[llvm] [InstCombine] Fold variable extract of a constant-strided pointer vector (PR #217078)

[Yingwei Zheng via llvm-commits]

dtcxzyw wrote:

The following correctness issue was found by [llvm-hackme](https://github.com/dtcxzyw/llvm-hackme).

<!-- llvm-hackme-state: bug_found -->
<!-- llvm-hackme-baseline: 7e0416da49f49b49c393fd2b750056e814b81441 -->
<!-- llvm-hackme-head-sha: 9ed44dce8649e9437e8f9b681a59a4a9815425f9 -->
<!-- llvm-hackme-patch-sha256: 66d5bf141863c7f992f5201936fa645ac56e19931359df5fb6cfac34d0daa0fc -->
<!-- llvm-hackme-kind: miscompilation -->

This comment is generated by an automated correctness checking service designed to help identify critical correctness bugs (opt crashes or Alive2 miscompilations) and improve PR review efficiency under limited reviewer bandwidth.

The reproducer was generated by LLM.

This bug is a regression introduced by this PR. It does not reproduce on the baseline commit.

## Reproducer

**Kind**: miscompilation

**IR Reproducer**:
```llvm
; RUN: opt -passes=instcombine<no-verify-fixpoint> -S
target datalayout = "p:8:8:8"
target triple = "x86_64-unknown-linux-gnu"

define ptr @f(ptr %b, i8 %i) {
  %g0 = getelementptr inbounds i8, ptr %b, i8 6
  %g1 = getelementptr inbounds i8, ptr %b, i8 4
  %v0 = insertelement <2 x ptr> poison, ptr %g0, i8 0
  %v1 = insertelement <2 x ptr> %v0, ptr %g1, i8 1
  %r = extractelement <2 x ptr> %v1, i8 %i
  ret ptr %r
}
```

**Alive2 Counterexample**:
```
----------------------------------------
define ptr @f(ptr %b, i8 %i) {
#0:
  %g0 = gep inbounds ptr %b, 1 x i8 6
  %g1 = gep inbounds ptr %b, 1 x i8 4
  %v0 = insertelement <2 x ptr> poison, ptr %g0, i8 0
  %v1 = insertelement <2 x ptr> %v0, ptr %g1, i8 1
  %r = extractelement <2 x ptr> %v1, i8 %i
  ret ptr %r
}
=>
define ptr @f(ptr %b, i8 %i) {
#0:
  %g0 = gep inbounds nuw ptr %b, 1 x i8 6
  %#1 = mul i8 %i, 254
  %r = gep ptr %g0, 1 x i8 %#1
  ret ptr %r
}
Transformation doesn't verify!

ERROR: Target is more poisonous than source

Example:
ptr %b = pointer(non-local, block_id=1, offset=0) / Address=#x08
i8 %i = #x01 (1)

Source:
ptr %g0 = poison
ptr %g1 = pointer(non-local, block_id=1, offset=4) / Address=#x0c
<2 x ptr> %v0 = < poison, poison >
<2 x ptr> %v1 = < poison, pointer(non-local, block_id=1, offset=4) / Address=#x0c >
ptr %r = pointer(non-local, block_id=1, offset=4) / Address=#x0c

SOURCE MEMORY STATE
===================
NON-LOCAL BLOCKS:
Block 0 >	size: 0	align: 1	alloc type: 0	alive: false	address: #x00
Block 1 >	size: 0	align: 1	alloc type: 4	alive: true	address: #x08

Target:
ptr %g0 = poison
i8 %#1 = #xfe (254, -2)
ptr %r = poison

TARGET MEMORY STATE
===================
NON-LOCAL BLOCKS:
Block 0 >	size: 0	align: 1	alloc type: 0	alive: false	address: #x00
Block 1 >	size: 0	align: 1	alloc type: 4	alive: true	address: #x08
Source value: pointer(non-local, block_id=1, offset=4) / Address=#x0c
Target value: poison

Summary:
  0 correct transformations
  1 incorrect transformations
  0 failed-to-prove transformations
  0 Alive2 errors
```

**Opt Output**:
```llvm
; ModuleID = '/tmp/tmpty7dsgv3.ll'
source_filename = "/tmp/tmpty7dsgv3.ll"
target datalayout = "p:8:8:8"
target triple = "x86_64-unknown-linux-gnu"

define ptr @f(ptr %b, i8 %i) {
  %g0 = getelementptr inbounds nuw i8, ptr %b, i8 6
  %1 = mul i8 %i, -2
  %r = getelementptr i8, ptr %g0, i8 %1
  ret ptr %r
}
```


**Baseline Revision**: `7e0416da49f49b49c393fd2b750056e814b81441`
**PR Head SHA**: `9ed44dce8649e9437e8f9b681a59a4a9815425f9`
**Patch SHA256**: `66d5bf141863c7f992f5201936fa645ac56e19931359df5fb6cfac34d0daa0fc`


https://github.com/llvm/llvm-project/pull/217078