Bug type: crash
Component: VectorCombine
Bug location: llvm/lib/Transforms/Vectorize/VectorCombine.cpp: VectorCombine::foldTruncFromReductions
Issue title: [VectorCombine] Assertion 'isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
Labels: vectorizers
crash
Reported by: patrick-rivos

Reduced LLVM IR:
```llvm ir
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

define i32 @main() #0 {
entry:
  %0 = tail call i16 @llvm.vector.reduce.and.nxv8i16(<vscale x 8 x i16> trunc (<vscale x 8 x i32> shufflevector (<vscale x 8 x i32> insertelement (<vscale x 8 x i32> poison, i32 268435456, i64 0), <vscale x 8 x i32> poison, <vscale x 8 x i32> zeroinitializer) to <vscale x 8 x i16>))
  ret i32 0
}

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare i16 @llvm.vector.reduce.and.nxv8i16(<vscale x 8 x i16>) #1

attributes #0 = { "target-features"="+64bit,+a,+c,+d,+f,+m,+relax,+v,+zicsr,+zifencei,+zve32f,+zve32x,+zve64d,+zve64f,+zve64x,+zvl128b,+zvl256b,+zvl32b,+zvl64b,-e,-experimental-smmpm,-experimental-smnpm,-experimental-ssnpm,-experimental-sspm,-experimental-ssqosid,-experimental-supm,-experimental-zaamo,-experimental-zabha,-experimental-zalasr,-experimental-zalrsc,-experimental-zfbfmin,-experimental-zicfilp,-experimental-zicfiss,-experimental-ztso,-experimental-zvfbfmin,-experimental-zvfbfwma,-h,-shcounterenw,-shgatpa,-shtvala,-shvsatpa,-shvstvala,-shvstvecd,-smaia,-smepmp,-ssaia,-ssccptr,-sscofpmf,-sscounterenw,-ssstateen,-ssstrict,-sstc,-sstvala,-sstvecd,-ssu64xl,-svade,-svadu,-svbare,-svinval,-svnapot,-svpbmt,-xcvalu,-xcvbi,-xcvbitmanip,-xcvelw,-xcvmac,-xcvmem,-xcvsimd,-xsfcease,-xsfvcp,-xsfvfnrclipxfqf,-xsfvfwmaccqqq,-xsfvqmaccdod,-xsfvqmaccqoq,-xsifivecdiscarddlone,-xsifivecflushdlone,-xtheadba,-xtheadbb,-xtheadbs,-xtheadcmo,-xtheadcondmov,-xtheadfmemidx,-xtheadmac,-xtheadmemidx,-xtheadmempair,-xtheadsync,-xtheadvdot,-xventanacondops,-za128rs,-za64rs,-zacas,-zawrs,-zba,-zbb,-zbc,-zbkb,-zbkc,-zbkx,-zbs,-zca,-zcb,-zcd,-zce,-zcf,-zcmop,-zcmp,-zcmt,-zdinx,-zfa,-zfh,-zfhmin,-zfinx,-zhinx,-zhinxmin,-zic64b,-zicbom,-zicbop,-zicboz,-ziccamoa,-ziccif,-zicclsm,-ziccrse,-zicntr,-zicond,-zihintntl,-zihintpause,-zihpm,-zimop,-zk,-zkn,-zknd,-zkne,-zknh,-zkr,-zks,-zksed,-zksh,-zkt,-zmmul,-zvbb,-zvbc,-zvfh,-zvfhmin,-zvkb,-zvkg,-zvkn,-zvknc,-zvkned,-zvkng,-zvknha,-zvknhb,-zvks,-zvksc,-zvksed,-zvksg,-zvksh,-zvkt,-zvl1024b,-zvl16384b,-zvl2048b,-zvl32768b,-zvl4096b,-zvl512b,-zvl65536b,-zvl8192b" }
attributes #1 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }
```
Godbolt: https://godbolt.org/z/jrEv178Ev

