[InstCombine] Miscompilation on vector operations with undef and poison elements

[ericliuu]

The following test case is miscompiled by InstCombine:

define <2 x i32> @src(<2 x i1> %x, <2 x i32> %y) {
%0:
  %sext.i1 = sext <2 x i1> %x to <2 x i32>
  %r = urem <2 x i32> %y, %sext.i1
  ret <2 x i32> %r
}
=>
define <2 x i32> @tgt(<2 x i1> %x, <2 x i32> %y) {
%0:
  %1 = icmp eq <2 x i32> %y, { 4294967295, 4294967295 }
  %r = select <2 x i1> %1, <2 x i32> { 0, 0 }, <2 x i32> %y
  ret <2 x i32> %r
}
Transformation doesn't verify!

ERROR: Value mismatch

Here is the alive2 output that produces an example input that causes a value mismatch: https://alive2.llvm.org/ce/z/JX-TLu
And here is the original IR file that produced the miscompilation:

define <2 x i32> @zext_bool_urem_divisor_vec(<2 x i1> %x, <2 x i32> %y) {
  %ext = zext <2 x i1> %x to <2 x i32>
  %sext.i = sext <2 x i1> %x to <2 x i32>
  %sext.i1 = sext <2 x i1> %x to <2 x i32>
  %r.i2 = xor <2 x i32> <i32 42, i32 -7>, %sext.i1
  %r.i = xor <2 x i32> <i32 42, i32 -7>, %r.i2
  %r = urem <2 x i32> %y, %r.i
  ret <2 x i32> %r
}

[floatshadow]

The replacement happens here

llvm-project/llvm/lib/Transforms/InstCombine/InstCombineMulDivRem.cpp

Lines 1917 to 1925 in fe3ed65

	// If the divisor is a sext of a boolean, then the divisor must be max
	// unsigned value (-1). Therefore, the remainder is Op0 unless Op0 is also
	// max unsigned value. In that case, the remainder is 0:
	// urem Op0, (sext i1 X) --> (Op0 == -1) ? 0 : Op0
	Value *X;
	if (match(Op1, m_SExt(m_Value(X))) && X->getType()->isIntOrIntVectorTy(1)) {
	Value *Cmp = Builder.CreateICmpEQ(Op0, ConstantInt::getAllOnesValue(Ty));
	return SelectInst::Create(Cmp, ConstantInt::getNullValue(Ty), Op0);
	}

I'm a bit confused. Alive2 tells me when

<2 x i32> %y = < undef, poison >

we have

Target:
<2 x i1> %1 = < #x0 (0), poison >
<2 x i32> %r = < #xffffffff (4294967295, -1), poison >