Bug type: crash
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: BoUpSLP::BlockScheduling::tryScheduleBundle
Issue title: Instruction does not dominate all uses!... LLVM ERROR: Broken module found, compilation aborted!
Labels: llvm:SLPVectorizer
crash-on-valid
Reported by: TatyanaDoubts

To reproduce run opt with the test below (-passes=slp-vectorizer -slp-threshold=-99999):
```
; ModuleID = './reduced.ll'
source_filename = "./reduced.ll"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128-ni:1-p2:32:8:8:32-ni:2"
target triple = "x86_64-unknown-linux-gnu"

declare void @llvm.experimental.deoptimize.isVoid(...) #0

define void @wombat() #0 gc "statepoint-example" {
bb:
  %trunc = trunc i64 0 to i32
  br label %bb1

bb1:                                              ; preds = %bb
  %or = or i32 %trunc, 0
  %zext = zext i32 %or to i64
  %and = and i32 0, 0
  %or2 = or i32 %trunc, 0
  br label %bb3

bb3:                                              ; preds = %bb1
  br label %bb4

bb4:                                              ; preds = %bb3
  %phi = phi i32 [ %trunc, %bb3 ]
  %phi5 = phi i32 [ %or, %bb3 ]
  %phi6 = phi i32 [ %and, %bb3 ]
  %phi7 = phi i32 [ %or2, %bb3 ]
  br label %bb8

bb8:                                              ; preds = %bb4
  %phi9 = phi i32 [ %phi5, %bb4 ]
  %phi10 = phi i32 [ %phi6, %bb4 ]
  %phi11 = phi double [ 0.000000e+00, %bb4 ]
  %phi12 = phi i32 [ %phi7, %bb4 ]
  %phi13 = phi i32 [ %phi, %bb4 ]
  %phi14 = phi double [ 0.000000e+00, %bb4 ]
  call void (...) @llvm.experimental.deoptimize.isVoid(i32 0) [ "deopt"([14 x i32] zeroinitializer, i32 %phi5) ]
  ret void
}

attributes #0 = { "target-features"="+prfchw,-cldemote,+avx,+aes,+sahf,+pclmul,-xop,+crc32,-amx-fp8,+xsaves,-avx512fp16,-usermsr,-sm4,-egpr,+sse4.1,-avx10.1,-avx512ifma,+xsave,+sse4.2,-tsxldtrk,-sm3,-ptwrite,-widekl,-movrs,-invpcid,+64bit,+xsavec,-avx512vpopcntdq,+cmov,-avx512vp2intersect,-avx512cd,+movbe,-avxvnniint8,-ccmp,-amx-int8,-kl,-sha512,-avxvnni,-rtm,+adx,+avx2,-hreset,-movdiri,-serialize,-vpclmulqdq,-avx512vl,-uintr,-cf,+clflushopt,-raoint,-cmpccxadd,+bmi,-amx-tile,+sse,-gfni,-avxvnniint16,-amx-fp16,-zu,-ndd,+xsaveopt,+rdrnd,-avx512f,-amx-bf16,-avx512bf16,-avx512vnni,-push2pop2,+cx8,-avx512bw,+sse3,-pku,-nf,-amx-tf32,-amx-avx512,+fsgsbase,+clzero,-mwaitx,-lwp,+lzcnt,+sha,-movdir64b,-ppx,+wbnoinvd,-enqcmd,-avxneconvert,-tbm,-pconfig,-amx-complex,+ssse3,+cx16,-avx10.2,+bmi2,+fma,+popcnt,-avxifma,+f16c,-avx512bitalg,-rdpru,+clwb,+mmx,+sse2,+rdseed,-avx512vbmi2,-prefetchi,-amx-movrs,+rdpid,-fma4,-avx512vbmi,-shstk,-vaes,-waitpkg,-sgx,+fxsr,-avx512dq,+sse4a" }
```
Reproducer: https://godbolt.org/z/9jrK3bqz9

Stack dump:
```
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=slp-vectorizer -slp-threshold=-99999 <source>
1.	Running pass "verify" on module "<source>"
 #0 0x00000000059aa7e8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x59aa7e8)
 #1 0x00000000059a7694 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007f812ec42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007f812ec969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x00007f812ec42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x00007f812ec287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x0000000000837df9 llvm::json::operator==(llvm::json::Value const&, llvm::json::Value const&) (.cold) JSON.cpp:0:0
 #7 0x00000000058d7311 (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x58d7311)
 #8 0x00000000057c3bc8 (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x57c3bc8)
 #9 0x000000000097d28e llvm::detail::PassModel<llvm::Module, llvm::VerifierPass, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x97d28e)
#10 0x0000000005781121 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5781121)
#11 0x000000000098745a llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x98745a)
#12 0x000000000097b6d1 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x97b6d1)
#13 0x00007f812ec29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#14 0x00007f812ec29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#15 0x0000000000972ae5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x972ae5)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```


Comments: author: antoniofrighetto
body: Maybe cc/ @alexey-bataev.

Fix patch:
commit 96806a7ec35f0e46132801c201ef53969f09ca81
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Thu Nov 6 10:46:53 2025 -0800

    [SLP]Gather copyable node, if its parent is copyable, but this node is still used outside of the block only
    
    If the current node is a copyable node and its parent is copyable too
    and still current node is only used outside, better to cancel scheduling
    for such node, because otherwise there might be wrong def-use chain
      built during vectorization.
    
    Fixes #166775

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index bf3f52c51b64..df835a077f2a 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -20996,6 +20996,15 @@ BoUpSLP::BlockScheduling::tryScheduleBundle(ArrayRef<Value *> VL, BoUpSLP *SLP,
         return false;
       }))
     return std::nullopt;
+  if (S.areInstructionsWithCopyableElements() && EI && EI.UserTE->hasState() &&
+      EI.UserTE->hasCopyableElements() &&
+      EI.UserTE->getMainOp()->getParent() == S.getMainOp()->getParent() &&
+      all_of(VL, [&](Value *V) {
+        if (S.isCopyableElement(V))
+          return true;
+        return isUsedOutsideBlock(V);
+      }))
+    return std::nullopt;
   bool HasCopyables = S.areInstructionsWithCopyableElements();
   if (((!HasCopyables && doesNotNeedToSchedule(VL)) ||
        all_of(VL, [&](Value *V) { return S.isNonSchedulable(V); }))) {


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/X86/copyable-child-node-used-outside.ll
commands: opt -passes=slp-vectorizer -S -slp-threshold=-99999 -mtriple=x86_64-unknown-linux-gnu < %s
tests: test_name: <module>
test_body: 
define <4 x i32> @test() {
;
bb:
  %trunc = trunc i64 0 to i32
  br label %bb1

bb1:
  %or = or i32 %trunc, 0
  %zext = zext i32 %or to i64
  %and = and i32 0, 0
  %or2 = or i32 %trunc, 0
  br label %bb3

bb3:
  %0 = insertelement <4 x i32> zeroinitializer, i32 %trunc, i32 0
  %1 = insertelement <4 x i32> %0, i32 %and, i32 1
  %2 = insertelement <4 x i32> %1, i32 %or2, i32 2
  %3 = insertelement <4 x i32> %2, i32 %or, i32 3
  ret <4 x i32> %3
}