Bug type: crash
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: BoUpSLP::getLastInstructionInBundle
Issue title: [SLPVectorizer] Instruction does not dominate all uses! LLVM ERROR: Broken module found, compilation aborted!
Labels: llvm:SLPVectorizer
crash-on-valid
Reported by: TatyanaDoubts

To reproduce run opt with the test below with -passes=slp-vectorizer -slp-threshold=-99999
```; ModuleID = './reduced.ll'
source_filename = "./reduced.ll"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128-ni:1-p2:32:8:8:32-ni:2"
target triple = "x86_64-unknown-linux-gnu"

define void @wombat() #0 gc "statepoint-example" {
bb:
  %icmp = icmp samesign ult i32 0, 0
  %select = select i1 %icmp, i32 0, i32 0
  %zext = zext i32 %select to i64
  %getelementptr = getelementptr ptr addrspace(1), ptr addrspace(1) null, i64 %zext
  store ptr addrspace(1) null, ptr addrspace(1) %getelementptr, align 8
  %icmp1 = icmp eq i32 0, 0
  %icmp2 = icmp eq i32 0, 0
  %icmp3 = icmp samesign ult i32 0, 0
  %icmp4 = icmp eq i32 0, 0
  %add = add i32 1, 0
  %icmp5 = icmp samesign ult i32 %add, 0
  store volatile i32 0, ptr addrspace(1) null, align 4
  %call = call i32 @llvm.x86.sse2.cvttsd2si(<2 x double> zeroinitializer)
  %icmp6 = icmp eq i32 %call, 0
  %icmp7 = icmp samesign ult i32 0, 0
  ret void
}

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(none)
declare i32 @llvm.x86.sse2.cvttsd2si(<2 x double>) #1

attributes #0 = { "target-features"="+prfchw,-cldemote,+avx,+aes,+sahf,+pclmul,-xop,+crc32,+xsaves,-avx512fp16,-usermsr,-sm4,-egpr,+sse4.1,-avx512ifma,+xsave,+sse4.2,-tsxldtrk,-sm3,-ptwrite,-widekl,+invpcid,+64bit,+xsavec,-avx10.1-512,-avx512vpopcntdq,+cmov,-avx512vp2intersect,+avx512cd,+movbe,-avxvnniint8,-ccmp,-amx-int8,-kl,-avx10.1-256,+evex512,-avxvnni,+rtm,+adx,+avx2,-hreset,-movdiri,-serialize,-sha512,-vpclmulqdq,+avx512vl,-uintr,-cf,+clflushopt,-raoint,-cmpccxadd,+bmi,-amx-tile,+sse,-avx10.2-256,-gfni,-avxvnniint16,-amx-fp16,-zu,-ndd,+xsaveopt,+rdrnd,+avx512f,-amx-bf16,-avx512bf16,-avx512vnni,-push2pop2,+cx8,+avx512bw,+sse3,+pku,-nf,+fsgsbase,-clzero,-mwaitx,-lwp,+lzcnt,-sha,-movdir64b,-ppx,-wbnoinvd,-enqcmd,-avx10.2-512,-avxneconvert,-tbm,-pconfig,-amx-complex,+ssse3,+cx16,+bmi2,+fma,+popcnt,-avxifma,+f16c,-avx512bitalg,-rdpru,+clwb,+mmx,+sse2,+rdseed,-avx512vbmi2,-prefetchi,-rdpid,-fma4,-avx512vbmi,-shstk,-vaes,-waitpkg,-sgx,+fxsr,+avx512dq,-sse4a,-avx512f" }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(none) "target-features"="+prfchw,-cldemote,+avx,+aes,+sahf,+pclmul,-xop,+crc32,+xsaves,-avx512fp16,-usermsr,-sm4,-egpr,+sse4.1,-avx512ifma,+xsave,+sse4.2,-tsxldtrk,-sm3,-ptwrite,-widekl,+invpcid,+64bit,+xsavec,-avx10.1-512,-avx512vpopcntdq,+cmov,-avx512vp2intersect,+avx512cd,+movbe,-avxvnniint8,-ccmp,-amx-int8,-kl,-avx10.1-256,+evex512,-avxvnni,+rtm,+adx,+avx2,-hreset,-movdiri,-serialize,-sha512,-vpclmulqdq,+avx512vl,-uintr,-cf,+clflushopt,-raoint,-cmpccxadd,+bmi,-amx-tile,+sse,-avx10.2-256,-gfni,-avxvnniint16,-amx-fp16,-zu,-ndd,+xsaveopt,+rdrnd,+avx512f,-amx-bf16,-avx512bf16,-avx512vnni,-push2pop2,+cx8,+avx512bw,+sse3,+pku,-nf,+fsgsbase,-clzero,-mwaitx,-lwp,+lzcnt,-sha,-movdir64b,-ppx,-wbnoinvd,-enqcmd,-avx10.2-512,-avxneconvert,-tbm,-pconfig,-amx-complex,+ssse3,+cx16,+bmi2,+fma,+popcnt,-avxifma,+f16c,-avx512bitalg,-rdpru,+clwb,+mmx,+sse2,+rdseed,-avx512vbmi2,-prefetchi,-rdpid,-fma4,-avx512vbmi,-shstk,-vaes,-waitpkg,-sgx,+fxsr,+avx512dq,-sse4a,-avx512f" }
```
Reproducer: https://godbolt.org/z/nTE84xq7n

Stack dump
```
Instruction does not dominate all uses!
  %5 = icmp eq <4 x i32> %4, zeroinitializer
  %2 = call <8 x i1> @llvm.vector.insert.v8i1.v4i1(<8 x i1> poison, <4 x i1> %5, i64 0)
LLVM ERROR: Broken module found, compilation aborted!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=slp-vectorizer -slp-threshold=-99999 <source>
1.	Running pass "verify" on module "<source>"
 #0 0x00000000050e7a98 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x50e7a98)
 #1 0x00000000050e548c SignalHandler(int) Signals.cpp:0:0
 #2 0x000078c8a0042520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x000078c8a00969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x000078c8a0042476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x000078c8a00287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x00000000007d7d7b llvm::json::operator==(llvm::json::Value const&, llvm::json::Value const&) (.cold) JSON.cpp:0:0
 #7 0x00000000050265b8 (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x50265b8)
 #8 0x0000000004f24790 llvm::VerifierPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4f24790)
 #9 0x00000000009015ce llvm::detail::PassModel<llvm::Module, llvm::VerifierPass, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x9015ce)
#10 0x0000000004ee5440 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4ee5440)
#11 0x000000000090c1ea llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x90c1ea)
#12 0x00000000008ff258 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x8ff258)
#13 0x000078c8a0029d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#14 0x000078c8a0029e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#15 0x00000000008f6d2e _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x8f6d2e)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```


Fix patch:
commit 77bec78878762e34150fe23734fa43df796c873c
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Fri Nov 8 04:16:01 2024 -0800

    [SLP]Do not look for last instruction in schedule block for buildvectors
    
    If looking for the insertion point for the node and the node is
    a buildvector node, the compiler should not use scheduling info for such
    nodes, they may contain only partial info, which is not fully correct
    and may cause compiler crash.
    
    Fixes #114082

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index b2f677fb84f9..c5b3537bc57b 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -13398,7 +13398,7 @@ Instruction &BoUpSLP::getLastInstructionInBundle(const TreeEntry *E) {
   // scheduled, and the last instruction is VL.back(). So we start with
   // VL.back() and iterate over schedule data until we reach the end of the
   // bundle. The end of the bundle is marked by null ScheduleData.
-  if (BlocksSchedules.count(BB)) {
+  if (BlocksSchedules.count(BB) && !E->isGather()) {
     Value *V = E->isOneOf(E->Scalars.back());
     if (doesNotNeedToBeScheduled(V))
       V = *find_if_not(E->Scalars, doesNotNeedToBeScheduled);


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/X86/buildvector-schedule-for-subvector.ll
commands: opt -S --passes=slp-vectorizer -mtriple=x86_64-unknown-linux-gnu -slp-threshold=-99999 < %s
tests: test_name: test
test_body: define void @test() {
bb:
  %icmp = icmp samesign ult i32 0, 0
  %select = select i1 %icmp, i32 0, i32 0
  %zext = zext i32 %select to i64
  %getelementptr = getelementptr ptr addrspace(1), ptr addrspace(1) null, i64 %zext
  store ptr addrspace(1) null, ptr addrspace(1) %getelementptr, align 8
  %icmp1 = icmp eq i32 0, 0
  %icmp2 = icmp eq i32 0, 0
  %icmp3 = icmp samesign ult i32 0, 0
  %icmp4 = icmp eq i32 0, 0
  %add = add i32 1, 0
  %icmp5 = icmp samesign ult i32 %add, 0
  store volatile i32 0, ptr addrspace(1) null, align 4
  %call = call i32 null(<2 x double> zeroinitializer)
  %icmp6 = icmp eq i32 %call, 0
  %icmp7 = icmp samesign ult i32 0, 0
  ret void
}