Bug type: crash
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: BoUpSLP::buildTree_rec
BoUpSLP::collectValuesToDemote
Issue title: [SLPVectorizer] Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
Labels: llvm:SLPVectorizer
crash-on-valid
Reported by: dtcxzyw

Reproducer: https://godbolt.org/z/68MKbnE4W
```
; bin/opt -O2 reduced.ll -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

@g_3 = internal unnamed_addr global i64 0
@g_127 = external local_unnamed_addr global [3 x i32]
@g_211 = external local_unnamed_addr global i32

define i8 @func_125() {
entry:
  %call42 = call ptr @func_178()
  ret i8 0
}

define ptr @func_178() {
entry:
  %0 = load i32, ptr @g_211, align 4
  %tobool158.not = icmp eq i32 %0, 0
  br i1 %tobool158.not, label %for.inc434, label %for.cond166.preheader

for.cond166.preheader:                            ; preds = %entry
  br label %for.cond166

for.cond166:                                      ; preds = %for.cond166.preheader, %for.cond166
  %1 = phi i64 [ %2, %for.cond166 ], [ poison, %for.cond166.preheader ]
  %2 = phi i64 [ %inc255, %for.cond166 ], [ 0, %for.cond166.preheader ]
  %cmp167 = icmp samesign ult i64 %2, 61
  %inc255 = add nuw nsw i64 %2, 1
  br i1 %cmp167, label %for.cond166, label %for.inc434.loopexit

for.inc434.loopexit:                              ; preds = %for.cond166
  %.lcssa = phi i64 [ %1, %for.cond166 ]
  store i64 %.lcssa, ptr @g_3, align 8
  br label %for.inc434

for.inc434:                                       ; preds = %for.inc434.loopexit, %entry
  store i32 1, ptr @g_211, align 4
  %3 = load i64, ptr @g_3, align 8
  %conv.i = trunc nuw nsw i64 %3 to i32
  %4 = load i32, ptr @g_127, align 4
  %and.i = and i32 %4, %conv.i
  %cmp.i = icmp eq i32 %and.i, 0
  %conv8.i = sext i32 %and.i to i64
  %sext = shl i64 %3, 32
  %conv9.i = ashr exact i64 %sext, 32
  %g_211.promoted5 = load i32, ptr @g_211, align 4
  br label %for.body447

for.body447:                                      ; preds = %for.inc434, %cleanup552
  %p_181.addr.08 = phi i64 [ -13, %for.inc434 ], [ %conv564, %cleanup552 ]
  %and14.i1.lcssa67 = phi i32 [ %g_211.promoted5, %for.inc434 ], [ %and14.i.lcssa, %cleanup552 ]
  br label %if.then489

if.then489:                                       ; preds = %for.body447, %safe_div_func_int64_t_s_s.exit
  %l_317.03 = phi i32 [ 2, %for.body447 ], [ %sub, %safe_div_func_int64_t_s_s.exit ]
  %and14.i12 = phi i32 [ %and14.i1.lcssa67, %for.body447 ], [ %and14.i, %safe_div_func_int64_t_s_s.exit ]
  br i1 %cmp.i, label %safe_div_func_int64_t_s_s.exit, label %lor.lhs.false.i

lor.lhs.false.i:                                  ; preds = %if.then489
  %div.i = sdiv i64 %conv8.i, %conv9.i
  %5 = trunc i64 %div.i to i16
  br label %safe_div_func_int64_t_s_s.exit

safe_div_func_int64_t_s_s.exit:                   ; preds = %lor.lhs.false.i, %if.then489
  %cond.i = phi i16 [ %5, %lor.lhs.false.i ], [ 0, %if.then489 ]
  %call12.i = tail call i16 @llvm.bswap.i16(i16 %cond.i)
  %conv13.i = zext i16 %call12.i to i32
  %and14.i = and i32 %and14.i12, %conv13.i
  %call26.i = load volatile ptr, ptr null, align 8
  %sub = add nsw i32 %l_317.03, -1
  %cmp482 = icmp sgt i32 %l_317.03, 0
  br i1 %cmp482, label %if.then489, label %cleanup552

cleanup552:                                       ; preds = %safe_div_func_int64_t_s_s.exit
  %and14.i.lcssa = phi i32 [ %and14.i, %safe_div_func_int64_t_s_s.exit ]
  %add.i = add nsw i64 %p_181.addr.08, 7
  %conv564 = and i64 %add.i, 255
  %6 = and i64 %p_181.addr.08, 255
  %cmp445.not = icmp eq i64 %6, 22
  br i1 %cmp445.not, label %for.end565, label %for.body447

for.end565:                                       ; preds = %cleanup552
  %and14.i.lcssa.lcssa = phi i32 [ %and14.i.lcssa, %cleanup552 ]
  store i32 %conv.i, ptr getelementptr inbounds nuw (i8, ptr @g_127, i64 8), align 4
  store i32 %and14.i.lcssa.lcssa, ptr @g_211, align 4
  ret ptr null
}

define ptr @func_183(i64 %p_185) {
entry:
  %call = call i64 @builtin_uaddl_overflow(i64 %p_185, i64 0)
  unreachable
}

define i64 @builtin_uaddl_overflow(i64 %x, i64 %y) {
