Bug type: crash
Component: LoopVectorize
Bug location: llvm/lib/Transforms/Vectorize/LoopVectorize.cpp: LoopVectorizationCostModel::getDivRemSpeculationCost
LoopVectorizationCostModel::interleavedAccessCanBeWidened
Issue title: Assertion `(BestFactor.Width == LegacyVF.Width || BestPlan.hasEarlyExit() || planContainsAdditionalSimplifications(getPlanFor(BestFactor.Width), CostCtx, OrigLoop, BestFactor.Width) || ....) && " VPlan cost model and legacy cost model disagreed"' failed.
Labels: vectorizers
crash
Reported by: TatyanaDoubts

```
Assertion `(BestFactor.Width == LegacyVF.Width || BestPlan.hasEarlyExit() || planContainsAdditionalSimplifications(getPlanFor(BestFactor.Width), CostCtx, OrigLoop, BestFactor.Width) || planContainsAdditionalSimplifications( getPlanFor(LegacyVF.Width), CostCtx, OrigLoop, LegacyVF.Width)) && " VPlan cost model and legacy cost model disagreed"' failed.
```
To reproduce run opt with the test below, -passes=loop-vectorize.
```
; ModuleID = './reduced.ll'
source_filename = "./reduced.ll"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128-ni:1-p2:32:8:8:32-ni:2"
target triple = "x86_64-unknown-linux-gnu"

define void @wombat(ptr addrspace(1) %arg) #0 gc "statepoint-example" {
bb:
  br label %bb1

bb1:                                              ; preds = %bb3, %bb
  %phi = phi i64 [ %add, %bb3 ], [ 0, %bb ]
  %load = load i32, ptr addrspace(1) %arg, align 4
  %icmp = icmp eq i32 %load, 0
  br i1 %icmp, label %bb3, label %bb2

bb2:                                              ; preds = %bb1
  %sdiv = sdiv i32 0, 0
  br label %bb3

bb3:                                              ; preds = %bb2, %bb1
  %phi4 = phi i32 [ %sdiv, %bb2 ], [ 0, %bb1 ]
  store i32 %phi4, ptr addrspace(1) null, align 4
  %add = add i64 %phi, 1
  %icmp5 = icmp ult i64 %phi, 7208
  br i1 %icmp5, label %bb1, label %bb6

bb6:                                              ; preds = %bb3
  ret void
}

attributes #0 = { "target-features"="+prfchw,-cldemote,+avx,+aes,+sahf,+pclmul,-xop,+crc32,-amx-fp8,+xsaves,-avx512fp16,-usermsr,-sm4,-egpr,+sse4.1,-avx512ifma,+xsave,+sse4.2,-tsxldtrk,-sm3,-ptwrite,-widekl,-movrs,+invpcid,+64bit,+xsavec,-avx10.1-512,-avx512vpopcntdq,+cmov,-avx512vp2intersect,+avx512cd,+movbe,-avxvnniint8,-ccmp,-amx-int8,-kl,-avx10.1-256,+evex512,-avxvnni,+rtm,+adx,+avx2,-hreset,-movdiri,-serialize,-sha512,-vpclmulqdq,+avx512vl,-uintr,-cf,+clflushopt,-raoint,-cmpccxadd,+bmi,-amx-tile,+sse,-avx10.2-256,-gfni,-avxvnniint16,-amx-fp16,-zu,-ndd,+xsaveopt,+rdrnd,+avx512f,-amx-bf16,-avx512bf16,-avx512vnni,-push2pop2,+cx8,+avx512bw,+sse3,+pku,-nf,-amx-tf32,-amx-avx512,+fsgsbase,-clzero,-mwaitx,-lwp,+lzcnt,-sha,-movdir64b,-ppx,-wbnoinvd,-enqcmd,-amx-transpose,-avx10.2-512,-avxneconvert,-tbm,-pconfig,-amx-complex,+ssse3,+cx16,+bmi2,+fma,+popcnt,-avxifma,+f16c,-avx512bitalg,-rdpru,+clwb,+mmx,+sse2,+rdseed,-avx512vbmi2,-prefetchi,-amx-movrs,-rdpid,-fma4,-avx512vbmi,-shstk,-vaes,-waitpkg,-sgx,+fxsr,+avx512dq,-sse4a,-avx512f" }

```
Reproducer: https://godbolt.org/z/zqeKesnbr

Stack dump:
```
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=loop-vectorize <source>
1.	Running pass "function(loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>)" on module "<source>"
2.	Running pass "loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>" on function "wombat"
 #0 0x00000000056cf178 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x56cf178)
 #1 0x00000000056cc024 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x000079efe3442520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x000079efe34969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x000079efe3442476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x000079efe34287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x000079efe342871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x000079efe3439e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x00000000034f7baa llvm::LoopVectorizationPlanner::computeBestVF() (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x34f7baa)
 #9 0x00000000034faead llvm::LoopVectorizePass::processLoop(llvm::Loop*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x34faead)
#10 0x00000000034fe190 llvm::LoopVectorizePass::runImpl(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x34fe190)
#11 0x00000000034fe7f7 llvm::LoopVectorizePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x34fe7f7)
#12 0x0000000002e0715e llvm::detail::PassModel<llvm::Function, llvm::LoopVectorizePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2e0715e)
#13 0x00000000054be5e1 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x54be5e1)
#14 0x0000000000edd4be llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xedd4be)
#15 0x00000000054bce3a llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x54bce3a)
#16 0x000000000096fcbe llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x96fcbe)
#17 0x00000000054bafd1 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x54bafd1)
#18 0x0000000000979f45 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x979f45)
#19 0x000000000096e027 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x96e027)
#20 0x000079efe3429d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#21 0x000079efe3429e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#22 0x0000000000965145 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x965145)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

Comments: author: fhahn
body: @TatyanaDoubts did the original input also have a `sdiv i32 0, 0` or non-constant operands? If so, would be great if you could also share this one

Fix patch:
commit e0f00bd645bfd75a6717242cc42d63eeebb1db68
Author: Florian Hahn <flo@fhahn.com>
Date:   Sat Sep 6 14:03:42 2025 +0100

    [LV] Don't consider second op as invariant in getDivRemSpeculationCost.
    
    The second operand when using a safe divisor will always be a select in
    the loop, so won't be invariant; don't treat it as such.
    
    This fixes a divergence with legacy and VPlan based cost model.
    
    Fixes https://github.com/llvm/llvm-project/issues/156066.

diff --git a/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp b/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
index 5a1d1e75e2d5..88e477e2dc64 100644
--- a/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
+++ b/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
@@ -2910,19 +2910,12 @@ LoopVectorizationCostModel::getDivRemSpeculationCost(Instruction *I,
                              toVectorTy(Type::getInt1Ty(I->getContext()), VF),
                              CmpInst::BAD_ICMP_PREDICATE, CostKind);
 
-  // Certain instructions can be cheaper to vectorize if they have a constant
-  // second vector operand. One example of this are shifts on x86.
-  Value *Op2 = I->getOperand(1);
-  auto Op2Info = TTI.getOperandInfo(Op2);
-  if (Op2Info.Kind == TargetTransformInfo::OK_AnyValue &&
-      Legal->isInvariant(Op2))
-    Op2Info.Kind = TargetTransformInfo::OK_UniformValue;
-
   SmallVector<const Value *, 4> Operands(I->operand_values());
   SafeDivisorCost += TTI.getArithmeticInstrCost(
-    I->getOpcode(), VecTy, CostKind,
-    {TargetTransformInfo::OK_AnyValue, TargetTransformInfo::OP_None},
-    Op2Info, Operands, I);
+      I->getOpcode(), VecTy, CostKind,
+      {TargetTransformInfo::OK_AnyValue, TargetTransformInfo::OP_None},
+      {TargetTransformInfo::OK_AnyValue, TargetTransformInfo::OP_None},
+      Operands, I);
   return {ScalarizationCost, SafeDivisorCost};
 }
 


Regression tests:
file: llvm/test/Transforms/LoopVectorize/X86/cost-conditional-branches.ll
commands: opt < %s -passes=loop-vectorize -mtriple=x86_64-apple-macosx10.8.0 -mcpu=corei7-avx -S
tests: test_name: sdiv_by_zero
test_body: target triple = "x86_64-apple-macosx10.8.0"

define void @sdiv_by_zero(ptr noalias %src, ptr noalias %dst, i32 %d) #0 {
bb:
  br label %loop.header

loop.header:                                      ; preds = %loop.latch, %bb
  %iv = phi i64 [ %iv.next, %loop.latch ], [ 0, %bb ]
  %gep.src = getelementptr inbounds i32, ptr %src, i64 %iv
  %l = load i32, ptr %gep.src, align 4
  %icmp = icmp eq i32 %l, 0
  br i1 %icmp, label %loop.latch, label %then

then:                                             ; preds = %loop.header
  %sdiv = sdiv i32 %l, 0
  br label %loop.latch

loop.latch:                                       ; preds = %then, %loop.header
  %merge = phi i32 [ %sdiv, %then ], [ 0, %loop.header ]
  %gep.dst = getelementptr inbounds i32, ptr %dst, i64 %iv
  store i32 %merge, ptr %gep.dst, align 4
  %iv.next = add i64 %iv, 1
  %ec = icmp ult i64 %iv, 16
  br i1 %ec, label %loop.header, label %exit

exit:                                             ; preds = %loop.latch
  ret void
}

attributes #0 = { "target-cpu"="znver3" }