[ConstraintElim] Miscompilation with cmp intrinsic

[dtcxzyw]

Reproducer: https://alive2.llvm.org/ce/z/Tvz2NA

; bin/opt -passes=constraint-elimination test.ll -S
define void @h(ptr %p) {
entry:
  br label %for.cond

for.cond:                                         ; preds = %for.cond1, %entry
  %storemerge = phi i32 [ 0, %entry ], [ 1, %for.cond1 ]
  %cmp = icmp eq i32 %storemerge, 0
  br i1 %cmp, label %for.cond1, label %for.end6

for.cond1:                                        ; preds = %for.cond, %for.body3
  %i.0 = phi i32 [ %inc, %for.body3 ], [ 0, %for.cond ]
  %cmp2 = icmp ult i32 %i.0, 3
  br i1 %cmp2, label %for.body3, label %for.cond

for.body3:                                        ; preds = %for.cond1
  %sub.i = tail call range(i32 -1, 2) i32 @llvm.scmp.i32.i32(i32 1, i32 %storemerge)
  store i32 %sub.i, ptr %p, align 4
  %inc = add nuw nsw i32 %i.0, 1
  br label %for.cond1

for.end6:
  ret void
}

define void @h(ptr %p) {
entry:
  br label %for.cond

for.cond:                                         ; preds = %for.cond1, %entry
  %storemerge = phi i32 [ 0, %entry ], [ 1, %for.cond1 ]
  %cmp = icmp eq i32 %storemerge, 0
  br i1 %cmp, label %for.cond1, label %for.end6

for.cond1:                                        ; preds = %for.body3, %for.cond
  %i.0 = phi i32 [ %inc, %for.body3 ], [ 0, %for.cond ]
  %cmp2 = icmp ult i32 %i.0, 3
  br i1 %cmp2, label %for.body3, label %for.cond

for.body3:                                        ; preds = %for.cond1
  store i32 0, ptr %p, align 4
  %inc = add nuw nsw i32 %i.0, 1
  br label %for.cond1

for.end6:                                         ; preds = %for.cond
  ret void
}

The result of scmp should be 1 instead of 0.

Reduced C reproducer:

#include <stdio.h>
#include <stdint.h>

int builtin_scmp(int d, int e) { return (d > e) - (d < e); }
int32_t f = 0;
int64_t g = 0;
void h() {
  for (f = 0; f <= 0; f++) {
    int i;
    for (i = 0; i < 3; i++)
      g = builtin_scmp(1, f);
  }
}
int main() {
  h();
  printf("%d\n", (int)g);
  return 0;
}

I will post a fix later.