Bug type: crash
Component: LoopVectorize
Bug location: llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp: simplifyRecipe
Issue title: [LoopVectorize] Assertion `PredicatingBB && "Predicated block has no single predecessor."' failed.
Labels: vectorizers
crash-on-valid
generated by fuzzer
Reported by: dtcxzyw

Crash reproducer:
```
; bin/opt -passes=loop-vectorize test.ll -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define i32 @main(i1 %cmp.i679.i.i.i, ptr %p) {
entry:
  br label %for.cond1.preheader.i

for.cond1.preheader.i:                            ; preds = %for.cond1.preheader.i, %entry
  %indvars.iv.i = phi i64 [ 0, %entry ], [ %indvars.iv.next.i, %for.cond1.preheader.i ]
  %arrayidx.i = getelementptr [256 x i32], ptr %p, i64 0, i64 %indvars.iv.i
  store i32 0, ptr %arrayidx.i, align 4
  %indvars.iv.next.i = add i64 %indvars.iv.i, 1
  %exitcond.not.i = icmp eq i64 %indvars.iv.i, 1
  br i1 %exitcond.not.i, label %crc32_gentab.exit, label %for.cond1.preheader.i

crc32_gentab.exit:                                ; preds = %for.cond1.preheader.i
  %div.rhs.trunc.i.i.i.i = sext i8 1 to i16
  %0 = trunc i32 0 to i16
  br label %for.body222.i.i.i

for.body222.i.i.i:                                ; preds = %safe_mod_func_int32_t_s_s.exit.i.i.i, %crc32_gentab.exit
  %p_188.addr.2816.i.i.i = phi i16 [ 0, %crc32_gentab.exit ], [ %inc272.i.i.i, %safe_mod_func_int32_t_s_s.exit.i.i.i ]
  br i1 %cmp.i679.i.i.i, label %safe_mod_func_int32_t_s_s.exit.i.i.i, label %cond.false.i683.i.i.i

cond.false.i683.i.i.i:                            ; preds = %for.body222.i.i.i
  %div16.i.i.i.i = sdiv i16 %0, %div.rhs.trunc.i.i.i.i
  %1 = zext i16 %div16.i.i.i.i to i32
  br label %safe_mod_func_int32_t_s_s.exit.i.i.i

safe_mod_func_int32_t_s_s.exit.i.i.i:             ; preds = %cond.false.i683.i.i.i, %for.body222.i.i.i
  %cond.i684.i.i.i = phi i32 [ %1, %cond.false.i683.i.i.i ], [ 0, %for.body222.i.i.i ]
  %inc272.i.i.i = add i16 %p_188.addr.2816.i.i.i, 1
  %exitcond.not.i.i.i = icmp eq i16 %inc272.i.i.i, 0
  br i1 %exitcond.not.i.i.i, label %if.else417.i.i.i, label %for.body222.i.i.i

if.else417.i.i.i:                                 ; preds = %safe_mod_func_int32_t_s_s.exit.i.i.i
  ret i32 %cond.i684.i.i.i
}
```
```
opt: /home/dtcxzyw/WorkSpace/Projects/compilers/llvm-project/llvm/lib/Transforms/Vectorize/VPlanRecipes.cpp:2885: virtual void llvm::VPPredInstPHIRecipe::execute(llvm::VPTransformState&): Assertion `PredicatingBB && "Predicated block has no single predecessor."' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: bin/opt -passes=loop-vectorize reduced.ll -S
1.      Running pass "function(loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>)" on module "reduced.ll"
2.      Running pass "loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>" on function "main"
 #0 0x00007088da627ab2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMSupport.so.21.0git+0x227ab2)
 #1 0x00007088da62498f llvm::sys::RunSignalHandlers() (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMSupport.so.21.0git+0x22498f)
 #2 0x00007088da624ad4 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x00007088da045330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
 #4 0x00007088da09eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x00007088da09eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x00007088da09eb2c pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x00007088da04527e raise ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x00007088da0288ff abort ./stdlib/abort.c:81:7
 #9 0x00007088da02881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x00007088da03b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x00007088d38e230e llvm::VPPredInstPHIRecipe::execute(llvm::VPTransformState&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMVectorize.so.21.0git+0x2e230e)
#12 0x00007088d3889738 llvm::VPBasicBlock::executeRecipes(llvm::VPTransformState*, llvm::BasicBlock*) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMVectorize.so.21.0git+0x289738)
#13 0x00007088d389abd5 llvm::VPBasicBlock::execute(llvm::VPTransformState*) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMVectorize.so.21.0git+0x29abd5)
#14 0x00007088d388c05d llvm::VPRegionBlock::execute(llvm::VPTransformState*) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMVectorize.so.21.0git+0x28c05d)
#15 0x00007088d389cff5 llvm::VPlan::execute(llvm::VPTransformState*) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMVectorize.so.21.0git+0x29cff5)
