Bug type: crash
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: BoUpSLP::vectorizeTree
Issue title: [SLPVectorizer] Instruction does not dominate all uses!
Labels: llvm:SLPVectorizer
crash
generated by fuzzer
Reported by: ewlu

Testcase:
```llvm ir
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

define i16 @c(ptr %i) #0 {
entry:
  %gep.us154 = getelementptr i8, ptr %i, i64 132860
  %gep.us154.1 = getelementptr i8, ptr %i, i64 137774
  %gep.us154.2 = getelementptr i8, ptr %i, i64 142688
  %gep.us154.3 = getelementptr i8, ptr %i, i64 147602
  %gep.us154.4 = getelementptr i8, ptr %i, i64 152516
  %gep.us154.5 = getelementptr i8, ptr %i, i64 157430
  br label %for.cond5.us

for.cond5.us:                                     ; preds = %entry
  %0 = load i16, ptr %gep.us154, align 2
  %1 = load i16, ptr %gep.us154.1, align 2
  %2 = load i16, ptr %gep.us154.2, align 2
  %3 = load i16, ptr %gep.us154.3, align 2
  %4 = load i16, ptr %gep.us154.4, align 2
  %5 = load i16, ptr %gep.us154.5, align 2
  %6 = call i16 @llvm.umax.i16(i16 %5, i16 0)
  %7 = call i16 @llvm.umax.i16(i16 %0, i16 %6)
  %8 = call i16 @llvm.umax.i16(i16 %1, i16 %7)
  %9 = call i16 @llvm.umax.i16(i16 %2, i16 %8)
  %10 = call i16 @llvm.umax.i16(i16 %3, i16 %9)
  %11 = call i16 @llvm.umax.i16(i16 %2, i16 %10)
  %12 = call i16 @llvm.umax.i16(i16 %3, i16 %11)
  %13 = call i16 @llvm.umax.i16(i16 %4, i16 %12)
  %14 = load i16, ptr %gep.us154, align 2
  %15 = call i16 @llvm.umax.i16(i16 %14, i16 %13)
  %16 = load i16, ptr %gep.us154.1, align 2
  %17 = call i16 @llvm.umax.i16(i16 %16, i16 %15)
  %18 = call i16 @llvm.umax.i16(i16 %4, i16 %17)
  ret i16 %18
}

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare i16 @llvm.umax.i16(i16, i16) #1

; uselistorder directives
uselistorder ptr @llvm.umax.i16, { 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 }

attributes #0 = { "target-features"="+v" }
attributes #1 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }
```

Command/backtrace:
```
$ /scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt reduced.ll --passes=slp-vectorizer
WARNING: You're attempting to print out a bitcode file.
This is inadvisable as it may cause display problems. If
you REALLY want to taste LLVM bitcode first-hand, you
can force output with the `-f' option.

Instruction does not dominate all uses!
  %6 = call <4 x i16> @llvm.experimental.vp.strided.load.v4i16.p0.i64(ptr align 2 %gep.us154.2, i64 4914, <4 x i1> splat (i1 true), i32 4)
  %4 = call <8 x i16> @llvm.vector.insert.v8i16.v4i16(<8 x i16> poison, <4 x i16> %6, i64 0)
Instruction does not dominate all uses!
  %7 = call <4 x i16> @llvm.masked.gather.v4i16.v4p0(<4 x ptr> %3, i32 2, <4 x i1> splat (i1 true), <4 x i16> poison)
  %5 = call <8 x i16> @llvm.vector.insert.v8i16.v4i16(<8 x i16> %4, <4 x i16> %7, i64 4)
LLVM ERROR: Broken module found, compilation aborted!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt reduced.ll --passes=slp-vectorizer
1.      Running pass "verify" on module "reduced.ll"
 #0 0x00005de624576b42 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x3588b42)
 #1 0x00005de624573baf llvm::sys::RunSignalHandlers() (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x3585baf)
 #2 0x00005de624573cf4 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x0000723bce445330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
 #4 0x0000723bce49eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x0000723bce49eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x0000723bce49eb2c pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x0000723bce44527e raise ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x0000723bce4288ff abort ./stdlib/abort.c:81:7
 #9 0x00005de6216a55f8 llvm::GlobPattern::create(llvm::StringRef, std::optional<unsigned long>) (.cold) GlobPattern.cpp:0:0
#10 0x00005de6244a24f5 (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x34b44f5)
#11 0x00005de6243a4a90 llvm::VerifierPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x33b6a90)
#12 0x00005de621795e15 llvm::detail::PassModel<llvm::Module, llvm::VerifierPass, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x7a7e15)
#13 0x00005de62435f33d llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x337133d)
#14 0x00005de6217a2051 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x7b4051)
#15 0x00005de621793b8c optMain (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x7a5b8c)
#16 0x0000723bce42a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#17 0x0000723bce42a28b call_init ./csu/../csu/libc-start.c:128:20
#18 0x0000723bce42a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#19 0x00005de62178a1e5 _start (/scratch/ewlu/daily-upstream-build/build-gcv/build-llvm-linux/bin/opt+0x79c1e5)
Aborted
```

