[InstCombine] Drop Range attribute when simplifying 'fshl' based on demanded bits (#124429)

When simplifying operands based on demanded bits, the return value range
of llvm.fshl might change. Keeping the Range attribute might cause
llvm.fshl to generate a poison and lead to miscompile. Drop the Range
attribute similar to `dropPosonGeneratingFlags` elsewhere.

Fix #124387

Author: MaskRay

llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp

@@ -1039,11 +1039,14 @@ Value *InstCombinerImpl::SimplifyDemandedUseBits(Instruction *I,
         APInt DemandedMaskLHS(DemandedMask.lshr(ShiftAmt));
         APInt DemandedMaskRHS(DemandedMask.shl(BitWidth - ShiftAmt));
         if (I->getOperand(0) != I->getOperand(1)) {
-          if (SimplifyDemandedBits(I, 0, DemandedMaskLHS, LHSKnown,
-                                   Depth + 1, Q) ||
+          if (SimplifyDemandedBits(I, 0, DemandedMaskLHS, LHSKnown, Depth + 1,
+                                   Q) ||
               SimplifyDemandedBits(I, 1, DemandedMaskRHS, RHSKnown, Depth + 1,
-                                   Q))
+                                   Q)) {
+            // Range attribute may no longer hold.
+            I->dropPoisonGeneratingReturnAttributes();
             return I;
+          }
         } else { // fshl is a rotate
           // Avoid converting rotate into funnel shift.
           // Only simplify if one operand is constant.

llvm/test/Transforms/InstCombine/fsh.ll

@@ -1069,11 +1069,12 @@ entry:
   ret <2 x i31>  %res
 }
 
+;; Issue #124387 Range attribute no longer holds after operands changed.
 define i8 @fshl_range_trunc(i1 %x) {
 ; CHECK-LABEL: @fshl_range_trunc(
 ; CHECK-NEXT:    [[ZEXT:%.*]] = zext i1 [[X:%.*]] to i32
 ; CHECK-NEXT:    [[OR:%.*]] = or disjoint i32 [[ZEXT]], 126
-; CHECK-NEXT:    [[FSHL:%.*]] = call range(i32 -4, 2) i32 @llvm.fshl.i32(i32 [[OR]], i32 -2, i32 1)
+; CHECK-NEXT:    [[FSHL:%.*]] = call i32 @llvm.fshl.i32(i32 [[OR]], i32 -2, i32 1)
 ; CHECK-NEXT:    [[TR:%.*]] = trunc nuw i32 [[FSHL]] to i8
 ; CHECK-NEXT:    ret i8 [[TR]]
 ;