Bug type: crash
Component: LoopVectorize
Bug location: llvm/lib/Transforms/Vectorize/LoopVectorize.cpp: LoopVectorizationCostModel::getInstructionCost
Issue title: [LoopVectorize] Assertion `Offset <= State.VF.getKnownMinValue() && "invalid offset to extract from"' failed.
Labels: vectorizers
crash
Reported by: patrick-rivos

Reduced testcase:
```llvm ir
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

define i32 @main() #0 {
entry:
  br label %for.body

for.cond.cleanup:                                 ; preds = %for.body
  %.lcssa17 = phi i64 [ %0, %for.body ]
  ret i32 0

for.body:                                         ; preds = %for.body, %entry
  %0 = phi i64 [ 0, %entry ], [ %1, %for.body ]
  %indvars.iv = phi i64 [ 0, %entry ], [ %indvars.iv.next, %for.body ]
  %indvars.iv.next = add i64 %indvars.iv, 1
  %1 = load i64, ptr null, align 8
  %exitcond.not = icmp eq i64 %indvars.iv, 22
  br i1 %exitcond.not, label %for.cond.cleanup, label %for.body
}

attributes #0 = { "target-features"="+64bit,+v,+zvl128b,+zvl256b" }
```

Command/backtrace:
```bash
> /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt -passes=loop-vectorize reduced.ll
WARNING: You're attempting to print out a bitcode file.
This is inadvisable as it may cause display problems. If
you REALLY want to taste LLVM bitcode first-hand, you
can force output with the `-f' option.

opt: /scratch/tc-testing/tc-compiler-fuzz-trunk/llvm/llvm/lib/Transforms/Vectorize/VPlanRecipes.cpp:569: llvm::Value* llvm::VPInstruction::generatePerPart(llvm::VPTransformState&, unsigned int): Assertion `Offset <= State.VF.getKnownMinValue() && "invalid offset to extract from"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt -passes=loop-vectorize reduced.ll
1.      Running pass "function(loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>)" on module "reduced.ll"
2.      Running pass "loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>" on function "main"
 #0 0x000055972ae01800 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2ed2800)
 #1 0x000055972adfec0f llvm::sys::RunSignalHandlers() (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2ecfc0f)
 #2 0x000055972adfed65 SignalHandler(int) Signals.cpp:0:0
 #3 0x0000728161442520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007281614969fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x00007281614969fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x00007281614969fc pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x0000728161442476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x00007281614287f3 abort ./stdlib/abort.c:81:7
 #9 0x000072816142871b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x0000728161439e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x0000559729f62d80 llvm::VPInstruction::generatePerPart(llvm::VPTransformState&, unsigned int) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2033d80)
#12 0x0000559729f63155 llvm::VPInstruction::execute(llvm::VPTransformState&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2034155)
#13 0x0000559729f2de47 llvm::VPBasicBlock::executeRecipes(llvm::VPTransformState*, llvm::BasicBlock*) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x1ffee47)
#14 0x0000559729f2e141 llvm::VPIRBasicBlock::execute(llvm::VPTransformState*) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x1fff141)
#15 0x0000559729f30286 llvm::VPlan::execute(llvm::VPTransformState*) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2001286)
#16 0x0000559729e2380a llvm::LoopVectorizationPlanner::executePlan(llvm::ElementCount, unsigned int, llvm::VPlan&, llvm::InnerLoopVectorizer&, llvm::DominatorTree*, bool, llvm::DenseMap<llvm::SCEV const*, llvm::Value*, llvm::DenseMapInfo<llvm::SCEV const*, void>, llvm::detail::DenseMapPair<llvm::SCEV const*, llvm::Value*>> const*) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x1ef480a)
#17 0x0000559729e34a7c llvm::LoopVectorizePass::processLoop(llvm::Loop*) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x1f05a7c)
#18 0x0000559729e36f7e llvm::LoopVectorizePass::runImpl(llvm::Function&, llvm::ScalarEvolution&, llvm::LoopInfo&, llvm::TargetTransformInfo&, llvm::DominatorTree&, llvm::BlockFrequencyInfo*, llvm::TargetLibraryInfo*, llvm::DemandedBits&, llvm::AssumptionCache&, llvm::LoopAccessInfoManager&, llvm::OptimizationRemarkEmitter&, llvm::ProfileSummaryInfo*) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x1f07f7e)
#19 0x0000559729e380a0 llvm::LoopVectorizePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x1f090a0)
#20 0x0000559728cc6dc6 llvm::detail::PassModel<llvm::Function, llvm::LoopVectorizePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0xd97dc6)
#21 0x000055972ac1ce46 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2cede46)
#22 0x0000559728cc9f56 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0xd9af56)
#23 0x000055972ac1bbcb llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2cecbcb)
#24 0x0000559728cc6526 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0xd97526)
#25 0x000055972ac19d02 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2cead02)
#26 0x0000559728520136 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x5f1136)
#27 0x0000559728511d51 optMain (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x5e2d51)
#28 0x0000728161429d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#29 0x0000728161429e40 call_init ./csu/../csu/libc-start.c:128:20
#30 0x0000728161429e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#31 0x0000559728507b85 _start (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x5d8b85)
zsh: IOT instruction (core dumped)  /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt
```
Godbolt: https://godbolt.org/z/ojz8sMa1r

