Bug type: crash
Component: Scalarizer
Bug location: llvm/lib/Transforms/Scalar/Scalarizer.cpp: ScalarizerVisitor::visitExtractElementInst
Issue title: [opt] -passes=scalarizer causes Assertion `idx < size()'
Labels: crash
llvm:transforms
Reported by: fraglantia

Reproducer: https://godbolt.org/z/MhnqEWPs9

```
opt: /root/llvm-project/llvm/include/llvm/ADT/SmallVector.h:297: T& llvm::SmallVectorTemplateCommon<T, <template-parameter-1-2> >::operator[](llvm::SmallVectorTemplateCommon<T, <template-parameter-1-2> >::size_type) [with T = llvm::Value*; <template-parameter-1-2> = void; llvm::SmallVectorTemplateCommon<T, <template-parameter-1-2> >::reference = llvm::Value*&; llvm::SmallVectorTemplateCommon<T, <template-parameter-1-2> >::size_type = long unsigned int]: Assertion `idx < size()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S --passes=module(cgscc(function(scalarizer))) <source>
1.	Running pass "cgscc(function(scalarizer))" on module "<source>"
2.	Running pass "scalarizer" on function "f13"
 #0 0x0000000005aefe98 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5aefe98)
 #1 0x0000000005aecd74 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x0000704cdba42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x0000704cdba969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x0000704cdba42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x0000704cdba287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x0000704cdba2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x0000704cdba39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x0000000004950030 (anonymous namespace)::Scatterer::operator[](unsigned int) Scalarizer.cpp:0:0
 #9 0x00000000049543e8 (anonymous namespace)::ScalarizerVisitor::visitExtractElementInst(llvm::ExtractElementInst&) Scalarizer.cpp:0:0
#10 0x0000000004957ea2 (anonymous namespace)::ScalarizerVisitor::visit(llvm::Function&) (.constprop.0) Scalarizer.cpp:0:0
#11 0x00000000049597ff llvm::ScalarizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x49597ff)
#12 0x000000000305920e llvm::detail::PassModel<llvm::Function, llvm::ScalarizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x305920e)
#13 0x00000000058604a1 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x58604a1)
#14 0x0000000000f0ce4e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xf0ce4e)
#15 0x0000000004e6c3c2 llvm::CGSCCToFunctionPassAdaptor::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4e6c3c2)
#16 0x0000000000f0bbae llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::CGSCCToFunctionPassAdaptor, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xf0bbae)
#17 0x0000000004e64bf2 llvm::PassManager<llvm::LazyCallGraph::SCC, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4e64bf2)
#18 0x0000000003058f2e llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::PassManager<llvm::LazyCallGraph::SCC, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3058f2e)
#19 0x0000000004e66571 llvm::ModuleToPostOrderCGSCCPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4e66571)
#20 0x0000000000f0bb8e llvm::detail::PassModel<llvm::Module, llvm::ModuleToPostOrderCGSCCPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xf0bb8e)
#21 0x000000000585e411 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x585e411)
#22 0x0000000000971fba llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x971fba)
#23 0x0000000000966068 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x966068)
#24 0x0000704cdba29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#25 0x0000704cdba29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#26 0x000000000095cce5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x95cce5)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

Possible duplicate of #126938

Comments: author: bala-bhargav
body: @fraglantia 
can i work on it ??

Fix patch:
commit 6e0054aa512aaa29cc04788291bbf3b4dfcbd2b3
Author: bala-bhargav <penugondabalabharghav@gmail.com>
Date:   Sat Feb 21 23:25:30 2026 +0530

    [Scalarizer] Fix out-of-bounds crash (#180359)
    
    When processing an extractelement instruction with an index that exceeds
    the vector size (e.g., extracting index 2147483647 from a 4-element
    vector), the scalarizer would calculate an out-of-bounds Fragment index
    and crash with an assertion failure in `SmallVector::operator[]`.
    
    This PR adds a bounds check in
    `ScalarizerVisitor::visitExtractElementInst` to prevent a crash when the
    extractelement index is out of bounds.
    
    Fixes #179880

diff --git a/llvm/lib/Transforms/Scalar/Scalarizer.cpp b/llvm/lib/Transforms/Scalar/Scalarizer.cpp
index 46f92c3de04d..0ef8e5790b7f 100644
--- a/llvm/lib/Transforms/Scalar/Scalarizer.cpp
+++ b/llvm/lib/Transforms/Scalar/Scalarizer.cpp
@@ -1133,6 +1133,8 @@ bool ScalarizerVisitor::visitExtractElementInst(ExtractElementInst &EEI) {
 
   if (auto *CI = dyn_cast<ConstantInt>(ExtIdx)) {
     unsigned Idx = CI->getZExtValue();
+    if (Idx >= VS->VecTy->getNumElements())
+      return false;
     unsigned Fragment = Idx / VS->NumPacked;
     Value *Res = Op0[Fragment];
     bool IsPacked = VS->NumPacked > 1;


Regression tests:
file: llvm/test/Transforms/Scalarizer/constant-extractelement.ll
commands: opt %s -passes='function(scalarizer<load-store>,dce)' -S
tests: test_name: oob_extract
test_body: target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"

define ptr @oob_extract() {
  %E = extractelement <4 x ptr> zeroinitializer, i32 100
  ret ptr %E
}

test_name: f1
test_body: target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"

define i32 @f1(ptr %src, i32 %index) {
  %val0 = load <4 x i32>, ptr %src, align 16
  %val1 = shl <4 x i32> <i32 1, i32 2, i32 3, i32 4>, %val0
  %val2 = extractelement <4 x i32> %val1, i32 3
  ret i32 %val2
}