Bug type: crash
Component: InstCombine
Bug location: llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp: InstCombinerImpl::SimplifyDemandedUseBits
Issue title: Segfault when building https://github.com/ivmai/bdwgc@4fe4238
Labels: llvm:instcombine
crash-on-valid
Reported by: d125q

Attempting to build [https://github.com/ivmai/bdwgc@4fe4238](https://github.com/ivmai/bdwgc/tree/4fe42389509ff059bad8d4c955a570b34a6bda4b) using
```shell
$ ./autogen.sh
$ ./configure --with-libatomic-ops --enable-cplusplus --enable-large-config
$ make
```
results in
```text
libtool: compile:  clang -std=gnu23 -DHAVE_CONFIG_H -I./include -I./include -DNDEBUG -fexceptions -DGC_VISIBILITY_HIDDEN_SET -fvisibility=hidden -Wall -Wextra -Wpedantic -Wno-long-long -O2 -march=native -Wno-frame-address -MT extra/gc.lo -MD -MP -MF extra/.deps/gc.Tpo -c extra/gc.c  -fno-common -DPIC -o extra/.libs/gc.o
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: clang -std=gnu23 -DHAVE_CONFIG_H -I./include -I./include -DNDEBUG -fexceptions -DGC_VISIBILITY_HIDDEN_SET -fvisibility=hidden -Wall -Wextra -Wpedantic -Wno-long-long -O2 -march=native -Wno-frame-address -MT extra/gc.lo -MD -MP -MF extra/.deps/gc.Tpo -c extra/gc.c -fno-common -DPIC -o extra/.libs/gc.o
1.	<eof> parser at end of file
2.	Optimizer
3.	Running pass "require<globals-aa>,function(invalidate<aa>),require<profile-summary>,cgscc(devirt<4>(inline,function-attrs<skip-non-recursive-function-attrs>,openmp-opt-cgscc,function<eager-inv;no-rerun>(sroa<modify-cfg>,early-cse<memssa>,speculative-execution<only-if-divergent-target>,jump-threading,correlated-propagation,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm<no-allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<no-nontrivial;trivial>),simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,loop(loop-idiom,indvars,simple-loop-unswitch<no-nontrivial;trivial>,loop-deletion,loop-unroll-full),sroa<modify-cfg>,vector-combine,mldst-motion<no-split-footer-bb>,gvn<>,sccp,bdce,instcombine<max-iterations=1;no-verify-fixpoint>,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm<allowspeculation>),coro-elide,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>),function-attrs,function(require<should-not-run-function-passes>),coro-split,coro-annotation-elide)),function(invalidate<should-not-run-function-passes>),cgscc(devirt<4>())" on module "extra/gc.c"
4.	Running pass "cgscc(devirt<4>(inline,function-attrs<skip-non-recursive-function-attrs>,openmp-opt-cgscc,function<eager-inv;no-rerun>(sroa<modify-cfg>,early-cse<memssa>,speculative-execution<only-if-divergent-target>,jump-threading,correlated-propagation,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm<no-allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<no-nontrivial;trivial>),simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>,loop(loop-idiom,indvars,simple-loop-unswitch<no-nontrivial;trivial>,loop-deletion,loop-unroll-full),sroa<modify-cfg>,vector-combine,mldst-motion<no-split-footer-bb>,gvn<>,sccp,bdce,instcombine<max-iterations=1;no-verify-fixpoint>,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm<allowspeculation>),coro-elide,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,instcombine<max-iterations=1;no-verify-fixpoint>),function-attrs,function(require<should-not-run-function-passes>),coro-split,coro-annotation-elide))" on module "extra/gc.c"
5.	Running pass "instcombine<max-iterations=1;no-verify-fixpoint>" on function "GC_push_finalizer_structures"
 #0 0x0000000112ecda98 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x3299a98)
 #1 0x0000000112eccb47 llvm::sys::RunSignalHandlers() (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x3298b47)
 #2 0x0000000112eccde1 llvm::sys::CleanupOnSignal(unsigned long) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x3298de1)
 #3 0x0000000112df2644 CrashRecoverySignalHandler(int) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x31be644)
 #4 0x00007ff81abe4fdd (/usr/lib/system/libsystem_platform.dylib+0x7ff80046afdd)
 #5 0x0000000112e1d131 computeForAddCarry(llvm::KnownBits const&, llvm::KnownBits const&, bool, bool) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x31e9131)
