Bug type: crash
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: tryToReduce
Issue title: [SLPVectorizer] Assertion `Iter != this->end() && "DenseMap::at failed due to a missing key"' failed.
Labels: llvm:SLPVectorizer
crash-on-valid
Reported by: dtcxzyw

Reproducer: https://godbolt.org/z/v5bqhPWqb
```
; bin/opt -passes=slp-vectorizer reduced.ll -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define i16 @test() {
entry:
  %sub.i487.i.reass.i = add i16 0, 0
  %sub.i487.i.reass.40.i = add i16 %sub.i487.i.reass.i, 0
  %sub.i487.i.reass.41.i = add i16 %sub.i487.i.reass.i, 0
  %sub.i487.i.reass.42.i = add i16 %sub.i487.i.reass.i, 0
  %sub.i487.i.reass.43.i = add i16 %sub.i487.i.reass.i, 0
  %sub.i487.i.reass.44.i = add i16 %sub.i487.i.reass.i, 0
  %sub.i487.i.reass.45.i = add i16 %sub.i487.i.reass.i, 0
  %sub.i487.i.reass.46.i = add i16 0, 0
  %sub.i487.i.reass.47.i = add i16 0, 0
  %sub.i487.i.reass.48.i = add i16 0, 0
  %sub.i487.i.reass.49.i = add i16 0, 0
  %or374461.i.40.i = or i16 %sub.i487.i.reass.40.i, %sub.i487.i.reass.41.i
  %or374461.i.41.i = or i16 %or374461.i.40.i, %sub.i487.i.reass.42.i
  %or374461.i.42.i = or i16 %or374461.i.41.i, %sub.i487.i.reass.43.i
  %or374461.i.43.i = or i16 %or374461.i.42.i, %sub.i487.i.reass.44.i
  %or374461.i.44.i = or i16 %or374461.i.43.i, %sub.i487.i.reass.45.i
  %or374461.i.45.i = or i16 %or374461.i.44.i, %sub.i487.i.reass.46.i
  %or374461.i.46.i = or i16 %or374461.i.45.i, %sub.i487.i.reass.47.i
  %or374461.i.47.i = or i16 %or374461.i.46.i, %sub.i487.i.reass.48.i
  %or374461.i.48.i = or i16 %or374461.i.47.i, %sub.i487.i.reass.49.i
  %or374461.i.50.i = or i16 %or374461.i.48.i, %sub.i487.i.reass.i
  %sub.i487.i96.reass.i = add i16 0, 0
  %sub.i487.i96.reass.16.i = add i16 %sub.i487.i96.reass.i, 0
  %sub.i487.i96.reass.17.i = add i16 %sub.i487.i96.reass.i, 0
  %0 = or i16 %sub.i487.i96.reass.16.i, %sub.i487.i96.reass.17.i
  %1 = or i16 %0, %or374461.i.50.i
  ret i16 %1
}
```
```
opt: /root/llvm-project/llvm/include/llvm/ADT/DenseMap.h:204: const ValueT& llvm::DenseMapBase<DerivedT, KeyT, ValueT, KeyInfoT, BucketT>::at(llvm::DenseMapBase<DerivedT, KeyT, ValueT, KeyInfoT, BucketT>::const_arg_type_t<KeyT>) const [with DerivedT = llvm::DenseMap<llvm::Value*, llvm::Value*>; KeyT = llvm::Value*; ValueT = llvm::Value*; KeyInfoT = llvm::DenseMapInfo<llvm::Value*, void>; BucketT = llvm::detail::DenseMapPair<llvm::Value*, llvm::Value*>; llvm::DenseMapBase<DerivedT, KeyT, ValueT, KeyInfoT, BucketT>::const_arg_type_t<KeyT> = const llvm::Value*]: Assertion `Iter != this->end() && "DenseMap::at failed due to a missing key"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=slp-vectorizer <source>
1.	Running pass "function(slp-vectorizer)" on module "<source>"
2.	Running pass "slp-vectorizer" on function "test"
 #0 0x0000000005035d68 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5035d68)
 #1 0x00000000050334ac SignalHandler(int) Signals.cpp:0:0
 #2 0x0000707bdcc42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x0000707bdcc969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x0000707bdcc42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x0000707bdcc287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x0000707bdcc2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x0000707bdcc39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x000000000409326e llvm::DenseMapBase<llvm::DenseMap<llvm::Value*, llvm::Value*, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, llvm::Value*>>, llvm::Value*, llvm::Value*, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, llvm::Value*>>::at(llvm::Value const*) const (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x409326e)
 #9 0x000000000413473f (anonymous namespace)::HorizontalReduction::tryToReduce(llvm::slpvectorizer::BoUpSLP&, llvm::DataLayout const&, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo const&) SLPVectorizer.cpp:0:0
#10 0x00000000041370d1 llvm::SLPVectorizerPass::vectorizeHorReduction(llvm::PHINode*, llvm::Instruction*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*, llvm::SmallVectorImpl<llvm::WeakTrackingVH>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x41370d1)
#11 0x000000000413b996 llvm::SLPVectorizerPass::vectorizeRootInstruction(llvm::PHINode*, llvm::Instruction*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*) (.constprop.0) SLPVectorizer.cpp:0:0
#12 0x000000000413ff36 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x413ff36)
#13 0x0000000004146401 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#14 0x000000000414708b llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x414708b)
#15 0x0000000002f1a1ae llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2f1a1ae)
#16 0x0000000004e38158 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4e38158)
#17 0x0000000000e0b02e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe0b02e)
#18 0x0000000004e36b7e llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4e36b7e)
#19 0x0000000000e0a83e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe0a83e)
#20 0x0000000004e365b0 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4e365b0)
#21 0x00000000008feef2 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x8feef2)
#22 0x00000000008f1d7c optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x8f1d7c)
#23 0x0000707bdcc29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#24 0x0000707bdcc29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#25 0x00000000008e984e _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x8e984e)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```
llvm version: e8a739062490ce1bb30974f216ba187cd7b5a2a4


Fix patch:
commit 3db0f8c895d4e814a18b754f9afbb1e03bd839a5
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Mon Sep 23 10:49:54 2024 -0700

    [SLP]Update TrackedToOrig mappings after reduction vectorization
    
    Need to update mappings in TrackedToOrig to correctly provide mapping
    between updated reduced value after vectorization and its original
    value, otherwise the compiler might miss this update and it may cause
    compiler crash later, when it tries to find the original instruction
    mapping for the updated value.
    
    Fixes https://github.com/llvm/llvm-project/issues/109376

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index a88702b81096..04b8fc09a724 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -18668,6 +18668,14 @@ public:
         // Vectorize a tree.
         Value *VectorizedRoot =
             V.vectorizeTree(LocalExternallyUsedValues, InsertPt);
+        // Update TrackedToOrig mapping, since the tracked values might be
+        // updated.
+        for (Value *RdxVal : Candidates) {
+          Value *OrigVal = TrackedToOrig.at(RdxVal);
+          Value *TransformedRdxVal = TrackedVals.at(OrigVal);
+          if (TransformedRdxVal != RdxVal)
+            TrackedToOrig.try_emplace(TransformedRdxVal, OrigVal);
+        }
 
         Builder.SetInsertPoint(InsertPt);
 


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/X86/reduced-value-vectorized-later.ll
commands: opt -S -passes=slp-vectorizer -mtriple=x86_64-unknown-linux-gnu < %s
tests: test_name: test
test_body: define i16 @test() {
entry:
  %subi = add i16 0, 0
  %sub40.i = add i16 %subi, 0
  %sub41.i = add i16 %subi, 0
  %sub42.i = add i16 %subi, 0
  %sub43.i = add i16 %subi, 0
  %sub44.i = add i16 %subi, 0
  %sub45.i = add i16 %subi, 0
  %sub46.i = add i16 0, 0
  %sub47.i = add i16 0, 0
  %sub48.i = add i16 0, 0
  %sub49.i = add i16 0, 0
  %or40.i = or i16 %sub40.i, %sub41.i
  %or41.i = or i16 %or40.i, %sub42.i
  %or42.i = or i16 %or41.i, %sub43.i
  %or43.i = or i16 %or42.i, %sub44.i
  %or44.i = or i16 %or43.i, %sub45.i
  %or45.i = or i16 %or44.i, %sub46.i
  %or46.i = or i16 %or45.i, %sub47.i
  %or47.i = or i16 %or46.i, %sub48.i
  %or48.i = or i16 %or47.i, %sub49.i
  %or50.i = or i16 %or48.i, %subi
  %subii = add i16 0, 0
  %subi16.i = add i16 %subii, 0
  %subi17.i = add i16 %subii, 0
  %0 = or i16 %subi16.i, %subi17.i
  %1 = or i16 %0, %or50.i
  ret i16 %1
}