Bug type: crash
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: getExtractIndex
Issue title: [LLVM] SLP Vectorizer crashes with APInt setBit assertion on out-of-bounds extractelement
Labels: llvm:SLPVectorizer
crash
Reported by: sairam2661

**Fuzzer Generated Test** 
**Reproducer**
https://godbolt.org/z/rxrEYrj1v

**Test Commit**
[0b2f3cfb72a76fa90f3ec2a234caabe0d0712590](https://github.com/llvm/llvm-project/commit/0b2f3cfb72a76fa90f3ec2a234caabe0d0712590)

**Description**
The SLP Vectorizer crashes when processing IR containing an out-of-bounds `extractelement` index. While `extractelement` with an out-of-bounds index is valid IR (it produces poison), the SLP Vectorizer's cost calculation logic uses an APInt bitmask to track vector lanes and attempts to set a bit beyond the APInt's width, triggering an assertion failure.

Related:  https://github.com/llvm/llvm-project/issues/58054

**Steps to reproduce**
- Minimized test case, `input.ll`
```
define <4 x i32> @test(<4 x i32> %A) {
entry:
  %e0 = extractelement <4 x i32> %A, i64 0
  %e1 = extractelement <4 x i32> %A, i64 1
  %e2 = extractelement <4 x i32> %A, i64 2
  %e3 = extractelement <4 x i32> %A, i64 3
  %oob = extractelement <4 x i32> %A, i64 4
  %d0 = sdiv i32 %e0, %e0
  %d1 = sdiv i32 %oob, %e1
  %d2 = sdiv i32 %e2, %e3
  %d3 = sdiv i32 %oob, %e1
  %v0 = insertelement <4 x i32> poison, i32 %d0, i64 0
  %v1 = insertelement <4 x i32> %v0, i32 %d1, i64 1
  %v2 = insertelement <4 x i32> %v1, i32 %d2, i64 2
  %v3 = insertelement <4 x i32> %v2, i32 %d3, i64 3
  ret <4 x i32> %v3
}
```

**Command**
```
opt -passes=slp-vectorizer -S input.ll
```

**Output**
```
opt: /workdir/llvm-project/llvm/include/llvm/ADT/APInt.h:1332: void llvm::APInt::setBit(unsigned int): Assertion `BitPosition < BitWidth && "BitPosition out of range"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: opt -passes=slp-vectorizer -S /input.ll
1.	Running pass "function(slp-vectorizer)" on module "input.ll"
2.	Running pass "slp-vectorizer" on function "test"
 #0 0x00007f726e5ac728 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMSupport.so.22.0git+0x1d3728)
 #1 0x00007f726e5a99d5 llvm::sys::RunSignalHandlers() (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMSupport.so.22.0git+0x1d09d5)
 #2 0x00007f726e5ad3c6 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x00007f72786d5420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #4 0x00007f726e0c000b raise /build/glibc-B3wQXB/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #5 0x00007f726e09f859 abort /build/glibc-B3wQXB/glibc-2.31/stdlib/abort.c:81:7
 #6 0x00007f726e09f729 get_sysdep_segment_value /build/glibc-B3wQXB/glibc-2.31/intl/loadmsgcat.c:509:8
 #7 0x00007f726e09f729 _nl_load_domain /build/glibc-B3wQXB/glibc-2.31/intl/loadmsgcat.c:970:34
 #8 0x00007f726e0b0fd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #9 0x00007f7270fce24d llvm::InstructionCost llvm::function_ref<llvm::InstructionCost (unsigned int)>::callback_fn<llvm::slpvectorizer::BoUpSLP::getEntryCost(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::ArrayRef<llvm::Value*>, llvm::SmallPtrSetImpl<llvm::Value*>&)::$_6>(long, unsigned int) SLPVectorizer.cpp:0:0
#10 0x00007f7270f12f56 llvm::slpvectorizer::BoUpSLP::getEntryCost(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::ArrayRef<llvm::Value*>, llvm::SmallPtrSetImpl<llvm::Value*>&)::$_2::operator()(llvm::function_ref<llvm::InstructionCost (unsigned int)>, llvm::function_ref<llvm::InstructionCost (llvm::InstructionCost)>) const SLPVectorizer.cpp:0:0
#11 0x00007f7270f0d5fc llvm::slpvectorizer::BoUpSLP::getEntryCost(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::ArrayRef<llvm::Value*>, llvm::SmallPtrSetImpl<llvm::Value*>&) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMVectorize.so.22.0git+0x1665fc)
#12 0x00007f7270f19404 llvm::slpvectorizer::BoUpSLP::calculateTreeCostAndTrimNonProfitable(llvm::ArrayRef<llvm::Value*>) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMVectorize.so.22.0git+0x172404)
#13 0x00007f7270f540e4 llvm::SLPVectorizerPass::tryToVectorizeList(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, bool) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMVectorize.so.22.0git+0x1ad0e4)
#14 0x00007f7270f5a075 llvm::SLPVectorizerPass::vectorizeInsertElementInst(llvm::InsertElementInst*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, bool) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMVectorize.so.22.0git+0x1b3075)
#15 0x00007f7270f5a279 llvm::SLPVectorizerPass::vectorizeInserts(llvm::SmallSetVector<llvm::Instruction*, 8u>&, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMVectorize.so.22.0git+0x1b3279)
#16 0x00007f7270f5b359 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&)::$_4::operator()(bool) const SLPVectorizer.cpp:0:0
#17 0x00007f7270f4e4a4 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMVectorize.so.22.0git+0x1a74a4)
#18 0x00007f7270f4ac94 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMVectorize.so.22.0git+0x1a3c94)
#19 0x00007f7270f49fe5 llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMVectorize.so.22.0git+0x1a2fe5)
#20 0x00007f726ea41f6b llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMCore.so.22.0git+0x2e3f6b)
#21 0x00007f726ea46f9f llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMCore.so.22.0git+0x2e8f9f)
#22 0x00007f726ea40d4b llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMCore.so.22.0git+0x2e2d4b)
#23 0x00007f727868a9fd llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::__1::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMOptDriver.so.22.0git+0x269fd)
#24 0x00007f727869bae4 optMain (/workdir/llvm-project/build-libcxx/bin/../lib/libLLVMOptDriver.so.22.0git+0x37ae4)
#25 0x00007f726e0a1083 __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:342:3
#26 0x000055c43c38e07e _start (/workdir/llvm-project/build-libcxx/bin/opt+0x207e)
```



