Bug type: crash
Component: ScalarEvolution
Bug location: llvm/lib/Transforms/Utils/ScalarEvolutionExpander.cpp: SCEVExpander::tryToReuseLCSSAPhi
Issue title: Attempt to use a SCEVCouldNotCompute object! UNREACHABLE executed at /root/llvm-project/llvm/lib/Analysis/ScalarEvolution.cpp:412!
Labels: llvm:SCEV
crash
Reported by: TatyanaDoubts

To reproduce run opt with the test below, -passes=loop-idiom.
```
; ModuleID = './reduced.ll'
source_filename = "./reduced.ll"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128-ni:1-p2:32:8:8:32-ni:2"
target triple = "x86_64-unknown-linux-gnu"

define i32 @wombat(ptr addrspace(1) %arg) gc "statepoint-example" {
bb:
  br label %bb2

bb1:                                              ; preds = %bb2
  %phi = phi ptr addrspace(1) [ %getelementptr, %bb2 ]
  br label %bb7

bb2:                                              ; preds = %bb2, %bb
  %phi3 = phi i64 [ 0, %bb ], [ %add5, %bb2 ]
  %phi4 = phi i64 [ 0, %bb ], [ %add, %bb2 ]
  %add = add i64 %phi4, 1
  %getelementptr = getelementptr i16, ptr addrspace(1) null, i64 %add
  %add5 = add i64 %phi3, 1
  br i1 false, label %bb2, label %bb1

bb6:                                              ; preds = %bb7
  ret i32 0

bb7:                                              ; preds = %bb10, %bb1
  %phi8 = phi i64 [ %phi3, %bb1 ], [ %add11, %bb10 ]
  %getelementptr9 = getelementptr i32, ptr addrspace(1) %arg, i64 %phi8
  store i32 0, ptr addrspace(1) %getelementptr9, align 4
  %icmp = icmp ult i64 %phi8, 1
  br i1 %icmp, label %bb10, label %bb6

bb10:                                             ; preds = %bb7
  %add11 = add i64 %phi8, 1
  br label %bb7
}
```
Reproducer: https://godbolt.org/z/qrWxb665W
Stack dump:
```
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=loop-idiom <source>
1.	Running pass "function(loop(loop-idiom))" on module "<source>"
2.	Running pass "loop(loop-idiom)" on function "wombat"
 #0 0x00000000056fda38 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x56fda38)
 #1 0x00000000056fa8e4 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x000072a056242520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x000072a0562969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x000072a056242476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x000072a0562287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x0000000005634fda (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5634fda)
 #7 0x0000000004d415be llvm::SCEV::getType() const (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4d415be)
 #8 0x0000000004d8c80e llvm::ScalarEvolution::getMinusSCEV(llvm::SCEV const*, llvm::SCEV const*, llvm::SCEV::NoWrapFlags, unsigned int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4d8c80e)
 #9 0x00000000049c63d8 llvm::SCEVExpander::tryToReuseLCSSAPhi(llvm::SCEVAddRecExpr const*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x49c63d8)
#10 0x00000000049cb858 llvm::SCEVExpander::visitAddRecExpr(llvm::SCEVAddRecExpr const*) (.part.0) ScalarEvolutionExpander.cpp:0:0
#11 0x00000000049c5455 llvm::SCEVVisitor<llvm::SCEVExpander, llvm::Value*>::visit(llvm::SCEV const*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x49c5455)
#12 0x00000000049c60fd llvm::SCEVExpander::expand(llvm::SCEV const*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x49c60fd)
#13 0x00000000049cb0f3 llvm::SCEVExpander::expandAddToGEP(llvm::SCEV const*, llvm::Value*, llvm::SCEV::NoWrapFlags) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x49cb0f3)
#14 0x00000000049cc095 llvm::SCEVExpander::visitAddRecExpr(llvm::SCEVAddRecExpr const*) (.part.0) ScalarEvolutionExpander.cpp:0:0
#15 0x00000000049c5455 llvm::SCEVVisitor<llvm::SCEVExpander, llvm::Value*>::visit(llvm::SCEV const*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x49c5455)
#16 0x00000000049c60fd llvm::SCEVExpander::expand(llvm::SCEV const*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x49c60fd)
#17 0x00000000049cc928 llvm::SCEVExpander::expandCodeFor(llvm::SCEV const*, llvm::Type*, llvm::ilist_iterator_w_bits<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void, true, llvm::BasicBlock>, false, false>) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x49cc928)
#18 0x0000000004494e77 (anonymous namespace)::LoopIdiomRecognize::processLoopStridedStore(llvm::Value*, llvm::SCEV const*, llvm::MaybeAlign, llvm::Value*, llvm::Instruction*, llvm::SmallPtrSetImpl<llvm::Instruction*>&, llvm::SCEVAddRecExpr const*, llvm::SCEV const*, bool, bool) LoopIdiomRecognize.cpp:0:0
#19 0x0000000004498c11 (anonymous namespace)::LoopIdiomRecognize::processLoopStores(llvm::SmallVectorImpl<llvm::StoreInst*>&, llvm::SCEV const*, (anonymous namespace)::LoopIdiomRecognize::ForMemset) LoopIdiomRecognize.cpp:0:0
#20 0x00000000044997b4 (anonymous namespace)::LoopIdiomRecognize::runOnCountableLoop() LoopIdiomRecognize.cpp:0:0
