Bug type: crash
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: BoUpSLP::analyzeRtStrideCandidate
Issue title: [SLPVectorizer] Crash when offset equals DenseMap reserved keys for int64_t (regressed by 3572e62991f4)
Labels: llvm:SLPVectorizer
crash
Reported by: mateuszchudyk

A change introduced in [3572e62](https://github.com/llvm/llvm-project/commit/3572e62991f4) made SLPVectorizer use a DenseMap<int64_t, ...> keyed by an offset. When the offset equals to INT64_MAX or INT64_MAX-1 the pass crashes, because those two values are used by this DenseMap as EmptyKey and TombstoneKey.

**Error message**

> bool llvm::DenseMapBase<DerivedT, KeyT, ValueT, KeyInfoT, BucketT>::LookupBucketFor(const LookupKeyT&, BucketT*&) [with LookupKeyT = long int; DerivedT = llvm::SmallDenseMap<long int, std::pair<llvm::SmallVector<llvm::Value*>, llvm::SmallVector<unsigned int> > >; KeyT = long int; ValueT = std::pair<llvm::SmallVector<llvm::Value*>, llvm::SmallVector<unsigned int> >; KeyInfoT = llvm::DenseMapInfo<long int>; BucketT = llvm::detail::DenseMapPair<long int, std::pair<llvm::SmallVector<llvm::Value*>, llvm::SmallVector<unsigned int> > >]: Assertion `!KeyInfoT::isEqual(Val, EmptyKey) && !KeyInfoT::isEqual(Val, TombstoneKey) && "Empty/Tombstone value shouldn't be inserted into map!"' failed.

**Minimal reproducer**
```llvm
define void @crash() {
entry:
  %0 = getelementptr i8, ptr addrspace(1) null, i64 9223372036854775807
  %a = load float, ptr addrspace(1) %0, align 4
  %b = load float, ptr addrspace(1) null, align 4
  %c = fadd float %a, %b
  store float %c, ptr addrspace(1) null, align 4
  ret void
}
```
```
opt -passes=slp-vectorizer -S crash.ll
```
https://godbolt.org/z/Wdz1jMda6

**Proposed Fix**
Disable this code-path for offsets equal to EmptyKey or TomestoneKey. In the long run, consider changing the data structure or changing the key type (wider type or wrapper structure) to prevent such collisions.




Fix patch:
commit 7ec7907b80f8137f06bfb84b47f4a9b4805402ba
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Mon Feb 16 11:05:58 2026 -0800

    [SLP] Fix a very long loads offset, being stored in DenseMap
    
    Added a check for a very long offset to avoid a crash in the compiler
    
    Fixes #181682

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index b29367fa1543..e50fb370ad7d 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -7231,6 +7231,10 @@ bool BoUpSLP::analyzeRtStrideCandidate(ArrayRef<Value *> PointerOps,
         if (!SC)
           continue;
         Offset = SC->getAPInt().getSExtValue();
+        if (Offset >= std::numeric_limits<int64_t>::max() - 1) {
+          Offset = 0;
+          continue;
+        }
         break;
       }
     }


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/loads-with-large-distance.ll
commands: opt -passes=slp-vectorizer -S < %s
tests: test_name: <module>
test_body: 
define void @test() {
;
entry:
  %0 = getelementptr i8, ptr addrspace(1) null, i64 9223372036854775807
  %a = load float, ptr addrspace(1) %0, align 4
  %b = load float, ptr addrspace(1) null, align 4
  %c = fadd float %a, %b
  store float %c, ptr addrspace(1) null, align 4
  ret void
}