[InstCombine] drop poison flags when simplifying 'shl' based on deman…

…ded bits

As with other transforms in demanded bits, we must be careful not to
wrongly propagate nsw/nuw if we are reducing values leading up to the shift.

This bug was introduced with 1b24f35 and leads to the miscompile
shown in:
https://llvm.org/PR50341

llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp

@@ -575,8 +575,11 @@ Value *InstCombinerImpl::SimplifyDemandedUseBits(Value *V, APInt DemandedMask,
       // demanding those bits from the pre-shifted operand either.
       if (unsigned CTLZ = DemandedMask.countLeadingZeros()) {
         APInt DemandedFromOp(APInt::getLowBitsSet(BitWidth, BitWidth - CTLZ));
-        if (SimplifyDemandedBits(I, 0, DemandedFromOp, Known, Depth + 1))
+        if (SimplifyDemandedBits(I, 0, DemandedFromOp, Known, Depth + 1)) {
+          // We can't guarantee that nsw/nuw hold after simplifying the operand.
+          I->dropPoisonGeneratingFlags();
           return I;
+        }
       }
       computeKnownBits(I, Known, Depth, CxtI);
     }

llvm/test/Transforms/InstCombine/shl-demand.ll

@@ -89,7 +89,7 @@ define i32 @set_shl_mask(i32 %x, i32 %y) {
 
 define i8 @must_drop_poison(i32 %x, i32 %y)  {
 ; CHECK-LABEL: @must_drop_poison(
-; CHECK-NEXT:    [[S:%.*]] = shl nuw nsw i32 [[X:%.*]], [[Y:%.*]]
+; CHECK-NEXT:    [[S:%.*]] = shl i32 [[X:%.*]], [[Y:%.*]]
 ; CHECK-NEXT:    [[T:%.*]] = trunc i32 [[S]] to i8
 ; CHECK-NEXT:    ret i8 [[T]]
 ;