Bug type: crash
Component: LoopVectorize
Bug location: llvm/lib/Transforms/Vectorize/VPlanUtils.h: isUniformAfterVectorization
Issue title: [clang] Crash at -O3: Assertion `hasVectorValue(Def)' failed.
Labels: vectorizers
crash-on-valid
Reported by: cardigan1008

This code crashes at `-O3`:

```c
int *a;
int b, d;
static int f = 65535;
char c[];
int h(int i) {
  int g = 1;
  for (; b;)
    if (a[0]) {
      g = 0;
      break;
    }
  if (g)
    a;
  else if (i)
    return 1;
  return 0;
}
void k() {
  int *e[10] = {&f};
  for (;;) {
    d = 0;
    for (; d < 8; d = f - 65535 + d + 1) {
      int j = h(f);
      c[j + f - 65534 + d] = 0;
    }
  }
}
void main() {}
```

Compiler Explorer: https://godbolt.org/z/rcGqsE196 

Bisected to https://github.com/llvm/llvm-project/commit/f48884ded884d982a7fd13394b0e93e6588f4143, which was comitted by @fhahn 

Crash:

```console
clang: /root/llvm-project/llvm/lib/Transforms/Vectorize/VPlan.cpp:236: llvm::Value* llvm::VPTransformState::get(llvm::VPValue*, const llvm::VPLane&): Assertion `hasVectorValue(Def)' failed.
```

Backtrace:

```console
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang -gdwarf-4 -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics -O3 <source>
1.	<eof> parser at end of file
2.	Optimizer
3.	Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,chr,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O3>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "<source>"
4.	Running pass "loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>" on function "k"
 #0 0x0000000003c71738 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3c71738)
 #1 0x0000000003c6f444 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3c6f444)
 #2 0x0000000003bbc988 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x000077fbea242520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x000077fbea2969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x000077fbea242476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x000077fbea2287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x000077fbea22871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x000077fbea239e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x00000000058fd2be llvm::VPTransformState::get(llvm::VPValue*, llvm::VPLane const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x58fd2be)
#10 0x0000000005790d0d llvm::InnerLoopVectorizer::scalarizeInstruction(llvm::Instruction const*, llvm::VPReplicateRecipe*, llvm::VPLane const&, llvm::VPTransformState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x5790d0d)
#11 0x00000000057916d0 llvm::VPReplicateRecipe::execute(llvm::VPTransformState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x57916d0)
#12 0x00000000058e3ce7 llvm::VPBasicBlock::executeRecipes(llvm::VPTransformState*, llvm::BasicBlock*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x58e3ce7)
#13 0x00000000058ef282 llvm::VPBasicBlock::execute(llvm::VPTransformState*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x58ef282)
#14 0x00000000058f0ef1 llvm::VPRegionBlock::execute(llvm::VPTransformState*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x58f0ef1)
#15 0x00000000058fddb1 llvm::VPlan::execute(llvm::VPTransformState*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x58fddb1)
#16 0x00000000057be1eb llvm::LoopVectorizationPlanner::executePlan(llvm::ElementCount, unsigned int, llvm::VPlan&, llvm::InnerLoopVectorizer&, llvm::DominatorTree*, bool, llvm::DenseMap<llvm::SCEV const*, llvm::Value*, llvm::DenseMapInfo<llvm::SCEV const*, void>, llvm::detail::DenseMapPair<llvm::SCEV const*, llvm::Value*>> const*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x57be1eb)
#17 0x00000000057d24c3 llvm::LoopVectorizePass::processLoop(llvm::Loop*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x57d24c3)
#18 0x00000000057d3e19 llvm::LoopVectorizePass::runImpl(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x57d3e19)
#19 0x00000000057d4453 llvm::LoopVectorizePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x57d4453)
#20 0x00000000052f765e llvm::detail::PassModel<llvm::Function, llvm::LoopVectorizePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x52f765e)
#21 0x000000000361c6e0 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x361c6e0)
#22 0x00000000011305ce llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x11305ce)
#23 0x000000000361affb llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x361affb)
#24 0x000000000112fc5e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x112fc5e)
#25 0x000000000361aa00 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x361aa00)
#26 0x0000000003f247bf (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#27 0x0000000003f28335 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3f28335)
#28 0x000000000460209e clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x460209e)
#29 0x000000000660f9cc clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x660f9cc)
#30 0x0000000004602478 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4602478)
#31 0x00000000048be799 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x48be799)
#32 0x0000000004840e2e clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4840e2e)
#33 0x00000000049abb8e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x49abb8e)
#34 0x0000000000ce93ef cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xce93ef)
#35 0x0000000000ce0e8a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#36 0x0000000004647ae9 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#37 0x0000000003bbce34 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3bbce34)
#38 0x00000000046480df clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#39 0x000000000460c1ed clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x460c1ed)
#40 0x000000000460d26e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x460d26e)
#41 0x0000000004614d95 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4614d95)
#42 0x0000000000ce6233 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xce6233)
#43 0x0000000000bb2524 main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xbb2524)
#44 0x000077fbea229d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#45 0x000077fbea229e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#46 0x0000000000ce0935 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xce0935)
```

