[InstCombine] miscompilation of `-X * Y --> -(X * Y)`

[bongjunj]

llvm-project/llvm/lib/Transforms/InstCombine/InstCombineMulDivRem.cpp

Lines 360 to 363 in 6de5305

	// -X * Y --> -(X * Y)
	// X * -Y --> -(X * Y)
	if (match(&I, m_c_Mul(m_OneUse(m_Neg(m_Value(X))), m_Value(Y))))
	return BinaryOperator::CreateNeg(Builder.CreateMul(X, Y));

Alive2 report: https://alive2.llvm.org/ce/z/Rq5DNd

----------------------------------------
define i32 @test1.2(i32 %b, i32 %z) {
#0:
  %c = sub i32 0, %z
  %#1 = sdiv i32 %z, %c
  %d = mul nsw i32 %#1, %b
  %e = mul i32 %c, %d
  ret i32 %e
}
=>
define i32 @test1.2(i32 %b, i32 %z) {
#0:
  %#1 = icmp eq i32 %z, 2147483648
  %#2 = sub nsw i32 0, %b
  %#3 = select i1 %#1, i32 %#2, i32 %b
  %.neg = mul i32 %#3, %z
  ret i32 %.neg
}
Transformation doesn't verify!

ERROR: Target is more poisonous than source

Example:
i32 %b = #x80000000 (2147483648, -2147483648)
i32 %z = #x80000000 (2147483648, -2147483648)

Source:
i32 %c = #x80000000 (2147483648, -2147483648)
i32 %#1 = #x00000001 (1)
i32 %d = #x80000000 (2147483648, -2147483648)
i32 %e = #x00000000 (0)

Target:
i1 %#1 = #x1 (1)
i32 %#2 = poison
i32 %#3 = poison
i32 %.neg = poison
Source value: #x00000000 (0)
Target value: poison

Summary:
  0 correct transformations
  1 incorrect transformations
  0 failed-to-prove transformations
  0 Alive2 errors

[dtcxzyw]

Fixed by #112893.

----------------------------------------
define i32 @test1.2(i32 %b, i32 %z) {
#0:
  %c = sub i32 0, %z
  %#1 = sdiv i32 %z, %c
  %d = mul nsw i32 %#1, %b
  %e = mul i32 %c, %d
  ret i32 %e
}
=>
define i32 @test1.2(i32 %b, i32 %z) {
#0:
  %#1 = icmp eq i32 %z, 2147483648
  %#2 = sub i32 0, %b
  %#3 = select i1 %#1, i32 %#2, i32 %b
  %.neg = mul i32 %#3, %z
  ret i32 %.neg
}
ERROR: Timeout

Summary:
  0 correct transformations
  0 incorrect transformations
  1 failed-to-prove transformations
  0 Alive2 errors

nsw flag is dropped.