[DAGCombiner] Fix the "subtraction if above a constant threshold" miscompile

This fixes llvm#135194 incorrectly reusing the existing `add nuw/nsw`
while the transformed code relies on an unsigned wrap.

Author: pfusik

llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp

@@ -12140,11 +12140,16 @@ SDValue DAGCombiner::visitSELECT(SDNode *N) {
     // (select (ult x, C), x, (add x, -C)) -> (umin x, (add x, -C))
     APInt C;
     if (sd_match(Cond1, m_ConstInt(C)) && hasUMin(VT)) {
-      if ((CC == ISD::SETUGT && Cond0 == N2 &&
-           sd_match(N1, m_Add(m_Specific(N2), m_SpecificInt(~C)))) ||
-          (CC == ISD::SETULT && Cond0 == N1 &&
-           sd_match(N2, m_Add(m_Specific(N1), m_SpecificInt(-C)))))
-        return DAG.getNode(ISD::UMIN, DL, VT, N1, N2);
+      if (CC == ISD::SETUGT && Cond0 == N2 &&
+          sd_match(N1, m_Add(m_Specific(N2), m_SpecificInt(~C))))
+        return DAG.getNode(
+            ISD::UMIN, DL, VT,
+            DAG.getNode(ISD::ADD, DL, VT, N2, DAG.getConstant(~C, DL, VT)), N2);
+      if (CC == ISD::SETULT && Cond0 == N1 &&
+          sd_match(N2, m_Add(m_Specific(N1), m_SpecificInt(-C))))
+        return DAG.getNode(
+            ISD::UMIN, DL, VT, N1,
+            DAG.getNode(ISD::ADD, DL, VT, N1, DAG.getConstant(-C, DL, VT)));
     }
   }
 

llvm/test/CodeGen/RISCV/rv32zbb.ll

@@ -1932,7 +1932,10 @@ define i7 @sub_if_uge_C_nsw_i7(i7 %a) {
 ; RV32ZBB-LABEL: sub_if_uge_C_nsw_i7:
 ; RV32ZBB:       # %bb.0:
 ; RV32ZBB-NEXT:    ori a0, a0, 51
+; RV32ZBB-NEXT:    andi a1, a0, 127
 ; RV32ZBB-NEXT:    addi a0, a0, 17
+; RV32ZBB-NEXT:    andi a0, a0, 92
+; RV32ZBB-NEXT:    minu a0, a0, a1
 ; RV32ZBB-NEXT:    ret
   %x = or i7 %a, 51
   %c = icmp ugt i7 %x, -18
@@ -1955,7 +1958,10 @@ define i7 @sub_if_uge_C_swapped_nsw_i7(i7 %a) {
 ; RV32ZBB-LABEL: sub_if_uge_C_swapped_nsw_i7:
 ; RV32ZBB:       # %bb.0:
 ; RV32ZBB-NEXT:    ori a0, a0, 51
+; RV32ZBB-NEXT:    andi a1, a0, 127
 ; RV32ZBB-NEXT:    addi a0, a0, 17
+; RV32ZBB-NEXT:    andi a0, a0, 92
+; RV32ZBB-NEXT:    minu a0, a1, a0
 ; RV32ZBB-NEXT:    ret
   %x = or i7 %a, 51
   %c = icmp ult i7 %x, -17

llvm/test/CodeGen/RISCV/rv64zbb.ll

@@ -2087,7 +2087,10 @@ define i7 @sub_if_uge_C_nsw_i7(i7 %a) {
 ; RV64ZBB-LABEL: sub_if_uge_C_nsw_i7:
 ; RV64ZBB:       # %bb.0:
 ; RV64ZBB-NEXT:    ori a0, a0, 51
+; RV64ZBB-NEXT:    andi a1, a0, 127
 ; RV64ZBB-NEXT:    addi a0, a0, 17
+; RV64ZBB-NEXT:    andi a0, a0, 92
+; RV64ZBB-NEXT:    minu a0, a0, a1
 ; RV64ZBB-NEXT:    ret
   %x = or i7 %a, 51
   %c = icmp ugt i7 %x, -18
@@ -2110,7 +2113,10 @@ define i7 @sub_if_uge_C_swapped_nsw_i7(i7 %a) {
 ; RV64ZBB-LABEL: sub_if_uge_C_swapped_nsw_i7:
 ; RV64ZBB:       # %bb.0:
 ; RV64ZBB-NEXT:    ori a0, a0, 51
+; RV64ZBB-NEXT:    andi a1, a0, 127
 ; RV64ZBB-NEXT:    addi a0, a0, 17
+; RV64ZBB-NEXT:    andi a0, a0, 92
+; RV64ZBB-NEXT:    minu a0, a1, a0
 ; RV64ZBB-NEXT:    ret
   %x = or i7 %a, 51
   %c = icmp ult i7 %x, -17