Comments: author: fhahn
body: Reduced repro:

```
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @k() {
entry:
  %.fr = freeze i32 65535
  %invariant.op = add i32 %.fr, -65534
  br label %for.cond.us

for.cond.us:                                      ; preds = %for.body.us.us, %entry
  br label %for.body.us.us

for.body.us.us:                                   ; preds = %for.body.us.us, %for.cond.us
  %storemerge7.us.us = phi i32 [ 0, %for.cond.us ], [ %sub.reass.us.us, %for.body.us.us ]
  %sub.reass.us.us = add i32 %storemerge7.us.us, %invariant.op
  %idxprom.us.us = sext i32 %sub.reass.us.us to i64
  %arrayidx.us.us = getelementptr [0 x i8], ptr null, i64 0, i64 %idxprom.us.us
  store i8 0, ptr %arrayidx.us.us, align 1
  %cmp.us.us = icmp slt i32 %sub.reass.us.us, 8
  br i1 %cmp.us.us, label %for.body.us.us, label %for.cond.us
}
```

Fix patch:
commit 0eaa69eb234798774a08743b64a9aa0cf71c5356
Author: Florian Hahn <flo@fhahn.com>
Date:   Tue Jan 7 21:26:40 2025 +0000

    [VPlan] Handle VPExpandSCEVRecipe in isUniformAfterVectorization.
    
    VPExpandSCEVRecipes must be placed in the entry and are alway uniform.
    This fixes a crash by always identifying them as uniform, even if the
    main vector loop region has been removed.
    
    Fixes https://github.com/llvm/llvm-project/issues/121897.

diff --git a/llvm/lib/Transforms/Vectorize/VPlanUtils.h b/llvm/lib/Transforms/Vectorize/VPlanUtils.h
index 965777002052..777944264f45 100644
--- a/llvm/lib/Transforms/Vectorize/VPlanUtils.h
+++ b/llvm/lib/Transforms/Vectorize/VPlanUtils.h
@@ -49,7 +49,8 @@ inline bool isUniformAfterVectorization(const VPValue *VPV) {
     return all_of(GEP->operands(), isUniformAfterVectorization);
   if (auto *VPI = dyn_cast<VPInstruction>(Def))
     return VPI->isSingleScalar() || VPI->isVectorToScalar();
-  return false;
+  // VPExpandSCEVRecipes must be placed in the entry and are alway uniform.
+  return isa<VPExpandSCEVRecipe>(Def);
 }
 
 /// Return true if \p V is a header mask in \p Plan.


