Bug type: crash
Component: VectorCombine
Bug location: llvm/lib/Transforms/Vectorize/VectorCombine.cpp: VectorCombine::foldInsExtVectorToShuffle
Issue title: [VectorCombine] Assertion `I >= 0 && I < (NumOpElts * 2) && "Out-of-bounds shuffle mask element"' failed.
Labels: crash-on-valid
llvm:transforms
Reported by: dtcxzyw

Reproducer:
```
; bin/opt -passes=vector-combine reduced.ll -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define i32 @test(ptr readonly captures(none) dereferenceable(16) %0) {
  %2 = load <16 x i8>, ptr %0, align 1
  %.sroa.01.2.vec.insert = shufflevector <16 x i8> %2, <16 x i8> poison, <4 x i32> <i32 0, i32 poison, i32 poison, i32 poison>
  %3 = extractelement <16 x i8> %2, i64 11
  %.sroa.01.3.vec.insert = insertelement <4 x i8> %.sroa.01.2.vec.insert, i8 %3, i64 1
  %4 = bitcast <4 x i8> %.sroa.01.3.vec.insert to i32
  ret i32 %4
}
```
```
opt: /home/dtcxzyw/WorkSpace/Projects/compilers/llvm-project/llvm/lib/IR/Instructions.cpp:1890: bool isSingleSourceMaskImpl(llvm::ArrayRef<int>, int): Assertion `I >= 0 && I < (NumOpElts * 2) && "Out-of-bounds shuffle mask element"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: bin/opt -passes=vector-combine reduced.ll -S
1.      Running pass "function(vector-combine)" on module "reduced.ll"
2.      Running pass "vector-combine" on function "test"
 #0 0x00007f4379a17152 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMSupport.so.21.0git+0x217152)
 #1 0x00007f4379a1403f llvm::sys::RunSignalHandlers() (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMSupport.so.21.0git+0x21403f)
 #2 0x00007f4379a1417c SignalHandler(int) Signals.cpp:0:0
 #3 0x00007f4379442520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007f43794969fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x00007f43794969fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x00007f43794969fc pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x00007f4379442476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x00007f43794287f3 abort ./stdlib/abort.c:81:7
 #9 0x00007f437942871b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x00007f4379439e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x00007f4370e71a16 isSingleSourceMaskImpl(llvm::ArrayRef<int>, int) Instructions.cpp:0:0
#12 0x00007f4370e7c3dc llvm::ShuffleVectorInst::isReverseMask(llvm::ArrayRef<int>, int) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x27c3dc)
#13 0x00007f43788933f2 llvm::X86TTIImpl::getShuffleCost(llvm::TargetTransformInfo::ShuffleKind, llvm::VectorType*, llvm::ArrayRef<int>, llvm::TargetTransformInfo::TargetCostKind, int, llvm::VectorType*, llvm::ArrayRef<llvm::Value const*>, llvm::Instruction const*) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0x4933f2)
#14 0x00007f43716ddf0c llvm::TargetTransformInfo::getShuffleCost(llvm::TargetTransformInfo::ShuffleKind, llvm::VectorType*, llvm::ArrayRef<int>, llvm::TargetTransformInfo::TargetCostKind, int, llvm::VectorType*, llvm::ArrayRef<llvm::Value const*>, llvm::Instruction const*) const (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMAnalysis.so.21.0git+0x4ddf0c)
#15 0x00007f437224f6e7 (anonymous namespace)::VectorCombine::foldInsExtVectorToShuffle(llvm::Instruction&) VectorCombine.cpp:0:0
#16 0x00007f4372256116 (anonymous namespace)::VectorCombine::run()::'lambda'(llvm::Instruction&)::operator()(llvm::Instruction&) const VectorCombine.cpp:0:0
#17 0x00007f437225787f llvm::VectorCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMVectorize.so.21.0git+0x25787f)
#18 0x00007f4373f225c5 llvm::detail::PassModel<llvm::Function, llvm::VectorCombinePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMPasses.so.21.0git+0x1225c5)
#19 0x00007f4370f10cad llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x310cad)
#20 0x00007f43784dc235 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0xdc235)
#21 0x00007f4370f0ee75 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x30ee75)
#22 0x00007f43784dcbf5 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0xdcbf5)
#23 0x00007f4370f0fb2a llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x30fb2a)
#24 0x00007f4379ba3dc6 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMOptDriver.so.21.0git+0x2fdc6)
#25 0x00007f4379baf5c2 optMain (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMOptDriver.so.21.0git+0x3b5c2)
#26 0x00007f4379429d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#27 0x00007f4379429e40 call_init ./csu/../csu/libc-start.c:128:20
#28 0x00007f4379429e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#29 0x00006293bc5a5095 _start (bin/opt+0x1095)
Aborted (core dumped)
```

Triggered by https://github.com/llvm/llvm-project/pull/121216. cc @ParkHanbum @RKSimon 
Reported by https://github.com/dtcxzyw/llvm-opt-benchmark/issues/2093



Comments: author: RKSimon
body: Found the problem - fix incoming

Fix patch:
commit eb2b453eb73dfe0b8cf516dfb4d568c0b858d1fa
Author: Simon Pilgrim <llvm-dev@redking.me.uk>
Date:   Thu Feb 6 16:40:48 2025 +0000

    [VectorCombine] foldInsExtVectorToShuffle - ensure we call getShuffleCost with the input operand type, not the result
    
    Typo in #121216
    
    Fixes #126085

diff --git a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
index 4f46b621c8a7..746742e14d08 100644
--- a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
+++ b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
@@ -3210,7 +3210,7 @@ bool VectorCombine::foldInsExtVectorToShuffle(Instruction &I) {
       ExtToVecMask[0] = ExtIdx;
     // Add cost for expanding or narrowing
     NewCost = TTI.getShuffleCost(TargetTransformInfo::SK_PermuteSingleSrc,
-                                 DstVecTy, ExtToVecMask, CostKind);
+                                 SrcVecTy, ExtToVecMask, CostKind);
     NewCost += TTI.getShuffleCost(SK, DstVecTy, Mask, CostKind);
   }
 


Regression tests:
file: llvm/test/Transforms/VectorCombine/X86/pr126085.ll
commands: opt < %s -passes=vector-combine -S -mtriple=x86_64--
tests: test_name: <module>
test_body: 
define i32 @test(ptr %a0) {
;
  %load = load <16 x i8>, ptr %a0, align 1
  %shuf = shufflevector <16 x i8> %load, <16 x i8> poison, <4 x i32> <i32 0, i32 poison, i32 poison, i32 poison>
  %elt = extractelement <16 x i8> %load, i64 11
  %ins = insertelement <4 x i8> %shuf, i8 %elt, i64 1
  %res = bitcast <4 x i8> %ins to i32
  ret i32 %res
}