[llvm] [InstCombine] Canonicalize nsz NaN-fallback float clamp to minnum/maxnum (PR #213690)

Mon Aug 3 07:55:42 PDT 2026

dtcxzyw wrote:

The following correctness issue was found by [llvm-hackme](https://github.com/dtcxzyw/llvm-hackme).

<!-- llvm-hackme-state: bug_found -->
<!-- llvm-hackme-baseline: 4905109b00e6916a310cf7c521bd8df19c0d4a11 -->
<!-- llvm-hackme-head-sha: 364b84683d67ce756b6e7a288c96da9d1c18e2bb -->
<!-- llvm-hackme-patch-sha256: 2883891bbd41de0be85b8b2b0a39bcdd7256e1368d36770626392372c76ad1b9 -->
<!-- llvm-hackme-kind: crash -->

This comment is generated by an automated correctness checking service designed to help identify critical correctness bugs (opt crashes or Alive2 miscompilations) and improve PR review efficiency under limited reviewer bandwidth.

The reproducer was generated by LLM.

This bug is a regression introduced by this PR. It does not reproduce on the baseline commit.

## Reproducer

**Kind**: crash

**IR Reproducer**:
```llvm
; RUN: opt -passes=instcombine<no-verify-fixpoint> -S
define { float, float } @test(i1 %c, { float, float } %a, { float, float } %b) {
  %r = select nsz i1 %c, { float, float } %a, { float, float } %b
  ret { float, float } %r
}
```

**Stacktrace**:
```
Invalid floating type
UNREACHABLE executed at ../llvm-project-pr/llvm/lib/IR/Type.cpp:115!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/opt -S -o /dev/null /tmp/tmple1fnaj6.ll -passes=instcombine<no-verify-fixpoint>
1.	Running pass "function(instcombine<max-iterations=1;no-verify-fixpoint>)" on module "/tmp/tmple1fnaj6.ll"
2.	Running pass "instcombine<max-iterations=1;no-verify-fixpoint>" on function "test"
 #0 0x00007ffff7e1a012 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Unix/Signals.inc:928:22
 #1 0x00007ffff7e16c4c llvm::sys::RunSignalHandlers() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Signals.cpp:108:20
 #2 0x00007ffff7e16e55 SignalHandler(int, siginfo_t*, void*) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Unix/Signals.inc:474:14
 #3 0x00007ffff7a19520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007ffff7a6d9fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007ffff7a19476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007ffff79ff7f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007ffff7d1d24e (/llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/../lib/libLLVMSupport.so.24.0git+0x11d24e)
 #8 0x00007fffedf1e1b1 (/llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/../lib/../lib/libLLVMCore.so.24.0git+0x31e1b1)
 #9 0x00007fffef36d9f8 llvm::Instruction::getFunction() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/Instruction.h:221:77
#10 0x00007fffef36d9f8 foldClampWithNaNFallback(llvm::SelectInst&, llvm::IRBuilder<llvm::TargetFolder, llvm::InstCombiner::IRBuilderInstCombineInserter>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstCombineSelect.cpp:4546:43
#11 0x00007fffef3849fd llvm::InstCombinerImpl::visitSelectInst(llvm::SelectInst&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstCombineSelect.cpp:5438:42
#12 0x00007fffef266032 llvm::InstCombinerImpl::run() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp:5932:36
#13 0x00007fffef267daa combineInstructionsOverFunction(llvm::Function&, llvm::InstructionWorklist&, llvm::AAResults*, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::TargetTransformInfo&, llvm::DominatorTree&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::BranchProbabilityInfo*, llvm::ProfileSummaryInfo*, llvm::InstCombineOptions const&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp:6240:5
#14 0x00007fffef268c0c llvm::InstCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp:6301:3
#15 0x00007ffff145f3d6 llvm::detail::PassModel<llvm::Function, llvm::InstCombinePass, llvm::AnalysisManager<llvm::Function> >::runImpl(llvm::detail::PassConcept<llvm::Function, llvm::AnalysisManager<llvm::Function> >&, llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:129:3
#16 0x00007fffedf020a8 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function> >::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerImpl.h:80:18
#17 0x00007ffff145cb36 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function> >, llvm::AnalysisManager<llvm::Function> >::runImpl(llvm::detail::PassConcept<llvm::Function, llvm::AnalysisManager<llvm::Function> >&, llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:129:3
#18 0x00007fffedf00e9c llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/IR/PassManager.cpp:132:41
#19 0x00007ffff1460516 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module> >::runImpl(llvm::detail::PassConcept<llvm::Module, llvm::AnalysisManager<llvm::Module> >&, llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:129:3
#20 0x00007fffedf008f8 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerImpl.h:80:18
#21 0x00007ffff7f948c4 llvm::SmallPtrSetImplBase::~SmallPtrSetImplBase() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:89:5
#22 0x00007ffff7f948c4 llvm::SmallPtrSetImpl<llvm::AnalysisKey*>::~SmallPtrSetImpl() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:365:35
#23 0x00007ffff7f948c4 llvm::SmallPtrSet<llvm::AnalysisKey*, 2u>::~SmallPtrSet() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:532:7
#24 0x00007ffff7f948c4 llvm::PreservedAnalyses::~PreservedAnalyses() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/Analysis.h:112:7
#25 0x00007ffff7f948c4 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)> >, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/tools/opt/NewPMDriver.cpp:580:10
#26 0x00007ffff7fa1914 optMain /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/tools/opt/optdriver.cpp:805:25
#27 0x00007ffff7a00d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#28 0x00007ffff7a00e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#29 0x0000555555555095 _start (/llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/opt+0x1095)
```

**Baseline Revision**: `4905109b00e6916a310cf7c521bd8df19c0d4a11`
**PR Head SHA**: `364b84683d67ce756b6e7a288c96da9d1c18e2bb`
**Patch SHA256**: `2883891bbd41de0be85b8b2b0a39bcdd7256e1368d36770626392372c76ad1b9`

https://github.com/llvm/llvm-project/pull/213690