Bug type: crash
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: BoUpSLP::collectValuesToDemote
Issue title: [SLPVectorizer] Assertion `castIsValid(op, S, Ty) && "Invalid cast!"' failed.
Labels: llvm:SLPVectorizer
crash-on-valid
generated by fuzzer
Reported by: dtcxzyw

Reproducer: https://godbolt.org/z/YMb7ovEoc
```
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define i1 @main(i32 %0) {
entry:
  %conv22.i.i = sext i32 %0 to i64
  %1 = bitcast i64 %conv22.i.i to double
  %2 = fadd double %1, 0.000000e+00
  %add.i.i.i = select i1 false, double 0.000000e+00, double %2
  %3 = bitcast double %add.i.i.i to i64
  %cmp3998.i.i = icmp ne i64 %3, %conv22.i.i
  %conv22.1.i.i = sext i32 0 to i64
  %4 = bitcast i64 %conv22.1.i.i to double
  %5 = fadd double %4, 0.000000e+00
  %add.i.1.i.i = select i1 false, double 0.000000e+00, double %5
  %6 = bitcast double %add.i.1.i.i to i64
  %cmp3998.1.i.i = icmp ne i64 %6, %conv22.1.i.i
  ret i1 %cmp3998.1.i.i
}
```
```
opt: /root/llvm-project/llvm/lib/IR/Instructions.cpp:3041: static llvm::CastInst* llvm::CastInst::Create(llvm::Instruction::CastOps, llvm::Value*, llvm::Type*, const llvm::Twine&, llvm::InsertPosition): Assertion `castIsValid(op, S, Ty) && "Invalid cast!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=slp-vectorizer <source>
1.	Running pass "function(slp-vectorizer)" on module "<source>"
2.	Running pass "slp-vectorizer" on function "main"
 #0 0x00000000057a4688 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x57a4688)
 #1 0x00000000057a1534 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007338d1c42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007338d1c969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x00007338d1c42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x00007338d1c287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x00007338d1c2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x00007338d1c39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x0000000005504776 (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5504776)
 #9 0x0000000000baea43 llvm::IRBuilderBase::CreateCast(llvm::Instruction::CastOps, llvm::Value*, llvm::Type*, llvm::Twine const&, llvm::MDNode*, llvm::FMFSource) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xbaea43)
#10 0x00000000035f04d1 llvm::slpvectorizer::BoUpSLP::vectorizeTree(llvm::slpvectorizer::BoUpSLP::TreeEntry*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35f04d1)
#11 0x00000000035edb63 llvm::slpvectorizer::BoUpSLP::vectorizeTree(llvm::slpvectorizer::BoUpSLP::TreeEntry*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35edb63)
#12 0x00000000035ee647 llvm::slpvectorizer::BoUpSLP::vectorizeTree(llvm::slpvectorizer::BoUpSLP::TreeEntry*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35ee647)
#13 0x00000000035edddc llvm::slpvectorizer::BoUpSLP::vectorizeTree(llvm::slpvectorizer::BoUpSLP::TreeEntry*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35edddc)
#14 0x00000000035edec5 llvm::slpvectorizer::BoUpSLP::vectorizeTree(llvm::slpvectorizer::BoUpSLP::TreeEntry*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35edec5)
#15 0x0000000003624cc4 llvm::slpvectorizer::BoUpSLP::vectorizeTree(llvm::SmallDenseSet<llvm::Value*, 4u, llvm::DenseMapInfo<llvm::Value*, void>> const&, llvm::Instruction*, llvm::ArrayRef<std::tuple<llvm::Value*, unsigned int, bool>>) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3624cc4)
#16 0x0000000003628d42 llvm::slpvectorizer::BoUpSLP::vectorizeTree() (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3628d42)
#17 0x000000000364a4e5 llvm::SLPVectorizerPass::tryToVectorizeList(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x364a4e5)
#18 0x000000000364e6ff bool llvm::SLPVectorizerPass::vectorizeCmpInsts<std::reverse_iterator<llvm::CmpInst* const*>>(llvm::iterator_range<std::reverse_iterator<llvm::CmpInst* const*>>, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x364e6ff)
#19 0x0000000003652191 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3652191)
#20 0x00000000036586e6 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#21 0x00000000036591fb llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x36591fb)
#22 0x0000000002e2b4be llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2e2b4be)
#23 0x00000000055904d1 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x55904d1)
#24 0x0000000000ee0cbe llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xee0cbe)
#25 0x000000000558ea3a llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x558ea3a)
#26 0x000000000096d5ae llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x96d5ae)
#27 0x000000000558e3f1 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x558e3f1)
#28 0x00000000009778a8 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x9778a8)
#29 0x000000000096b917 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x96b917)
#30 0x00007338d1c29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#31 0x00007338d1c29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#32 0x0000000000962a35 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x962a35)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

cc @alexey-bataev 


Fix patch:
commit d0ea176ccea8bdcd60aacc2753734294b9eec71f
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Mon Sep 8 06:43:04 2025 -0700

    [SLP]Do not consider SExt/ZExt profitable for demotion, if the user is a bitcast to float
    
    If the user node of the SExt/ZExt node is a bitcast to a float point
    type, the node itself should not be considered legal to demote, since
    still the casting is required to match the size of the float point type.
    
    Fixes #157277

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index 4e90c1d5b9e1..1cfcd3ffbd66 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -21889,6 +21889,10 @@ bool BoUpSLP::collectValuesToDemote(
     return TryProcessInstruction(BitWidth);
   case Instruction::ZExt:
   case Instruction::SExt:
+    if (E.UserTreeIndex.UserTE && E.UserTreeIndex.UserTE->hasState() &&
+        E.UserTreeIndex.UserTE->getOpcode() == Instruction::BitCast &&
+        E.UserTreeIndex.UserTE->getMainOp()->getType()->isFPOrFPVectorTy())
+      return false;
     IsProfitableToDemote = true;
     return TryProcessInstruction(BitWidth);
 


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/X86/parent-bitcast-with-fp.ll
commands: opt -S --passes=slp-vectorizer -mtriple=x86_64-unknown-linux-gnu < %s
tests: test_name: <module>
test_body: 
define i1 @test(i32 %0) {
;
entry:
  %conv22.i.i = sext i32 %0 to i64
  %1 = bitcast i64 %conv22.i.i to double
  %2 = fadd double %1, 0.000000e+00
  %add.i.i.i = select i1 false, double 0.000000e+00, double %2
  %3 = bitcast double %add.i.i.i to i64
  %cmp3998.i.i = icmp ne i64 %3, %conv22.i.i
  %conv22.1.i.i = sext i32 0 to i64
  %4 = bitcast i64 %conv22.1.i.i to double
  %5 = fadd double %4, 0.000000e+00
  %add.i.1.i.i = select i1 false, double 0.000000e+00, double %5
  %6 = bitcast double %add.i.1.i.i to i64
  %cmp3998.1.i.i = icmp ne i64 %6, %conv22.1.i.i
  ret i1 %cmp3998.1.i.i
}