools/opt/optdriver.cpp:798:25
#19 0x00007ffff7a00d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#20 0x00007ffff7a00e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#21 0x0000555555555095 _start (/llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/opt+0x1095)
```

**Baseline Revision**: `467390e7c08a5067355aa72d6262ff965d7fc9b4`
**PR Head SHA**: `eafe0f09205a0e5f526f48ddb4842a60f0e72ae7`
**Patch SHA256**: `41b900f90880687da51d12e1757a795b6fd18cf6f93550f3439d8d544419a796`

https://github.com/llvm/llvm-project/pull/207654