[InstCombine] Fix out-of-bounds ashr(shl) optimization

[jeroen.dobbelaere]

Summary

This fixes a crash found by the oss fuzzer and reported by @fhahn.
The suggestion of @RKSimon seems to be the correct fix here. (See D91343).

The oss fuzz report can be found here: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32759

[lebedev.ri]

LGTM, thank you.

llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp

case Instruction::AShr: {
     // if we do not demand any of the new sign bits. So, return the original
     // operand instead.
     const APInt *ShiftRC;
     const APInt *ShiftLC;
     Value *X;
     unsigned BitWidth = DemandedMask.getBitWidth();
     if (match(I,
               m_AShr(m_Shl(m_Value(X), m_APInt(ShiftLC)), m_APInt(ShiftRC))) &&
-        ShiftLC == ShiftRC &&
+        ShiftLC == ShiftRC && ShiftLC->ult(BitWidth) &&
         DemandedMask.isSubsetOf(APInt::getLowBitsSet(
             BitWidth, BitWidth - ShiftRC->getZExtValue()))) {
       return X;
     }
 
     break;
   }
   default:

llvm/test/Transforms/InstCombine/oss_fuzz_32759.ll

+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; RUN: opt < %s -instcombine -S | FileCheck %s
+target datalayout = "n32"
+
+define i1 @oss_fuzz_32759(i1 %y) {
+; CHECK-LABEL: @oss_fuzz_32759(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    br i1 undef, label [[COND_TRUE:%.*]], label [[END:%.*]]
+; CHECK:       cond.true:
+; CHECK-NEXT:    br label [[END]]
+; CHECK:       end:
+; CHECK-NEXT:    ret i1 false
+;
+entry:
+  br i1 undef, label %cond.true, label %end
+
+cond.true:                                        ; preds = %entry
+  %zy = zext i1 %y to i32
+  %B6 = shl i32 %zy, 2147483647
+  %B3 = ashr i32 %B6, 2147483647
+  %B7 = srem i32 %B3, 123
+  %cond = xor i32 %B7, %B3
+  br label %end
+
+end:                                              ; preds = %cond.true, %entry
+  %p = phi i32 [ %cond, %cond.true ], [ -1, %entry ]
+  %r = icmp eq i32 %p, 0
+  ret i1 %r
+}