#16 0x00007088d36f1382 llvm::LoopVectorizationPlanner::executePlan(llvm::ElementCount, unsigned int, llvm::VPlan&, llvm::InnerLoopVectorizer&, llvm::DominatorTree*, bool) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMVectorize.so.21.0git+0xf1382)
#17 0x00007088d3709d6f llvm::LoopVectorizePass::processLoop(llvm::Loop*) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMVectorize.so.21.0git+0x109d6f)
#18 0x00007088d370bf11 llvm::LoopVectorizePass::runImpl(llvm::Function&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMVectorize.so.21.0git+0x10bf11)
#19 0x00007088d370c586 llvm::LoopVectorizePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMVectorize.so.21.0git+0x10c586)
#20 0x00007088d42ec9c5 llvm::detail::PassModel<llvm::Function, llvm::LoopVectorizePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMPasses.so.21.0git+0xec9c5)
#21 0x00007088d1127444 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x327444)
#22 0x00007088d90db9b5 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0xdb9b5)
#23 0x00007088d1127960 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x327960)
#24 0x00007088d90dc375 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0xdc375)
#25 0x00007088d1128ae5 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x328ae5)
#26 0x00007088da7912e9 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMOptDriver.so.21.0git+0x2c2e9)
#27 0x00007088da79c306 optMain (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMOptDriver.so.21.0git+0x37306)
#28 0x00007088da02a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#29 0x00007088da02a28b call_init ./csu/../csu/libc-start.c:128:20
#30 0x00007088da02a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#31 0x000064bed9823095 _start (bin/opt+0x1095)
Aborted (core dumped)
```
llvm version: 94bcd9ceedc7e194b6296e4a293c60b8e38d1b67

Comments: author: gregbedwell
body: We've hit this as well in our testing.
https://godbolt.org/z/hjGqcsWso

```
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-unknown"

define i8 @g(i1 %cmp3) {
entry:
  %0 = zext i1 true to i16
  %div.lhs.trunc = sext i8 0 to i16
  br label %for.body

for.body:                                         ; preds = %cond.end, %entry
  %b.014 = phi i8 [ %inc, %cond.end ], [ 0, %entry ]
  br i1 %cmp3, label %cond.end, label %cond.false

cond.false:                                       ; preds = %for.body
  %div13 = sdiv i16 %div.lhs.trunc, %0
  %1 = trunc i16 %div13 to i8
  br label %cond.end

cond.end:                                         ; preds = %cond.false, %for.body
  %cond = phi i8 [ %1, %cond.false ], [ 0, %for.body ]
  %inc = add i8 %b.014, 1
  %exitcond.not = icmp eq i8 %inc, 0
  br i1 %exitcond.not, label %for.end, label %for.body

for.end:                                          ; preds = %cond.end
  ret i8 %cond
}
```

```
opt: /root/llvm-project/llvm/lib/Transforms/Vectorize/VPlanRecipes.cpp:2885: virtual void llvm::VPPredInstPHIRecipe::execute(llvm::VPTransformState&): Assertion `PredicatingBB && "Predicated block has no single predecessor."' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S --passes=loop-vectorize <source>
1.	Running pass "function(loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>)" on module "<source>"
2.	Running pass "loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>" on function "g"
 #0 0x0000000005603c18 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5603c18)
 #1 0x00000000056015a4 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x000071a65b642520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x000071a65b6969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x000071a65b642476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x000071a65b6287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x000071a65b62871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x000071a65b639e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x00000000035fc5b7 llvm::VPPredInstPHIRecipe::execute(llvm::VPTransformState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35fc5b7)
 #9 0x00000000035a9a8a llvm::VPBasicBlock::executeRecipes(llvm::VPTransformState*, llvm::BasicBlock*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35a9a8a)
#10 0x00000000035bc70d llvm::VPBasicBlock::execute(llvm::VPTransformState*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35bc70d)
#11 0x00000000035afb81 llvm::VPRegionBlock::execute(llvm::VPTransformState*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35afb81)
#12 0x00000000035bf201 llvm::VPlan::execute(llvm::VPTransformState*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35bf201)
#13 0x0000000003459b9b llvm::LoopVectorizationPlanner::executePlan(llvm::ElementCount, unsigned int, llvm::VPlan&, llvm::InnerLoopVectorizer&, llvm::DominatorTree*, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3459b9b)
#14 0x0000000003470889 llvm::LoopVectorizePass::processLoop(llvm::Loop*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3470889)
#15 0x0000000003472670 llvm::LoopVectorizePass::runImpl(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3472670)
#16 0x0000000003472cc3 llvm::LoopVectorizePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3472cc3)
#17 0x0000000002d824be llvm::detail::PassModel<llvm::Function, llvm::LoopVectorizePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2d824be)
#18 0x00000000053fa1f0 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x53fa1f0)
#19 0x0000000000e91dde llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe91dde)
#20 0x00000000053fa703 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x53fa703)
#21 0x0000000000e90c2e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe90c2e)
#22 0x00000000053f8320 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x53f8320)
#23 0x00000000009519ea llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x9519ea)
#24 0x00000000009451bc optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x9451bc)
#25 0x000071a65b629d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#26 0x000071a65b629e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#27 0x000000000093cdf5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x93cdf5)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

Bisected to 5f39be591714eba1be413e2b3ed6fc152a15bb8e

Fix patch:
commit b8c4eea3d8b2a2df9442319de14ef38c2492428d
Author: Ramkumar Ramachandra <ramkumar.ramachandra@codasip.com>
Date:   Mon Jun 2 15:56:35 2025 +0200

    [VPlan] Simplify PredPHI LiveIn -> LiveIn (#142271)
    
    5f39be5 ([VPlan] Use InstSimplifyFolder instead of TargetFolder) updated
    simplifyRecipe to fold live-ins to Values that are not necessarily
    Constant, but forgot to update the corresponding PredPHI folder, which
    still folds PredPHI constant -> constant. Update it to fold PredPHI
    LiveIn -> LiveIn.
    
    Fixes #141968.

diff --git a/llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp b/llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp
index 5b42a9056b69..348100124ba3 100644
--- a/llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp
+++ b/llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp
@@ -1015,13 +1015,11 @@ static void simplifyRecipe(VPRecipeBase &R, VPTypeAnalysis &TypeInfo) {
           .Default([](auto *) { return false; }))
     return;
 
-  // Fold PredPHI constant -> constant.
+  // Fold PredPHI LiveIn -> LiveIn.
   if (auto *PredPHI = dyn_cast<VPPredInstPHIRecipe>(&R)) {
     VPValue *Op = PredPHI->getOperand(0);
-    if (!Op->isLiveIn() || !Op->getLiveInIRValue())
-      return;
-    if (auto *C = dyn_cast<Constant>(Op->getLiveInIRValue()))
-      PredPHI->replaceAllUsesWith(Plan->getOrAddLiveIn(C));
+    if (Op->isLiveIn())
+      PredPHI->replaceAllUsesWith(Op);
   }
 
   VPValue *A;


Regression tests:
file: llvm/test/Transforms/LoopVectorize/X86/pr141968-instsimplifyfolder.ll
commands: opt -passes=loop-vectorize -S %s
tests: test_name: <module>
test_body: 
target triple = "x86_64"

define i8 @pr141968(i1 %cond, i8 %v) {
;
entry:
  %zext.true = zext i1 true to i16
  %sext = sext i8 %v to i16
  br label %loop.header

loop.header:                                      ; preds = %loop.latch, %entry
  %iv = phi i8 [ %iv.next, %loop.latch ], [ 0, %entry ]
  br i1 %cond, label %loop.latch, label %cond.false

cond.false:                                       ; preds = %loop.header
  %sdiv = sdiv i16 %sext, %zext.true
  %sdiv.trunc = trunc i16 %sdiv to i8
  br label %loop.latch

loop.latch:                                       ; preds = %cond.false, %loop.header
  %ret = phi i8 [ %sdiv.trunc, %cond.false ], [ 0, %loop.header ]
  %iv.next = add i8 %iv, 1
  %exitcond = icmp eq i8 %iv.next, 0
  br i1 %exitcond, label %exit, label %loop.header

exit:                                             ; preds = %loop.latch
  ret i8 %ret
}