Regression tests:
file: llvm/test/Transforms/LoopVectorize/vector-loop-backedge-elimination.ll
commands: opt -passes='loop-vectorize,verify<loops>' -force-vector-width=8 -force-vector-interleave=1 -S %s
opt -passes='loop-vectorize,verify<loops>' -force-vector-width=8 -force-vector-interleave=2 -S %s
opt -passes='loop-vectorize,verify<loops>' -force-vector-width=16 -force-vector-interleave=1 -S %s
tests: test_name: scev_expand_step
test_body: target datalayout = "e-m:o-i64:64-i128:128-n32:64-S128"

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(inaccessiblemem: write)
declare void @llvm.assume(i1 noundef) #0

define void @scev_expand_step(i64 %x, ptr %dst) {
entry:
  %c = icmp eq i64 %x, 65536
  call void @llvm.assume(i1 %c)
  %fr = freeze i64 %x
  %step = add i64 %fr, -65534
  br label %loop

loop:                                             ; preds = %loop, %entry
  %iv = phi i64 [ 0, %entry ], [ %iv.next, %loop ]
  %iv.next = add i64 %iv, %step
  %gep.dst = getelementptr i8, ptr %dst, i64 %iv.next
  store i8 0, ptr %gep.dst, align 1
  %ec = icmp slt i64 %iv.next, 16
  br i1 %ec, label %loop, label %exit

exit:                                             ; preds = %loop
  ret void
}

attributes #0 = { nocallback nofree nosync nounwind willreturn memory(inaccessiblemem: write) }

test_name: remove_loop_region_outer_loop
test_body: target datalayout = "e-m:o-i64:64-i128:128-n32:64-S128"

declare i1 @cond()

define void @remove_loop_region_outer_loop(i64 range(i64 8, 17) %N, ptr noalias %src, ptr %dst) {
entry:
  br label %outer.header

outer.header:                                     ; preds = %outer.latch, %entry
  %outer.iv = phi ptr [ %src, %entry ], [ %outer.iv.next, %outer.latch ]
  br label %inner

inner:                                            ; preds = %inner, %outer.header
  %inner.iv = phi i64 [ 0, %outer.header ], [ %iv.next, %inner ]
  %gep.src = getelementptr i8, ptr %outer.iv, i64 %inner.iv
  %l = load i8, ptr %gep.src, align 1
  %gep.dst = getelementptr i8, ptr %dst, i64 %inner.iv
  store i8 %l, ptr %gep.dst, align 1
  %iv.next = add i64 %inner.iv, 1
  %c.1 = icmp eq i64 %iv.next, %N
  br i1 %c.1, label %outer.latch, label %inner

outer.latch:                                      ; preds = %inner
  %outer.iv.next = getelementptr i8, ptr %outer.iv, i64 1
  %c.2 = call i1 @cond()
  br i1 %c.2, label %outer.header, label %exit

exit:                                             ; preds = %outer.latch
  ret void
}

test_name: remove_loop_region_with_replicate_recipe
test_body: target datalayout = "e-m:o-i64:64-i128:128-n32:64-S128"

define void @remove_loop_region_with_replicate_recipe(ptr %dst, i64 range(i64 5, 10) %N) {
entry:
  br label %loop

loop:                                             ; preds = %loop, %entry
  %iv = phi i64 [ 2, %entry ], [ %iv.next, %loop ]
  %gep.dst = getelementptr i16, ptr %dst, i64 %iv
  store i16 0, ptr %gep.dst, align 2
  %iv.next = add i64 %iv, 1
  %ec = icmp eq i64 %iv.next, %N
  br i1 %ec, label %exit, label %loop

exit:                                             ; preds = %loop
  ret void
}

test_name: test_tc_less_than_16
test_body: target datalayout = "e-m:o-i64:64-i128:128-n32:64-S128"

define void @test_tc_less_than_16(ptr %A, i64 %N) {
entry:
  %and = and i64 %N, 15
  br label %loop

loop:                                             ; preds = %loop, %entry
  %iv = phi i64 [ %and, %entry ], [ %iv.next, %loop ]
  %p.src = phi ptr [ %A, %entry ], [ %p.src.next, %loop ]
  %p.src.next = getelementptr inbounds i8, ptr %p.src, i64 1
  %l = load i8, ptr %p.src, align 1
  %add = add nsw i8 %l, 10
  store i8 %add, ptr %p.src, align 1
  %iv.next = add nsw i64 %iv, -1
  %cmp = icmp eq i64 %iv.next, 0
  br i1 %cmp, label %exit, label %loop

exit:                                             ; preds = %loop
  ret void
}