Found via fuzzer

Comments: author: svs-quic
body: Bisected to #93395 
cc: @fhahn 
author: fhahn
body: Thanks for the test case. Should be fixed now. The assertion highlighted a case where we previously miscompiled for the case where VF is <vscale x 1 x ..>; in that case we are unable to extract the penultimate value (second-to-last) if vscale = 1

Fix patch:
commit 2b3b405b09a0d965a4aff1f92958418ddbf1e7f6
Author: Florian Hahn <flo@fhahn.com>
Date:   Thu Jul 4 11:44:50 2024 +0100

    [LV] Don't vectorize first-order recurrence with VF <vscale x 1 x ..>
    
    The assertion added as part of https://github.com/llvm/llvm-project/pull/93395
    surfaced cases where first-order recurrences are vectorized with
    <vscale x 1 x ..>. If vscale is 1, then we are unable to extract the
    penultimate value (second to last lane). Previously this case got
    mis-compiled, trying to extract from an invalid lane (-1)
    https://llvm.godbolt.org/z/3adzYYcf9.
    
    Fixes https://github.com/llvm/llvm-project/issues/97452.

diff --git a/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp b/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
index f9c0c66e6e0a..d7b0240fd8a8 100644
--- a/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
+++ b/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
@@ -6813,6 +6813,11 @@ LoopVectorizationCostModel::getInstructionCost(Instruction *I, ElementCount VF,
 
     // First-order recurrences are replaced by vector shuffles inside the loop.
     if (VF.isVector() && Legal->isFixedOrderRecurrence(Phi)) {
+      // For <vscale x 1 x i64>, if vscale = 1 we are unable to extract the
+      // penultimate value of the recurrence.
+      // TODO: Consider vscale_range info.
+      if (VF.isScalable() && VF.getKnownMinValue() == 1)
+        return InstructionCost::getInvalid();
       SmallVector<int> Mask(VF.getKnownMinValue());
       std::iota(Mask.begin(), Mask.end(), VF.getKnownMinValue() - 1);
       return TTI.getShuffleCost(TargetTransformInfo::SK_Splice,


Regression tests:
file: llvm/test/Transforms/LoopVectorize/RISCV/first-order-recurrence-scalable-vf1.ll
commands: opt -p loop-vectorize -S %s
tests: test_name: <module>
test_body: 
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

; Make sure we do not pick <vscale x 1 x i64> as VF for a loop with a
; first-order recurrence.
define i64 @pr97452_scalable_vf1_for(ptr %src) #0 {
;
entry:
  br label %loop

loop:
  %for = phi i64 [ 0, %entry ], [ %l, %loop ]
  %iv = phi i64 [ 0, %entry ], [ %iv.next, %loop ]
  %iv.next = add i64 %iv, 1
  %gep = getelementptr inbounds i64, ptr %src, i64 %iv
  %l = load i64, ptr %gep, align 8
  %ec = icmp eq i64 %iv, 22
  br i1 %ec, label %exit, label %loop

exit:
  %res = phi i64 [ %for, %loop ]
  ret i64 %res
}

attributes #0 = { "target-features"="+64bit,+v,+zvl128b,+zvl256b" }
;.
;.
file: llvm/test/Transforms/LoopVectorize/first-order-recurrence-scalable-vf1.ll
commands: opt -p loop-vectorize -scalable-vectorization=on -force-vector-width=1 -force-target-supports-scalable-vectors=true -S %s
tests: test_name: <module>
test_body: 
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"


define i64 @pr97452_scalable_vf1_for_live_out(ptr %src) {
;
entry:
  br label %loop

loop:
  %for = phi i64 [ 0, %entry ], [ %l, %loop ]
  %iv = phi i64 [ 0, %entry ], [ %iv.next, %loop ]
  %iv.next = add i64 %iv, 1
  %gep = getelementptr inbounds i64, ptr %src, i64 %iv
  %l = load i64, ptr %gep, align 8
  %ec = icmp eq i64 %iv, 22
  br i1 %ec, label %exit, label %loop

exit:
  %res = phi i64 [ %for, %loop ]
  ret i64 %res
}


define void @pr97452_scalable_vf1_for_no_live_out(ptr %src, ptr noalias %dst) {
;
entry:
  br label %loop

loop:
  %for = phi i64 [ 0, %entry ], [ %l, %loop ]
  %iv = phi i64 [ 0, %entry ], [ %iv.next, %loop ]
  %iv.next = add i64 %iv, 1
  %gep = getelementptr inbounds i64, ptr %src, i64 %iv
  %l = load i64, ptr %gep, align 8
  %gep.dst = getelementptr inbounds i64, ptr %dst, i64 %iv
  store i64 %l, ptr %gep.dst
  %ec = icmp eq i64 %iv, 22
  br i1 %ec, label %exit, label %loop

exit:
  ret void
}