 #6 0x0000000112318cdd llvm::TargetFolder::FoldGEP(llvm::Type*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::GEPNoWrapFlags) const (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x26e4cdd)
 #7 0x00000001102d2177 llvm::IRBuilderBase::CreateGEP(llvm::Type*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::Twine const&, llvm::GEPNoWrapFlags) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x69e177)
 #8 0x000000011209545a llvm::InstCombinerImpl::SimplifyDemandedUseBits(llvm::Instruction*, llvm::APInt const&, llvm::KnownBits&, unsigned int, llvm::SimplifyQuery const&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x246145a)
 #9 0x0000000112097524 llvm::InstCombinerImpl::SimplifyDemandedInstructionBits(llvm::Instruction&, llvm::KnownBits&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x2463524)
#10 0x0000000111ffc58b llvm::InstCombinerImpl::visitCallInst(llvm::CallInst&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x23c858b)
#11 0x0000000111f85788 llvm::InstCombinerImpl::run() (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x2351788)
#12 0x0000000111f765e2 combineInstructionsOverFunction(llvm::Function&, llvm::InstructionWorklist&, llvm::AAResults*, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::TargetTransformInfo&, llvm::DominatorTree&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::BranchProbabilityInfo*, llvm::ProfileSummaryInfo*, llvm::InstCombineOptions const&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x23425e2)
#13 0x0000000111fc1b85 llvm::InstCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x238db85)
#14 0x0000000110596272 llvm::detail::PassModel<llvm::Function, llvm::InstCombinePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x962272)
#15 0x0000000112b6736a llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x2f3336a)
#16 0x000000011003f522 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x40b522)
#17 0x00000001122fe7db llvm::CGSCCToFunctionPassAdaptor::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x26ca7db)
#18 0x0000000110b41712 llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::CGSCCToFunctionPassAdaptor, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0xf0d712)
#19 0x00000001122fa573 llvm::PassManager<llvm::LazyCallGraph::SCC, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x26c6573)
#20 0x0000000110b3e332 llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::PassManager<llvm::LazyCallGraph::SCC, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0xf0a332)
#21 0x00000001122fcc0e llvm::DevirtSCCRepeatedPass::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x26c8c0e)
#22 0x0000000110b413a2 llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::DevirtSCCRepeatedPass, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0xf0d3a2)
#23 0x00000001122fbe83 llvm::ModuleToPostOrderCGSCCPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x26c7e83)
#24 0x0000000110b3e012 llvm::detail::PassModel<llvm::Module, llvm::ModuleToPostOrderCGSCCPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0xf0a012)
#25 0x0000000112b65a22 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x2f31a22)
#26 0x0000000110d25d8b llvm::ModuleInlinerWrapperPass::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x10f1d8b)
#27 0x0000000110594012 llvm::detail::PassModel<llvm::Module, llvm::ModuleInlinerWrapperPass, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x960012)
#28 0x0000000112b65a22 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x2f31a22)
#29 0x000000010788b478 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::__1::unique_ptr<llvm::raw_pwrite_stream, std::__1::default_delete<llvm::raw_pwrite_stream>>&, std::__1::unique_ptr<llvm::ToolOutputFile, std::__1::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) (/opt/llvm-project@HEAD/lib/libclang-cpp.dylib+0x172d478)
#30 0x0000000107883b08 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::__1::unique_ptr<llvm::raw_pwrite_stream, std::__1::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/opt/llvm-project@HEAD/lib/libclang-cpp.dylib+0x1725b08)
#31 0x0000000107d037d3 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/opt/llvm-project@HEAD/lib/libclang-cpp.dylib+0x1ba57d3)
