Bug type: crash
Component: InferAddressSpaces
Bug location: llvm/lib/Transforms/Scalar/InferAddressSpaces.cpp: InferAddressSpacesImpl::updateAddressSpace
Issue title: [NVPTX][InferAddressSpaces] Assertion `Val && "isa<> used on a null pointer"' failed.
Labels: crash-on-valid
llvm:transforms
Reported by: XChy

Reproducer: https://godbolt.org/z/P3exKvMsT
Testcase:
```llvm
target datalayout = "e-p6:32:32-i64:64-i128:128-i256:256-v16:16-v32:32-n16:32:64"
target triple = "nvptx64-unknown-nvidiacl"

define ptr @func_64() {
entry:
  %p_1027_1 = alloca i16, align 2
  br label %for.cond2.3

for.cond2.3:                                      ; preds = %entry
  %l_171.1.3 = phi ptr [ null, %entry ]
  br i1 false, label %for.cond2.4, label %BS_LABEL_0.preheader.4

BS_LABEL_0.preheader.4:                           ; preds = %for.cond2.3
  br label %for.cond2.4

for.cond2.4:                                      ; preds = %BS_LABEL_0.preheader.4, %for.cond2.3
  %l_171.1.4 = phi ptr [ %p_1027_1, %BS_LABEL_0.preheader.4 ], [ %l_171.1.3, %for.cond2.3 ]
  ret ptr %l_171.1.4
}
```

Dump:
```
llc: /root/llvm-project/llvm/include/llvm/Support/Casting.h:109: static bool llvm::isa_impl_cl<To, const From*>::doit(const From*) [with To = llvm::PoisonValue; From = llvm::Value]: Assertion `Val && "isa<> used on a null pointer"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/llc -o /app/output.s -x86-asm-syntax=intel -O1 <source>
1.	Running pass 'Function Pass Manager' on module '<source>'.
2.	Running pass 'Early CSE' on function '@func_64'
 #0 0x000000000421f3e8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x421f3e8)
 #1 0x000000000421c294 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x0000712cf8642520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x0000712cf86969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x0000712cf8642476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x0000712cf86287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x0000712cf862871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x0000712cf8639e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x0000000002ba36a3 (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x2ba36a3)
 #9 0x0000000002bc87ab simplifyInstructionWithOperands(llvm::Instruction*, llvm::ArrayRef<llvm::Value*>, llvm::SimplifyQuery const&, unsigned int) InstructionSimplify.cpp:0:0
#10 0x0000000002bc89cb llvm::simplifyInstruction(llvm::Instruction*, llvm::SimplifyQuery const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x2bc89cb)
#11 0x0000000003aba91f (anonymous namespace)::EarlyCSE::processNode(llvm::DomTreeNodeBase<llvm::BasicBlock>*) EarlyCSE.cpp:0:0
#12 0x0000000003abcdc6 (anonymous namespace)::EarlyCSE::run() EarlyCSE.cpp:0:0
#13 0x0000000003abf7cb (anonymous namespace)::EarlyCSELegacyCommonPass<false>::runOnFunction(llvm::Function&) (.part.0) EarlyCSE.cpp:0:0
#14 0x00000000037503d6 llvm::FPPassManager::runOnFunction(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x37503d6)
#15 0x0000000003750781 llvm::FPPassManager::runOnModule(llvm::Module&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x3750781)
#16 0x0000000003750fef llvm::legacy::PassManagerImpl::run(llvm::Module&) (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x3750fef)
#17 0x00000000008fdcc4 compileModule(char**, llvm::LLVMContext&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) llc.cpp:0:0
#18 0x00000000007c8139 main (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x7c8139)
#19 0x0000712cf8629d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#20 0x0000712cf8629e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#21 0x00000000008f2ec5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/llc+0x8f2ec5)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

Comments: author: XChy
body: The problem is in InferAddressSpace:
```llvm
*** IR Dump Before Infer address spaces (infer-address-spaces) ***
define ptr @func_64() {
entry:
  %p_1027_1 = alloca i16, align 2
  %0 = addrspacecast ptr %p_1027_1 to ptr addrspace(5)
  %1 = addrspacecast ptr addrspace(5) %0 to ptr
  br label %for.cond2.3

for.cond2.3:                                      ; preds = %entry
  %l_171.1.3 = phi ptr [ null, %entry ]
  br i1 false, label %for.cond2.4, label %BS_LABEL_0.preheader.4