Fix patch:
commit 51845a53fd2e2f6b0a18dfad3f912e9f676a5fc9
Author: Soumik15630m <soumik15630m@gmail.com>
Date:   Wed Jan 28 16:38:03 2026 +0530

    [SLP] Fix crash on extractelement with out-of-bounds index.....Fixes … (#176918)
    
    …The cose modeling logic was attempting to set a bit in APInt for an
    out-of-bounds index, causing an assertion failure. This patch ignores
    OOB indices as they produce poison- which is already handled.
    Fixes #176780
    
    this is the same test result which produces this bug
    
    <img width="1600" height="964" alt="image"
    src="https://github.com/user-attachments/assets/80593902-9d15-4e18-850b-a558bca8518e"
    />

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index 3034e94b5997..ce4786802388 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -902,7 +902,14 @@ static std::optional<unsigned> getExtractIndex(const Instruction *E) {
     auto *CI = dyn_cast<ConstantInt>(E->getOperand(1));
     if (!CI)
       return std::nullopt;
-    return CI->getZExtValue();
+    // Check if the index is out of bound  - we can get the source vector from
+    // operand 0
+    unsigned Idx = CI->getZExtValue();
+    auto *EE = cast<ExtractElementInst>(E);
+    const unsigned VF = ::getNumElements(EE->getVectorOperandType());
+    if (Idx >= VF)
+      return std::nullopt;
+    return Idx;
   }
   auto *EI = cast<ExtractValueInst>(E);
   if (EI->getNumIndices() != 1)


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/X86/crash-on-out-of-bound-extract.ll
commands: opt -passes=slp-vectorizer -S < %s
tests: test_name: <module>
test_body: 


define <4 x i32> @test(<4 x i32> %A){
;
entry:
  %e0 = extractelement <4 x i32> %A, i64 0
  %e1 = extractelement <4 x i32> %A, i64 1
  %e2 = extractelement <4 x i32> %A, i64 2
  %e3 = extractelement <4 x i32> %A, i64 3
  %oob = extractelement <4 x i32> %A, i64 4
  %d0 = sdiv i32 %e0, %e0
  %d1 = sdiv i32 %oob, %e1
  %d2 = sdiv i32 %e2, %e3
  %d3 = sdiv i32 %oob, %e1
  %v0 = insertelement <4 x i32> poison, i32 %d0, i64 0
  %v1 = insertelement <4 x i32> %v0, i32 %d1, i64 1
  %v2 = insertelement <4 x i32> %v1, i32 %d2, i64 2
  %v3 = insertelement <4 x i32> %v2, i32 %d3, i64 3
  ret <4 x i32> %v3

}