[llvm] [InstCombine] Fold `(A < B) ^ ((A - B) < 0)` into `ssub.with.overflow` (PR #216590)

Sun Aug 16 11:58:13 PDT 2026

dtcxzyw wrote:

The following correctness issue was found by [llvm-hackme](https://github.com/dtcxzyw/llvm-hackme).

<!-- llvm-hackme-state: bug_found -->
<!-- llvm-hackme-baseline: 30a31c467683a6c635d143848051160e9c8330be -->
<!-- llvm-hackme-head-sha: 719cd7b4ea092ee94d04d107af76d6db776e1bf2 -->
<!-- llvm-hackme-patch-sha256: 544a54a5694c2afd3587f48369fd3367037e9d213854dea9994844e4346ef4e7 -->
<!-- llvm-hackme-kind: crash -->

This comment is generated by an automated correctness checking service designed to help identify critical correctness bugs (opt crashes or Alive2 miscompilations) and improve PR review efficiency under limited reviewer bandwidth.

The reproducer was generated by LLM.

This bug is a regression introduced by this PR. It does not reproduce on the baseline commit.

## Reproducer

**Kind**: crash

**IR Reproducer**:
```llvm
; RUN: opt -passes=instcombine<no-verify-fixpoint> -S
@llvm.ssub.with.overflow.i8 = global i8 0

define i1 @f(i8 %a, i8 %b) {
  %s = sub i8 %a, %b
  %c1 = icmp slt i8 %s, 0
  %c2 = icmp slt i8 %a, %b
  %x = xor i1 %c1, %c2
  ret i1 %x
}
```

**Stacktrace**:
```
opt: ../llvm-project-pr/llvm/include/llvm/Support/Casting.h:572: decltype(auto) llvm::cast(From*) [with To = llvm::Function; From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/opt -S -o /dev/null /tmp/tmpvve_adh0.ll -passes=instcombine<no-verify-fixpoint>
1.	Running pass "function(instcombine<max-iterations=1;no-verify-fixpoint>)" on module "/tmp/tmpvve_adh0.ll"
2.	Running pass "instcombine<max-iterations=1;no-verify-fixpoint>" on function "f"
 #0 0x00007ffff7e1a862 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Unix/Signals.inc:931:22
 #1 0x00007ffff7e1749c llvm::sys::RunSignalHandlers() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Signals.cpp:108:20
 #2 0x00007ffff7e176a5 SignalHandler(int, siginfo_t*, void*) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Unix/Signals.inc:474:14
 #3 0x00007ffff7a19520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007ffff7a6d9fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007ffff7a19476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007ffff79ff7f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007ffff79ff71b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x00007ffff7a10e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x00007fffedc3b605 (/llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/../lib/../lib/libLLVMCore.so.24.0git+0x23b605)
#10 0x00007fffedc48e6c decltype(auto) llvm::cast<llvm::FunctionType, llvm::Type>(llvm::Type*) /usr/include/c++/11/bits/basic_string.h:442:27
#11 0x00007fffedc48e6c llvm::Function::getFunctionType() const /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/Function.h:212:30
#12 0x00007fffedc48e6c getOrInsertIntrinsicDeclarationImpl(llvm::Module*, unsigned int, llvm::ArrayRef<llvm::Type*>, llvm::FunctionType*) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/IR/Intrinsics.cpp:790:25
#13 0x00007fffef097495 foldSignedSubOverflowCheck /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp:4801:35
#14 0x00007fffef097495 llvm::InstCombinerImpl::foldXorOfICmps(llvm::ICmpInst*, llvm::ICmpInst*, llvm::BinaryOperator&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp:4811:44
#15 0x00007fffef0a9f6c llvm::InstCombinerImpl::visitXor(llvm::BinaryOperator&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp:5705:36
#16 0x00007fffef065e82 llvm::InstCombinerImpl::run() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp:5909:36
#17 0x00007fffef067bfa combineInstructionsOverFunction(llvm::Function&, llvm::InstructionWorklist&, llvm::AAResults*, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::TargetTransformInfo&, llvm::DominatorTree&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::BranchProbabilityInfo*, llvm::ProfileSummaryInfo*, llvm::InstCombineOptions const&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp:6217:5
#18 0x00007fffef068a5c llvm::InstCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp:6278:3
#19 0x00007ffff145ed16 llvm::detail::PassModel<llvm::Function, llvm::InstCombinePass, llvm::AnalysisManager<llvm::Function> >::runImpl(llvm::detail::PassConcept<llvm::Function, llvm::AnalysisManager<llvm::Function> >&, llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:129:3
#20 0x00007fffedd04a9e llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function> >::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerImpl.h:80:18
#21 0x00007ffff145c4c6 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function> >, llvm::AnalysisManager<llvm::Function> >::runImpl(llvm::detail::PassConcept<llvm::Function, llvm::AnalysisManager<llvm::Function> >&, llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:129:3
#22 0x00007fffedd03957 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/IR/PassManager.cpp:132:41
#23 0x00007ffff145fe56 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module> >::runImpl(llvm::detail::PassConcept<llvm::Module, llvm::AnalysisManager<llvm::Module> >&, llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:129:3
#24 0x00007fffedd0324f llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerImpl.h:80:18
#25 0x00007ffff7f94874 llvm::SmallPtrSetImplBase::~SmallPtrSetImplBase() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:89:5
#26 0x00007ffff7f94874 llvm::SmallPtrSetImpl<llvm::AnalysisKey*>::~SmallPtrSetImpl() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:365:35
#27 0x00007ffff7f94874 llvm::SmallPtrSet<llvm::AnalysisKey*, 2u>::~SmallPtrSet() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:532:7
#28 0x00007ffff7f94874 llvm::PreservedAnalyses::~PreservedAnalyses() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/Analysis.h:112:7
#29 0x00007ffff7f94874 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)> >, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/tools/opt/NewPMDriver.cpp:580:10
#30 0x00007ffff7fa18c4 optMain /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/tools/opt/optdriver.cpp:805:25
#31 0x00007ffff7a00d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#32 0x00007ffff7a00e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#33 0x0000555555555095 _start (/llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/opt+0x1095)
```

**Baseline Revision**: `30a31c467683a6c635d143848051160e9c8330be`
**PR Head SHA**: `719cd7b4ea092ee94d04d107af76d6db776e1bf2`
**Patch SHA256**: `544a54a5694c2afd3587f48369fd3367037e9d213854dea9994844e4346ef4e7`

https://github.com/llvm/llvm-project/pull/216590