BS_LABEL_0.preheader.4:                           ; preds = %for.cond2.3
  br label %for.cond2.4

for.cond2.4:                                      ; preds = %BS_LABEL_0.preheader.4, %for.cond2.3
  %l_171.1.4 = phi ptr [ %p_1027_1, %BS_LABEL_0.preheader.4 ], [ %l_171.1.3, %for.cond2.3 ]
  ret ptr %l_171.1.4
}
*** IR Dump Before NVPTX lower atomics of local memory (nvptx-atomic-lower) ***
define ptr @func_64() {
entry:
  %p_1027_1 = alloca i16, align 2
  %0 = addrspacecast ptr %p_1027_1 to ptr addrspace(5)
  %1 = addrspacecast ptr addrspace(5) %0 to ptr
  br label %for.cond2.3

for.cond2.3:                                      ; preds = %entry
  br i1 false, label %for.cond2.4, label %BS_LABEL_0.preheader.4

BS_LABEL_0.preheader.4:                           ; preds = %for.cond2.3
  br label %for.cond2.4

for.cond2.4:                                      ; preds = %BS_LABEL_0.preheader.4, %for.cond2.3
  %l_171.1.4 = phi ptr addrspace(5) [ %0, %BS_LABEL_0.preheader.4 ], [ <null operand!>, %for.cond2.3 ]
  %2 = addrspacecast ptr addrspace(5) %l_171.1.4 to ptr
  ret ptr %2
}
```

Fix patch:
commit 8b5e95b1fd2fa49a7c1607e294659f2c0ec12d69
Author: Hongyu Chen <xxs_chy@outlook.com>
Date:   Sun Feb 8 01:20:19 2026 +0800

    [InferAddressSpaces] Initialize op(generic const, generic const, ...) -> generic (#172143)
    
    Fixes #171890
    If the pointer operands of an instruction are all constants with generic
    AS, we always infer the AS of the instruction as uninitialized finally.
    And the rewrite process will skip cloning the instruction, producing
    invalid IR.
    This patch fixes it by inferring the AS of this kind of instruction as
    flat. Maybe we can fold the operator with all constants to get better
    performance, but I think this case is rare in the real world.

diff --git a/llvm/lib/Transforms/Scalar/InferAddressSpaces.cpp b/llvm/lib/Transforms/Scalar/InferAddressSpaces.cpp
index 03efc156df1e..93da510c5fbc 100644
--- a/llvm/lib/Transforms/Scalar/InferAddressSpaces.cpp
+++ b/llvm/lib/Transforms/Scalar/InferAddressSpaces.cpp
@@ -1102,7 +1102,8 @@ bool InferAddressSpacesImpl::updateAddressSpace(
   } else {
     // Otherwise, infer the address space from its pointer operands.
     SmallVector<Constant *, 2> ConstantPtrOps;
-    for (Value *PtrOperand : getPointerOperands(V, *DL, TTI)) {
+    SmallVector<Value *, 2> PtrOps = getPointerOperands(V, *DL, TTI);
+    for (Value *PtrOperand : PtrOps) {
       auto I = InferredAddrSpace.find(PtrOperand);
       unsigned OperandAS;
       if (I == InferredAddrSpace.end()) {
@@ -1133,12 +1134,18 @@ bool InferAddressSpacesImpl::updateAddressSpace(
       if (NewAS == FlatAddrSpace)
         break;
     }
+
     if (NewAS != FlatAddrSpace && NewAS != UninitializedAddressSpace) {
       if (any_of(ConstantPtrOps, [=](Constant *C) {
             return !isSafeToCastConstAddrSpace(C, NewAS);
           }))
         NewAS = FlatAddrSpace;
     }
+
+    // operator(flat const, flat const, ...) -> flat
+    if (NewAS == UninitializedAddressSpace &&
+        PtrOps.size() == ConstantPtrOps.size())
+      NewAS = FlatAddrSpace;
   }
 
   unsigned OldAS = InferredAddrSpace.lookup(&V);


Regression tests:
file: llvm/test/Transforms/InferAddressSpaces/NVPTX/nullptr.ll
commands: opt -S -passes=infer-address-spaces %s
tests: test_name: <module>
test_body: 
target triple = "nvptx64--"

define ptr @pr171890(i1 %c) {
;
entry:
  %stack = alloca i16, align 2
  %const = getelementptr i8, ptr null, i64 1
  %sel = select i1 %c, ptr %stack, ptr %const
  ret ptr %sel
}