Godbolt: https://godbolt.org/z/hq5nGcnrd

Found via fuzzer: Reduced from C testcase in https://github.com/llvm/llvm-project/issues/141262


Fix patch:
commit aa452b65fc7ebfee6f7e5b9d08aa418d532c7b88
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Sat May 24 07:20:41 2025 -0700

    [SLP]Restore insertion points after gathers vectorization
    
    Restore insertion points after gathers vectorization to avoid a crash in
    a root node vectorization.
    
    Fixes #141265

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index 0f86c572639c..831703b375d9 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -18535,6 +18535,7 @@ Value *BoUpSLP::vectorizeTree(
     }
   }
   for (auto &Entry : GatherEntries) {
+    IRBuilderBase::InsertPointGuard Guard(Builder);
     Builder.SetInsertPoint(Entry.second);
     Builder.SetCurrentDebugLocation(Entry.second->getDebugLoc());
     (void)vectorizeTree(Entry.first);


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/RISCV/gather-insert-point-restore.ll
commands: opt -S --passes=slp-vectorizer -mtriple=riscv64-unknown-linux-gnu -mattr=+v < %s
tests: test_name: <module>
test_body: 
define i16 @test(ptr %i) {
;
entry:
  %gep.us154 = getelementptr i8, ptr %i, i64 132860
  %gep.us154.1 = getelementptr i8, ptr %i, i64 137774
  %gep.us154.2 = getelementptr i8, ptr %i, i64 142688
  %gep.us154.3 = getelementptr i8, ptr %i, i64 147602
  %gep.us154.4 = getelementptr i8, ptr %i, i64 152516
  %gep.us154.5 = getelementptr i8, ptr %i, i64 157430
  br label %for.cond5.us

for.cond5.us:
  %0 = load i16, ptr %gep.us154, align 2
  %1 = load i16, ptr %gep.us154.1, align 2
  %2 = load i16, ptr %gep.us154.2, align 2
  %3 = load i16, ptr %gep.us154.3, align 2
  %4 = load i16, ptr %gep.us154.4, align 2
  %5 = load i16, ptr %gep.us154.5, align 2
  %6 = call i16 @llvm.umax.i16(i16 %5, i16 0)
  %7 = call i16 @llvm.umax.i16(i16 %0, i16 %6)
  %8 = call i16 @llvm.umax.i16(i16 %1, i16 %7)
  %9 = call i16 @llvm.umax.i16(i16 %2, i16 %8)
  %10 = call i16 @llvm.umax.i16(i16 %3, i16 %9)
  %11 = call i16 @llvm.umax.i16(i16 %2, i16 %10)
  %12 = call i16 @llvm.umax.i16(i16 %3, i16 %11)
  %13 = call i16 @llvm.umax.i16(i16 %4, i16 %12)
  %14 = load i16, ptr %gep.us154, align 2
  %15 = call i16 @llvm.umax.i16(i16 %14, i16 %13)
  %16 = load i16, ptr %gep.us154.1, align 2
  %17 = call i16 @llvm.umax.i16(i16 %16, i16 %15)
  %18 = call i16 @llvm.umax.i16(i16 %4, i16 %17)
  ret i16 %18
}

declare i16 @llvm.umax.i16(i16, i16) #1