Backtrace:
```
opt: /scratch/tc-testing/tc-apr-15/llvm/llvm/include/llvm/Support/Casting.h:578: decltype(auto) llvm::cast(From*) [with To = llvm::CastInst; From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt --passes=vector-combine reduced.ll
 #0 0x00005eb857c5a1b0 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt+0x2da91b0)
 #1 0x00005eb857c575bf llvm::sys::RunSignalHandlers() (/scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt+0x2da65bf)
 #2 0x00005eb857c57715 SignalHandler(int) Signals.cpp:0:0
 #3 0x000071f7d0e42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x000071f7d0e969fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x000071f7d0e969fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x000071f7d0e969fc pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x000071f7d0e42476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x000071f7d0e287f3 abort ./stdlib/abort.c:81:7
 #9 0x000071f7d0e2871b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x000071f7d0e39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x00005eb856da36eb (anonymous namespace)::VectorCombine::run()::'lambda'(llvm::Instruction&)::operator()(llvm::Instruction&) const VectorCombine.cpp:0:0
#12 0x00005eb856da4290 llvm::VectorCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt+0x1ef3290)
#13 0x00005eb855bc7936 llvm::detail::PassModel<llvm::Function, llvm::VectorCombinePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt+0xd16936)
#14 0x00005eb857a7f451 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt+0x2bce451)
#15 0x00005eb855bbec26 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt+0xd0dc26)
#16 0x00005eb857a7e12b llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt+0x2bcd12b)
#17 0x00005eb855bc6ee6 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt+0xd15ee6)
#18 0x00005eb857a7bf61 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt+0x2bcaf61)
#19 0x00005eb855440205 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt+0x58f205)
#20 0x00005eb855432836 optMain (/scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt+0x581836)
#21 0x000071f7d0e29d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#22 0x000071f7d0e29e40 call_init ./csu/../csu/libc-start.c:128:20
#23 0x000071f7d0e29e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#24 0x00005eb8554284b5 _start (/scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/opt+0x5774b5)
zsh: IOT instruction  /scratch/tc-testing/tc-apr-15/build-rv64gcv/build-llvm-linux/bin/op
```

Found via fuzzer.


Fix patch:
commit 57b9c15227ec15a5e2abf4587d7d0ad536cff9e6
Author: Ramkumar Ramachandra <r@artagnon.com>
Date:   Wed May 8 09:47:55 2024 +0100

    VectorCombine: fix logical error after m_Trunc match (#91201)
    
    The matcher m_Trunc() matches an Operator with a given Opcode, which
    could either be an Instruction or ConstExpr.
    VectorCombine::foldTruncFromReductions() incorrectly assumes that the
    pattern matched is always an Instruction, and attempts a cast. Fix this.
    
    Fixes #88796.

diff --git a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
index bbb70134870a..8573a8adf53b 100644
--- a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
+++ b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
@@ -1961,17 +1961,17 @@ bool VectorCombine::foldTruncFromReductions(Instruction &I) {
   if (!match(ReductionSrc, m_OneUse(m_Trunc(m_Value(TruncSrc)))))
     return false;
 
-  auto *Trunc = cast<CastInst>(ReductionSrc);
   auto *TruncSrcTy = cast<VectorType>(TruncSrc->getType());
   auto *ReductionSrcTy = cast<VectorType>(ReductionSrc->getType());
   Type *ResultTy = I.getType();
 
   TTI::TargetCostKind CostKind = TTI::TCK_RecipThroughput;
-  InstructionCost OldCost =
-      TTI.getCastInstrCost(Instruction::Trunc, ReductionSrcTy, TruncSrcTy,
-                           TTI::CastContextHint::None, CostKind, Trunc) +
-      TTI.getArithmeticReductionCost(ReductionOpc, ReductionSrcTy, std::nullopt,
-                                     CostKind);
+  InstructionCost OldCost = TTI.getArithmeticReductionCost(
+      ReductionOpc, ReductionSrcTy, std::nullopt, CostKind);
+  if (auto *Trunc = dyn_cast<CastInst>(ReductionSrc))
+    OldCost +=
+        TTI.getCastInstrCost(Instruction::Trunc, ReductionSrcTy, TruncSrcTy,
+                             TTI::CastContextHint::None, CostKind, Trunc);
   InstructionCost NewCost =
       TTI.getArithmeticReductionCost(ReductionOpc, TruncSrcTy, std::nullopt,
                                      CostKind) +


Regression tests:
file: llvm/test/Transforms/VectorCombine/pr88796.ll
commands: opt -passes=vector-combine -S %s
tests: test_name: test
test_body: define i32 @test() {
entry:
  %0 = tail call i16 @llvm.vector.reduce.and.nxv8i16(<vscale x 8 x i16> trunc (<vscale x 8 x i32> splat (i32 268435456) to <vscale x 8 x i16>))
  ret i32 0
}

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare i16 @llvm.vector.reduce.and.nxv8i16(<vscale x 8 x i16>) #0

attributes #0 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }