[InstCombine] Fix miscompile in FoldSPFofSPF

We had a select of a cast of a select but attempted to replace the outer
select with the inner select dispite their incompatible types.

Patch by Anton Korobeynikov!

This fixes PR27236.

llvm-svn: 265805

2 files changed, 22 insertions, 0 deletions

diff --git a/llvm/lib/Transforms/InstCombine/InstCombineSelect.cpp b/llvm/lib/Transforms/InstCombine/InstCombineSelect.cpp
index 7260dd2093d..8595996c29c 100644
--- a/llvm/lib/Transforms/InstCombine/InstCombineSelect.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstCombineSelect.cpp
@@ -642,6 +642,9 @@ Instruction *InstCombiner::FoldSPFofSPF(Instruction *Inner,
                                         Value *A, Value *B,
                                         Instruction &Outer,
                                         SelectPatternFlavor SPF2, Value *C) {
+  if (Outer.getType() != Inner->getType())
+    return nullptr;
+
   if (C == A || C == B) {
     // MAX(MAX(A, B), B) -> MAX(A, B)
     // MIN(MIN(a, b), a) -> MIN(a, b)
diff --git a/llvm/test/Transforms/InstCombine/pr27236.ll b/llvm/test/Transforms/InstCombine/pr27236.ll
new file mode 100644
index 00000000000..0b086cd7b8c
--- /dev/null
+++ b/llvm/test/Transforms/InstCombine/pr27236.ll
@@ -0,0 +1,19 @@
+; RUN: opt -S -instcombine < %s | FileCheck %s
+
+define float @test1(i32 %scale) {
+entry:
+  %tmp1 = icmp sgt i32 1, %scale
+  %tmp2 = select i1 %tmp1, i32 1, i32 %scale
+  %tmp3 = sitofp i32 %tmp2 to float
+  %tmp4 = icmp sgt i32 %tmp2, 0
+  %sel = select i1 %tmp4, float %tmp3, float 0.000000e+00
+  ret float %sel
+}
+
+; CHECK-LABEL: define float @test1(
+; CHECK:  %[[tmp1:.*]] = icmp slt i32 %scale, 1
+; CHECK:  %[[tmp2:.*]] = select i1 %[[tmp1]], i32 1, i32 %scale
+; CHECK:  %[[tmp3:.*]] = sitofp i32 %[[tmp2]] to float
+; CHECK:  %[[tmp4:.*]] = icmp sgt i32 %[[tmp2]], 0
+; CHECK:  %[[sel:.*]] = select i1 %[[tmp4]], float %[[tmp3]], float 0.000000e+00
+; CHECK:  ret float %[[sel]]