Bug type: crash
Component: LoopVectorize
Bug location: llvm/lib/Transforms/Vectorize/LoopVectorize.cpp: LoopVectorizationPlanner::computeBestVF
VPCostContext::getLegacyCost
VPCostContext::skipCostComputation
planContainsAdditionalSimplifications
Issue title: Crash in LoopVectorizationPlanner::computeBestVF()
Labels: vectorizers
crash
Reported by: eugeneepshteyn

Reduced reproducer:
```
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @reduced_test_(ptr %0, i64 %1, ptr %.sroa.067.0.copyload) {
._crit_edge103:
  br label %2

2:                                                ; preds = %2, %._crit_edge103
  %indvars.iv = phi i64 [ 0, %._crit_edge103 ], [ %indvars.iv.next, %2 ]
  %3 = phi i64 [ %1, %._crit_edge103 ], [ %10, %2 ]
  %4 = load double, ptr %0, align 8
  %5 = fmul double %4, 0.000000e+00
  %6 = fdiv double %5, 0.000000e+00
  %7 = sub i64 %indvars.iv, %1
  %8 = getelementptr double, ptr %.sroa.067.0.copyload, i64 %indvars.iv
  %9 = getelementptr double, ptr %8, i64 %7
  store double %6, ptr %9, align 8
  %indvars.iv.next = add i64 %indvars.iv, 1
  %10 = add i64 %3, -1
  %11 = icmp sgt i64 %3, 0
  br i1 %11, label %2, label %._crit_edge106

._crit_edge106:                                   ; preds = %2
  ret void
}
```
Crash:
```
$ opt -O2 reduced.ll 
WARNING: You're attempting to print out a bitcode file.
This is inadvisable as it may cause display problems. If
you REALLY want to taste LLVM bitcode first-hand, you
can force output with the `-f' option.

opt: .../llvm/lib/Transforms/Vectorize/LoopVectorize.cpp:7478: llvm::VectorizationFactor llvm::LoopVectorizationPlanner::computeBestVF(): Assertion `(BestFactor.Width == LegacyVF.Width || BestPlan.hasEarlyExit() || planContainsAdditionalSimplifications(getPlanFor(BestFactor.Width), CostCtx, OrigLoop) || planContainsAdditionalSimplifications(getPlanFor(LegacyVF.Width), CostCtx, OrigLoop)) && " VPlan cost model and legacy cost model disagreed"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: opt -O2 reduced.ll
1.      Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O2>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "reduced.ll"
2.      Running pass "loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>" on function "reduced_test_"
 #0 0x0000000001b16948 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (.../llvm-5162/bin/opt+0x1b16948)
 #1 0x0000000001b13bd4 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007ce1f6c45330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
 #3 0x00007ce1f6c9eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #4 0x00007ce1f6c9eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #5 0x00007ce1f6c9eb2c pthread_kill ./nptl/pthread_kill.c:89:10
 #6 0x00007ce1f6c4527e raise ./signal/../sysdeps/posix/raise.c:27:6
 #7 0x00007ce1f6c288ff abort ./stdlib/abort.c:81:7
 #8 0x00007ce1f6c2881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
 #9 0x00007ce1f6c3b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#10 0x0000000003b73b36 llvm::LoopVectorizationPlanner::computeBestVF() (.../llvm-5162/bin/opt+0x3b73b36)
#11 0x0000000003b7556a llvm::LoopVectorizePass::processLoop(llvm::Loop*) (.../llvm-5162/bin/opt+0x3b7556a)
#12 0x0000000003b78140 llvm::LoopVectorizePass::runImpl(llvm::Function&) (.../llvm-5162/bin/opt+0x3b78140)
#13 0x0000000003b78793 llvm::LoopVectorizePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (opt+0x3b78793)
#14 0x00000000036215ae llvm::detail::PassModel<llvm::Function, llvm::LoopVectorizePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) PassBuilder.cpp:0:0
#15 0x0000000001de4030 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (opt+0x1de4030)
#16 0x0000000002e4da6e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) NVPTXTargetMachine.cpp:0:0
#17 0x0000000001de4543 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (opt+0x1de4543)
#18 0x0000000002e4da2e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) NVPTXTargetMachine.cpp:0:0
#19 0x0000000001de2160 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (opt+0x1de2160)
#20 0x00000000034ad61a llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (opt+0x34ad61a)
...
Aborted
```


Fix patch:
commit a9b2998e315af64b7a68606af9064db425699c39
Author: Florian Hahn <flo@fhahn.com>
Date:   Sat May 24 11:09:27 2025 +0100

    [VPlan] Skip cost assert if VPlan converted to single-scalar recipes.
    
    Check if a VPlan transform converted recipes to single-scalar
    VPReplicateRecipes (after 07c085af3efcd67503232f99a1652efc6e54c1a9). If
    that's the case, the legacy cost model incorrectly overestimates the cost.
    
    Fixes https://github.com/llvm/llvm-project/issues/141237.

diff --git a/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp b/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
index 275b3d567856..8a35afbb73f3 100644
--- a/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
+++ b/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
@@ -7082,6 +7082,11 @@ InstructionCost VPCostContext::getLegacyCost(Instruction *UI,
   return CM.getInstructionCost(UI, VF);
 }
 
+bool VPCostContext::isLegacyUniformAfterVectorization(Instruction *I,
+                                                      ElementCount VF) const {
+  return CM.isUniformAfterVectorization(I, VF);
+}
+
 bool VPCostContext::skipCostComputation(Instruction *UI, bool IsVector) const {
   return CM.ValuesToIgnore.contains(UI) ||
          (IsVector && CM.VecValuesToIgnore.contains(UI)) ||
@@ -7315,7 +7320,8 @@ InstructionCost LoopVectorizationPlanner::cost(VPlan &Plan,
 /// cost-model did not account for.
 static bool planContainsAdditionalSimplifications(VPlan &Plan,
                                                   VPCostContext &CostCtx,
-                                                  Loop *TheLoop) {
+                                                  Loop *TheLoop,
+                                                  ElementCount VF) {
   // First collect all instructions for the recipes in Plan.
   auto GetInstructionForCost = [](const VPRecipeBase *R) -> Instruction * {
     if (auto *S = dyn_cast<VPSingleDefRecipe>(R))
@@ -7352,6 +7358,16 @@ static bool planContainsAdditionalSimplifications(VPlan &Plan,
       // comparing against the legacy cost isn't desirable.
       if (isa<VPPartialReductionRecipe>(&R))
         return true;
+
+      /// If a VPlan transform folded a recipe to one producing a single-scalar,
+      /// but the original instruction wasn't uniform-after-vectorization in the
+      /// legacy cost model, the legacy cost overestimates the actual cost.
+      if (auto *RepR = dyn_cast<VPReplicateRecipe>(&R)) {
+        if (RepR->isSingleScalar() &&
+            !CostCtx.isLegacyUniformAfterVectorization(
+                RepR->getUnderlyingInstr(), VF))
+          return true;
+      }
       if (Instruction *UI = GetInstructionForCost(&R)) {
         // If we adjusted the predicate of the recipe, the cost in the legacy
         // cost model may be different.
@@ -7477,9 +7493,10 @@ VectorizationFactor LoopVectorizationPlanner::computeBestVF() {
   // legacy cost model doesn't properly model costs for such loops.
   assert((BestFactor.Width == LegacyVF.Width || BestPlan.hasEarlyExit() ||
           planContainsAdditionalSimplifications(getPlanFor(BestFactor.Width),
-                                                CostCtx, OrigLoop) ||
-          planContainsAdditionalSimplifications(getPlanFor(LegacyVF.Width),
-                                                CostCtx, OrigLoop)) &&
+                                                CostCtx, OrigLoop,
+                                                BestFactor.Width) ||
+          planContainsAdditionalSimplifications(
+              getPlanFor(LegacyVF.Width), CostCtx, OrigLoop, LegacyVF.Width)) &&
          " VPlan cost model and legacy cost model disagreed");
   assert((BestFactor.Width.isScalar() || BestFactor.ScalarCost > 0) &&
          "when vectorizing, the scalar cost must be computed.");
diff --git a/llvm/lib/Transforms/Vectorize/VPlanHelpers.h b/llvm/lib/Transforms/Vectorize/VPlanHelpers.h
index 1d42c8f5f373..0446991ebfff 100644
--- a/llvm/lib/Transforms/Vectorize/VPlanHelpers.h
+++ b/llvm/lib/Transforms/Vectorize/VPlanHelpers.h
@@ -364,6 +364,11 @@ struct VPCostContext {
 
   /// Returns the OperandInfo for \p V, if it is a live-in.
   TargetTransformInfo::OperandValueInfo getOperandInfo(VPValue *V) const;
+
+  /// Return true if \p I is considered uniform-after-vectorization in the
+  /// legacy cost model for \p VF. Only used to check for additional VPlan
+  /// simplifications.
+  bool isLegacyUniformAfterVectorization(Instruction *I, ElementCount VF) const;
 };
 
 /// This class can be used to assign names to VPValues. For VPValues without


Regression tests:
file: llvm/test/Transforms/LoopVectorize/X86/uniform_load.ll
commands: opt -passes=loop-vectorize -S %s
tests: test_name: foo
test_body: target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

@inc = external global float, align 4

define void @foo(ptr noalias captures(none) %A, i64 %N) #0 {
entry:
  br label %loop

loop:                                             ; preds = %loop, %entry
  %iv = phi i64 [ 0, %entry ], [ %iv.next, %loop ]
  %l.inc = load float, ptr @inc, align 4
  %gep.A = getelementptr inbounds float, ptr %A, i64 %iv
  %l.A = load float, ptr %gep.A, align 4
  %add = fadd float %l.inc, %l.A
  store float %add, ptr %gep.A, align 4
  %iv.next = add nuw nsw i64 %iv, 1
  %ec = icmp eq i64 %iv.next, 32
  br i1 %ec, label %exit, label %loop

exit:                                             ; preds = %loop
  ret void
}

attributes #0 = { "target-cpu"="core-avx2" }

test_name: uniform_load_can_fold_users
test_body: target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @uniform_load_can_fold_users(ptr noalias %src, ptr %dst, i64 %start, double %d) {
entry:
  br label %loop

loop:                                             ; preds = %loop, %entry
  %iv.1 = phi i64 [ 0, %entry ], [ %iv.1.next, %loop ]
  %iv.2 = phi i64 [ %start, %entry ], [ %iv.2.next, %loop ]
  %l = load double, ptr %src, align 8
  %m = fmul double %l, 9.000000e+00
  %div = fdiv double %m, %d
  %sub = sub i64 %iv.1, 1
  %gep.1 = getelementptr double, ptr %dst, i64 %iv.1
  %gep.2 = getelementptr double, ptr %gep.1, i64 %sub
  store double %div, ptr %gep.2, align 8
  %iv.1.next = add i64 %iv.1, 1
  %iv.2.next = add i64 %iv.2, -1
  %ec = icmp sgt i64 %iv.2, 0
  br i1 %ec, label %loop, label %exit

exit:                                             ; preds = %loop
  ret void
}