#21 0x000000000449b0fd llvm::LoopIdiomRecognizePass::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x449b0fd)
#22 0x0000000002e085be llvm::detail::PassModel<llvm::Loop, llvm::LoopIdiomRecognizePass, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2e085be)
#23 0x00000000044c0406 std::optional<llvm::PreservedAnalyses> llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runSinglePass<llvm::Loop, std::unique_ptr<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>>>>(llvm::Loop&, std::unique_ptr<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>>>&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&, llvm::PassInstrumentation&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x44c0406)
#24 0x00000000044c05ef llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runWithoutLoopNestPasses(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x44c05ef)
#25 0x00000000044c1d54 llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x44c1d54)
#26 0x00000000044c2860 llvm::FunctionToLoopPassAdaptor::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x44c2860)
#27 0x0000000000ed957e llvm::detail::PassModel<llvm::Function, llvm::FunctionToLoopPassAdaptor, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xed957e)
#28 0x00000000054eb6c1 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x54eb6c1)
#29 0x0000000000ed969e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xed969e)
#30 0x00000000054ebd0a llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x54ebd0a)
#31 0x000000000096d56e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x96d56e)
#32 0x00000000054e9771 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x54e9771)
#33 0x000000000097780a llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x97780a)
#34 0x000000000096b8d7 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x96b8d7)
#35 0x000072a056229d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#36 0x000072a056229e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#37 0x00000000009629f5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x9629f5)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```


Fix patch:
commit b29084f0d80dd4fd66f1421350c87f79c537d071
Author: Florian Hahn <flo@fhahn.com>
Date:   Tue Aug 26 11:38:39 2025 +0100

    [SCEVExp] Check if getPtrToIntExpr resulted in CouldNotCompute.
    
    This fixes a crash trying to use SCEVCouldNotCompute, if getPtrToIntExpr
    failed.
    
    Fixes https://github.com/llvm/llvm-project/issues/155287

diff --git a/llvm/lib/Transforms/Utils/ScalarEvolutionExpander.cpp b/llvm/lib/Transforms/Utils/ScalarEvolutionExpander.cpp
index 060ca92e559a..3e3d51bffff3 100644
--- a/llvm/lib/Transforms/Utils/ScalarEvolutionExpander.cpp
+++ b/llvm/lib/Transforms/Utils/ScalarEvolutionExpander.cpp
@@ -1239,10 +1239,13 @@ Value *SCEVExpander::tryToReuseLCSSAPhi(const SCEVAddRecExpr *S) {
     if (!isa<SCEVAddRecExpr>(ExitSCEV))
       continue;
     Type *PhiTy = PN.getType();
-    if (STy->isIntegerTy() && PhiTy->isPointerTy())
+    if (STy->isIntegerTy() && PhiTy->isPointerTy()) {
       ExitSCEV = SE.getPtrToIntExpr(ExitSCEV, STy);
-    else if (S->getType() != PN.getType())
+      if (isa<SCEVCouldNotCompute>(ExitSCEV))
+        continue;
+    } else if (S->getType() != PN.getType()) {
       continue;
+    }
 
     // Check if we can re-use the existing PN, by adjusting it with an expanded
     // offset, if the offset is simpler.


Regression tests:
file: llvm/test/Transforms/LoopIdiom/reuse-lcssa-phi-scev-expansion.ll
commands: opt -p loop-idiom -S %s
tests: test_name: phi_ptr_addressspace_ptrtoint_fail
test_body: target datalayout = "e-m:e-i64:64-i128:128-f80:128-n8:16:32:64-S128-ni:1-p2:32:8:8:32-ni:2"

define void @phi_ptr_addressspace_ptrtoint_fail(ptr addrspace(1) %arg) {
bb:
  br label %loop.1

loop.1:                                           ; preds = %loop.1, %bb
  %iv.1 = phi i64 [ 0, %bb ], [ %add5, %loop.1 ]
  %add5 = add i64 %iv.1, 1
  %getelementptr = getelementptr i16, ptr addrspace(1) %arg, i64 %add5
  br i1 false, label %loop.1, label %loop.2.ph

loop.2.ph:                                        ; preds = %loop.1
  %phi = phi ptr addrspace(1) [ %getelementptr, %loop.1 ]
  br label %loop.2.header

loop.2.header:                                    ; preds = %loop.2.latch, %loop.2.ph
  %iv.2 = phi i64 [ %iv.1, %loop.2.ph ], [ %iv.2.next, %loop.2.latch ]
  %grep.arg = getelementptr i32, ptr addrspace(1) %arg, i64 %iv.2
  store i32 0, ptr addrspace(1) %grep.arg, align 4
  %ec = icmp ult i64 %iv.2, 1
  br i1 %ec, label %loop.2.latch, label %exit

loop.2.latch:                                     ; preds = %loop.2.header
  %iv.2.next = add i64 %iv.2, 1
  br label %loop.2.header

exit:                                             ; preds = %loop.2.header
  ret void
}