#32 0x000000010635df1d clang::ParseAST(clang::Sema&, bool, bool) (/opt/llvm-project@HEAD/lib/libclang-cpp.dylib+0x1fff1d)
#33 0x000000010877f3d7 clang::FrontendAction::Execute() (/opt/llvm-project@HEAD/lib/libclang-cpp.dylib+0x26213d7)
#34 0x00000001086e0500 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/llvm-project@HEAD/lib/libclang-cpp.dylib+0x2582500)
#35 0x00000001087f60e9 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/llvm-project@HEAD/lib/libclang-cpp.dylib+0x26980e9)
#36 0x000000010128d4f9 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/llvm-project@HEAD/bin/clang-20+0x1000084f9)
#37 0x0000000101289f88 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) (/opt/llvm-project@HEAD/bin/clang-20+0x100004f88)
#38 0x00000001082b552e void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::__1::optional<llvm::StringRef>>, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>*, bool*) const::$_0>(long) (/opt/llvm-project@HEAD/lib/libclang-cpp.dylib+0x215752e)
#39 0x0000000112df288c llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/llvm-project@HEAD/lib/libLLVM.dylib+0x31be88c)
#40 0x00000001082b5431 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::__1::optional<llvm::StringRef>>, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>*, bool*) const (/opt/llvm-project@HEAD/lib/libclang-cpp.dylib+0x2157431)
#41 0x0000000108262131 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/llvm-project@HEAD/lib/libclang-cpp.dylib+0x2104131)
#42 0x00000001082623bf clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::__1::pair<int, clang::driver::Command const*>>&, bool) const (/opt/llvm-project@HEAD/lib/libclang-cpp.dylib+0x21043bf)
#43 0x00000001082b00c0 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::__1::pair<int, clang::driver::Command const*>>&) (/opt/llvm-project@HEAD/lib/libclang-cpp.dylib+0x21520c0)
#44 0x00000001012892b3 clang_main(int, char**, llvm::ToolContext const&) (/opt/llvm-project@HEAD/bin/clang-20+0x1000042b3)
#45 0x00000001012984cb main (/opt/llvm-project@HEAD/bin/clang-20+0x1000134cb)
#46 0x00007ff81a82a345 
clang: error: clang frontend command failed with exit code 139 (use -v to see invocation)
clang version 20.0.0git (https://github.com/llvm/llvm-project.git c25c6c32494c8d1038438b6208d42ba40f25270e)
Target: x86_64-apple-darwin23.6.0
Thread model: posix
InstalledDir: /opt/llvm-project@HEAD/bin
clang: note: diagnostic msg: 
********************
```

Find attached the preprocessed source code at [gc-add69e.c.gz](https://github.com/user-attachments/files/17813033/gc-add69e.c.gz).

Comments: author: dtcxzyw
body: Reproducer: https://godbolt.org/z/Ts478aen6
```
; bin/opt -passes=instcombine test.ll -S
@GC_arrays = external global { i8, i8, i64 }

define ptr @GC_push_finalizer_structures() {
entry:
  %aligned_result.i = call ptr @llvm.ptrmask.p0.i64(ptr getelementptr inbounds (i8, ptr @GC_arrays, i64 1), i64 -8)
  ret ptr %aligned_result.i
}
```
```
opt: /root/llvm-project/llvm/include/llvm/Support/Casting.h:578: decltype(auto) llvm::cast(From*) [with To = llvm::GetElementPtrInst; From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=instcombine <source>
1.	Running pass "function(instcombine<max-iterations=1;verify-fixpoint>)" on module "<source>"
2.	Running pass "instcombine<max-iterations=1;verify-fixpoint>" on function "GC_push_finalizer_structures"
 #0 0x0000000005194b38 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5194b38)
 #1 0x000000000519252c SignalHandler(int) Signals.cpp:0:0
 #2 0x000074b7d8442520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x000074b7d84969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x000074b7d8442476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x000074b7d84287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x000074b7d842871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x000074b7d8439e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x00000000040d9310 decltype(auto) llvm::cast<llvm::GetElementPtrInst, llvm::Value>(llvm::Value*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x40d9310)
 #9 0x00000000040e2f9e llvm::InstCombinerImpl::SimplifyDemandedUseBits(llvm::Instruction*, llvm::APInt const&, llvm::KnownBits&, unsigned int, llvm::SimplifyQuery const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x40e2f9e)
#10 0x00000000040e6082 llvm::InstCombinerImpl::SimplifyDemandedInstructionBits(llvm::Instruction&, llvm::KnownBits&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x40e6082)
#11 0x00000000040355a6 llvm::InstCombinerImpl::visitCallInst(llvm::CallInst&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x40355a6)
#12 0x0000000003fe2311 llvm::InstCombinerImpl::run() (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3fe2311)
#13 0x0000000003fe3cc6 combineInstructionsOverFunction(llvm::Function&, llvm::InstructionWorklist&, llvm::AAResults*, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::TargetTransformInfo&, llvm::DominatorTree&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::BranchProbabilityInfo*, llvm::ProfileSummaryInfo*, llvm::InstCombineOptions const&) (.isra.0) InstructionCombining.cpp:0:0
#14 0x0000000003fe504e llvm::InstCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3fe504e)
#15 0x0000000002c5c24e llvm::detail::PassModel<llvm::Function, llvm::InstCombinePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2c5c24e)
#16 0x0000000004f949e8 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4f949e8)
#17 0x0000000000e4027e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe4027e)
#18 0x0000000004f9340e llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4f9340e)
#19 0x0000000000e3f92e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe3f92e)
#20 0x0000000004f92e40 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4f92e40)
#21 0x0000000000909fda llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x909fda)
#22 0x00000000008fc70a optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x8fc70a)
#23 0x000074b7d8429d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#24 0x000074b7d8429e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#25 0x00000000008f3e9e _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x8f3e9e)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

Fix patch:
commit 03d8831fa8ef5b7e32172c718b550a454645faea
Author: Yingwei Zheng <dtcxzyw2333@gmail.com>
Date:   Tue Nov 19 22:17:24 2024 +0800

    [InstCombine] Handle constant GEP expr in `SimplifyDemandedUseBits` (#116794)
    
    Closes https://github.com/llvm/llvm-project/issues/116775.

diff --git a/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp b/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp
index 5eb807dcb76c..392c5c78345c 100644
--- a/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp
@@ -997,7 +997,7 @@ Value *InstCombinerImpl::SimplifyDemandedUseBits(Instruction *I,
             uint64_t MaskedGEPIndex = HighBitsGEPIndex | MaskedLowBitsGEPIndex;
 
             if (MaskedGEPIndex != GEPIndex) {
-              auto *GEP = cast<GetElementPtrInst>(II->getArgOperand(0));
+              auto *GEP = cast<GEPOperator>(II->getArgOperand(0));
               Builder.SetInsertPoint(I);
               Type *GEPIndexType =
                   DL.getIndexType(GEP->getPointerOperand()->getType());


Regression tests:
file: llvm/test/Transforms/InstCombine/ptrmask.ll
commands: opt < %s -passes=instcombine -S
tests: test_name: ptrmask_demandedbits_constantexpr
test_body: target datalayout = "p1:64:64:64:32"

@GC_arrays = external global { i8, i8, i64 }

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare ptr @llvm.ptrmask.p0.i64(ptr, i64) #0

define ptr @ptrmask_demandedbits_constantexpr() {
entry:
  %aligned_result = call ptr @llvm.ptrmask.p0.i64(ptr getelementptr inbounds (i8, ptr @GC_arrays, i64 1), i64 -8)
  ret ptr %aligned_result
}

attributes #0 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }

test_name: ptrmask_is_useless_fail1
test_body: target datalayout = "p1:64:64:64:32"

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare ptr @llvm.ptrmask.p0.i64(ptr, i64) #0

define ptr @ptrmask_is_useless_fail1(i64 %i, i64 %m) {
  %m0 = and i64 %m, 127
  %i0 = and i64 %i, 511
  %p0 = inttoptr i64 %i0 to ptr
  %r = call ptr @llvm.ptrmask.p0.i64(ptr %p0, i64 %m0)
  ret ptr %r
}

attributes #0 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }