Bug type: crash
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: BoUpSLP::computeMinimumValueSizes
Issue title: [SLPVectorizer] Segmentation Fault using opt "-passes=lto<O3>"
Labels: llvm:SLPVectorizer
crash
Reported by: ewlu

Testcase:
```llvm ir
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

@a = external global i32
@g = internal global i16 -8049
@r = external global [8 x i8]

define internal void @c(i16 %g, ptr %r) #0 {
entry:
  br label %for.cond16.preheader.us.us.us.us

for.cond16.preheader.us.us.us.us:                 ; preds = %for.cond.cleanup20.split.us.us.us.us.us, %entry
  %indvars.iv133 = phi i64 [ %indvars.iv.next134, %for.cond.cleanup20.split.us.us.us.us.us ], [ 0, %entry ]
  br label %for.body21.us.us.us.us.us

for.body21.us.us.us.us.us:                        ; preds = %for.body21.us.us.us.us.us, %for.cond16.preheader.us.us.us.us
  %sub74.us.us.us.us124.us = phi i32 [ 0, %for.cond16.preheader.us.us.us.us ], [ %sub74.us.us.us.us.us, %for.body21.us.us.us.us.us ]
  %w.0109.us.us.us.us.us = phi i16 [ 0, %for.cond16.preheader.us.us.us.us ], [ %add77.us.us.us.us.us, %for.body21.us.us.us.us.us ]
  %idxprom38.us.us.us.us.us = sext i16 %w.0109.us.us.us.us.us to i64
  %arrayidx48.us.us.us.us.us = getelementptr i8, ptr %r, i64 %idxprom38.us.us.us.us.us
  %0 = load i8, ptr %arrayidx48.us.us.us.us.us, align 1
  %loadedv49.us.us.us.us.us = trunc i8 %0 to i1
  %cond71.in.in.v.us.us.us.us.us = select i1 %loadedv49.us.us.us.us.us, i64 %indvars.iv133, i64 0
  %cond71.in.in.us.us.us.us.us = getelementptr i8, ptr %r, i64 %cond71.in.in.v.us.us.us.us.us
  %cond71.in.us.us.us.us.us = load i8, ptr %cond71.in.in.us.us.us.us.us, align 1
  %cmp72.us.us.us.us.us = icmp ule i8 %0, %cond71.in.us.us.us.us.us
  %conv73.neg.us.us.us.us.us = sext i1 %cmp72.us.us.us.us.us to i32
  %sub74.us.us.us.us.us = add i32 %sub74.us.us.us.us124.us, %conv73.neg.us.us.us.us.us
  store i32 %sub74.us.us.us.us124.us, ptr @a, align 4
  %add77.us.us.us.us.us = add i16 %w.0109.us.us.us.us.us, %g
  %cmp18.us.us.us.us.us = icmp slt i16 %add77.us.us.us.us.us, 0
  br i1 %cmp18.us.us.us.us.us, label %for.body21.us.us.us.us.us, label %for.cond.cleanup20.split.us.us.us.us.us

for.cond.cleanup20.split.us.us.us.us.us:          ; preds = %for.body21.us.us.us.us.us
  %indvars.iv.next134 = add i64 %indvars.iv133, 1
  %1 = and i64 %indvars.iv133, 2147483648
  %cmp12.us.us.us.us = icmp eq i64 %1, 0
  br i1 %cmp12.us.us.us.us, label %for.cond16.preheader.us.us.us.us, label %for.cond5.loopexit.split.us.us.us.us

for.cond5.loopexit.split.us.us.us.us:             ; preds = %for.cond.cleanup20.split.us.us.us.us.us
  ret void
}

define i32 @main() {
entry:
  %0 = load i16, ptr @g, align 2
  call void @c(i16 %0, ptr @r)
  ret i32 0
}

attributes #0 = { "target-features"="+64bit,+a,+c,+d,+f,+m,+relax,+v,+zaamo,+zalrsc,+zicsr,+zifencei,+zmmul,+zve32f,+zve32x,+zve64d,+zve64f,+zve64x,+zvl128b,+zvl256b,+zvl32b,+zvl64b,-b,-e,-experimental-sdext,-experimental-sdtrig,-experimental-smctr,-experimental-ssctr,-experimental-svukte,-experimental-xqcia,-experimental-xqciac,-experimental-xqcicli,-experimental-xqcicm,-experimental-xqcics,-experimental-xqcicsr,-experimental-xqciint,-experimental-xqcilo,-experimental-xqcilsm,-experimental-xqcisls,-experimental-zalasr,-experimental-zicfilp,-experimental-zicfiss,-experimental-zvbc32e,-experimental-zvkgs,-h,-sha,-shcounterenw,-shgatpa,-shtvala,-shvsatpa,-shvstvala,-shvstvecd,-smaia,-smcdeleg,-smcsrind,-smdbltrp,-smepmp,-smmpm,-smnpm,-smrnmi,-smstateen,-ssaia,-ssccfg,-ssccptr,-sscofpmf,-sscounterenw,-sscsrind,-ssdbltrp,-ssnpm,-sspm,-ssqosid,-ssstateen,-ssstrict,-sstc,-sstvala,-sstvecd,-ssu64xl,-supm,-svade,-svadu,-svbare,-svinval,-svnapot,-svpbmt,-svvptc,-xcvalu,-xcvbi,-xcvbitmanip,-xcvelw,-xcvmac,-xcvmem,-xcvsimd,-xmipscmove,-xmipslsp,-xsfcease,-xsfvcp,-xsfvfnrclipxfqf,-xsfvfwmaccqqq,-xsfvqmaccdod,-xsfvqmaccqoq,-xsifivecdiscarddlone,-xsifivecflushdlone,-xtheadba,-xtheadbb,-xtheadbs,-xtheadcmo,-xtheadcondmov,-xtheadfmemidx,-xtheadmac,-xtheadmemidx,-xtheadmempair,-xtheadsync,-xtheadvdot,-xventanacondops,-xwchc,-za128rs,-za64rs,-zabha,-zacas,-zama16b,-zawrs,-zba,-zbb,-zbc,-zbkb,-zbkc,-zbkx,-zbs,-zca,-zcb,-zcd,-zce,-zcf,-zcmop,-zcmp,-zcmt,-zdinx,-zfa,-zfbfmin,-zfh,-zfhmin,-zfinx,-zhinx,-zhinxmin,-zic64b,-zicbom,-zicbop,-zicboz,-ziccamoa,-ziccif,-zicclsm,-ziccrse,-zicntr,-zicond,-zihintntl,-zihintpause,-zihpm,-zimop,-zk,-zkn,-zknd,-zkne,-zknh,-zkr,-zks,-zksed,-zksh,-zkt,-ztso,-zvbb,-zvbc,-zvfbfmin,-zvfbfwma,-zvfh,-zvfhmin,-zvkb,-zvkg,-zvkn,-zvknc,-zvkned,-zvkng,-zvknha,-zvknhb,-zvks,-zvksc,-zvksed,-zvksg,-zvksh,-zvkt,-zvl1024b,-zvl16384b,-zvl2048b,-zvl32768b,-zvl4096b,-zvl512b,-zvl65536b,-zvl8192b" }
```


Command/backtrace:
```
$ /scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt "-passes=lto<O3>" reduced.ll
WARNING: You're attempting to print out a bitcode file.
This is inadvisable as it may cause display problems. If
you REALLY want to taste LLVM bitcode first-hand, you
can force output with the `-f' option.

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt -passes=lto<O3> reduced.ll
1.      Running pass "function<eager-inv>(loop-mssa(licm<allowspeculation>),gvn<>,memcpyopt,dse,move-auto-init,mldst-motion<no-split-footer-bb>,loop(indvars,loop-deletion,loop-unroll-full),loop-distribute,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-unroll<O3>,transform-warning,sroa<preserve-cfg>,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,sccp,instcombine<max-iterations=1;no-verify-fixpoint>,bdce,slp-vectorizer,vector-combine,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,jump-threading)" on module "reduced.ll"
2.      Running pass "slp-vectorizer" on function "c"
 #0 0x000064a320d6dd02 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x34a8d02)
 #1 0x000064a320d6ad3f llvm::sys::RunSignalHandlers() (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x34a5d3f)
 #2 0x000064a320d6ae84 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x00007fe3fee45330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
 #4 0x000064a31fc28b80 llvm::slpvectorizer::BoUpSLP::computeMinimumValueSizes()::'lambda1'(llvm::slpvectorizer::BoUpSLP::EdgeInfo const&)::operator()(llvm::slpvectorizer::BoUpSLP::EdgeInfo const&) const (.isra.0) SLPVectorizer.cpp:0:0
 #5 0x000064a31fcdc0bb llvm::slpvectorizer::BoUpSLP::computeMinimumValueSizes() (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x24170bb)
 #6 0x000064a31fcf9808 (anonymous namespace)::HorizontalReduction::tryToReduce(llvm::slpvectorizer::BoUpSLP&, llvm::DataLayout const&, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo const&, llvm::AssumptionCache*) SLPVectorizer.cpp:0:0
 #7 0x000064a31fcfc9ae llvm::SLPVectorizerPass::vectorizeHorReduction(llvm::PHINode*, llvm::Instruction*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::SmallVectorImpl<llvm::WeakTrackingVH>&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x24379ae)
 #8 0x000064a31fd00c41 llvm::SLPVectorizerPass::vectorizeRootInstruction(llvm::PHINode*, llvm::Instruction*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x243bc41)
 #9 0x000064a31fd04e32 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x243fe32)
#10 0x000064a31fd0c6e0 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x24476e0)
#11 0x000064a31fd0d336 llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x2448336)
#12 0x000064a31e87b285 llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0xfb6285)
#13 0x000064a320b5976a llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x329476a)
#14 0x000064a31e87d0d5 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0xfb80d5)
#15 0x000064a320b5807c llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x329307c)
#16 0x000064a31e879675 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0xfb4675)
#17 0x000064a320b5865d llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x329365d)
#18 0x000064a31e01d465 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x758465)
#19 0x000064a31e00d6ee optMain (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x7486ee)
#20 0x00007fe3fee2a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#21 0x00007fe3fee2a28b call_init ./csu/../csu/libc-start.c:128:20
#22 0x00007fe3fee2a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#23 0x000064a31e003f45 _start (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x73ef45)
Segmentation fault (core dumped)
```

Godbolt: https://godbolt.org/z/P3sGYsGYc

Found via fuzzer (C program before reduction)


Fix patch:
commit d18b1ebef5f5e355d6cee2b2f48789a159a5d616
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Thu Feb 13 09:39:56 2025 -0800

    [SLP]Check if vector user exist before accessing it
    
    Need to check if vector user exist before accessing it to avoid compiler
    crash.
    Fixes #126581

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index a337ab7410f7..fb72a112b9ac 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -18467,8 +18467,8 @@ void BoUpSLP::computeMinimumValueSizes() {
           any_of(
               VectorizableTree[NodeIdx]->UserTreeIndices,
               [&](const EdgeInfo &EI) {
-                return (EI.UserTE->hasState() &&
-                        EI.UserTE->getOpcode() == Instruction::ICmp) &&
+                return EI.UserTE && EI.UserTE->hasState() &&
+                       EI.UserTE->getOpcode() == Instruction::ICmp &&
                        any_of(EI.UserTE->Scalars, [&](Value *V) {
                          auto *IC = dyn_cast<ICmpInst>(V);
                          return IC &&


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/RISCV/check-node-without-vector-user.ll
commands: opt -S --passes=slp-vectorizer -mtriple=riscv64-unknown-linux-gnu -mattr=+v < %s
tests: test_name: <module>
test_body: 
@r = external global [8 x i8]

define void @test(i64 %0, ptr %1) {
;
  %3 = load i8, ptr @r, align 1
  %4 = trunc i8 %3 to i1
  %5 = select i1 %4, i64 %0, i64 0
  %6 = getelementptr i8, ptr @r, i64 %5
  %7 = load i8, ptr %6, align 1
  %8 = icmp ule i8 %3, %7
  %9 = sext i1 %8 to i32
  %10 = load i8, ptr getelementptr (i8, ptr @r, i64 -8049), align 1
  %11 = trunc i8 %10 to i1
  %12 = select i1 %11, i64 %0, i64 0
  %13 = getelementptr i8, ptr @r, i64 %12
  %14 = load i8, ptr %13, align 1
  %15 = icmp ule i8 %10, %14
  %16 = sext i1 %15 to i32
  %17 = add i32 %9, %16
  %18 = load i8, ptr getelementptr (i8, ptr @r, i64 -16098), align 1
  %19 = trunc i8 %18 to i1
  %20 = select i1 %19, i64 %0, i64 0
  %21 = getelementptr i8, ptr @r, i64 %20
  %22 = load i8, ptr %21, align 1
  %23 = icmp ule i8 %18, %22
  %24 = sext i1 %23 to i32
  %25 = add i32 %17, %24
  %26 = load i8, ptr getelementptr (i8, ptr @r, i64 -24147), align 1
  %27 = trunc i8 %26 to i1
  %28 = select i1 %27, i64 %0, i64 0
  %29 = getelementptr i8, ptr @r, i64 %28
  %30 = load i8, ptr %29, align 1
  %31 = icmp ule i8 %26, %30
  %32 = sext i1 %31 to i32
  %33 = add i32 %25, %32
  store i32 %33, ptr %1, align 4
  ret void
}