entry:
  %0 = call { i64, i1 } @llvm.uadd.with.overflow.i64(i64 %x, i64 %y)
  %1 = extractvalue { i64, i1 } %0, 1
  %conv = zext i1 %1 to i64
  ret i64 %conv
}
```
```
opt: /root/llvm-project/llvm/include/llvm/Support/Casting.h:578: decltype(auto) llvm::cast(From*) [with To = llvm::Instruction; From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -O2 <source>
1.	Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O2>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "<source>"
2.	Running pass "slp-vectorizer" on function "func_125"
 #0 0x00000000052803a8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x52803a8)
 #1 0x000000000527ddac SignalHandler(int) Signals.cpp:0:0
 #2 0x0000776446c42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x0000776446c969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x0000776446c42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x0000776446c287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x0000776446c2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x0000776446c39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x0000000000b6a41a (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xb6a41a)
 #9 0x0000000004253c98 llvm::slpvectorizer::BoUpSLP::collectValuesToDemote(llvm::slpvectorizer::BoUpSLP::TreeEntry const&, bool, unsigned int&, llvm::SmallVectorImpl<unsigned int>&, llvm::DenseSet<llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::DenseMapInfo<llvm::slpvectorizer::BoUpSLP::TreeEntry const*, void>>&, llvm::SmallDenseSet<unsigned int, 8u, llvm::DenseMapInfo<unsigned int, void>> const&, unsigned int&, bool&, bool) const::'lambda10'(unsigned int, unsigned int)::operator()(unsigned int, unsigned int) const::'lambda'(llvm::Value*)::operator()(llvm::Value*) const SLPVectorizer.cpp:0:0
#10 0x0000000004253f67 bool llvm::function_ref<bool (unsigned int, unsigned int)>::callback_fn<llvm::slpvectorizer::BoUpSLP::collectValuesToDemote(llvm::slpvectorizer::BoUpSLP::TreeEntry const&, bool, unsigned int&, llvm::SmallVectorImpl<unsigned int>&, llvm::DenseSet<llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::DenseMapInfo<llvm::slpvectorizer::BoUpSLP::TreeEntry const*, void>>&, llvm::SmallDenseSet<unsigned int, 8u, llvm::DenseMapInfo<unsigned int, void>> const&, unsigned int&, bool&, bool) const::'lambda10'(unsigned int, unsigned int)>(long, unsigned int, unsigned int) SLPVectorizer.cpp:0:0
#11 0x00000000042e2312 llvm::slpvectorizer::BoUpSLP::collectValuesToDemote(llvm::slpvectorizer::BoUpSLP::TreeEntry const&, bool, unsigned int&, llvm::SmallVectorImpl<unsigned int>&, llvm::DenseSet<llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::DenseMapInfo<llvm::slpvectorizer::BoUpSLP::TreeEntry const*, void>>&, llvm::SmallDenseSet<unsigned int, 8u, llvm::DenseMapInfo<unsigned int, void>> const&, unsigned int&, bool&, bool) const::'lambda6'(unsigned int&, llvm::ArrayRef<llvm::slpvectorizer::BoUpSLP::TreeEntry const*>, llvm::function_ref<bool (unsigned int, unsigned int)>)::operator()(unsigned int&, llvm::ArrayRef<llvm::slpvectorizer::BoUpSLP::TreeEntry const*>, llvm::function_ref<bool (unsigned int, unsigned int)>) const SLPVectorizer.cpp:0:0
#12 0x00000000042deacb llvm::slpvectorizer::BoUpSLP::collectValuesToDemote(llvm::slpvectorizer::BoUpSLP::TreeEntry const&, bool, unsigned int&, llvm::SmallVectorImpl<unsigned int>&, llvm::DenseSet<llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::DenseMapInfo<llvm::slpvectorizer::BoUpSLP::TreeEntry const*, void>>&, llvm::SmallDenseSet<unsigned int, 8u, llvm::DenseMapInfo<unsigned int, void>> const&, unsigned int&, bool&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x42deacb)
#13 0x00000000042df8a0 llvm::slpvectorizer::BoUpSLP::computeMinimumValueSizes()::'lambda0'(llvm::slpvectorizer::BoUpSLP::TreeEntry const&, bool, bool, unsigned int, unsigned int, bool, bool)::operator()(llvm::slpvectorizer::BoUpSLP::TreeEntry const&, bool, bool, unsigned int, unsigned int, bool, bool) const SLPVectorizer.cpp:0:0
#14 0x00000000042e03d0 llvm::slpvectorizer::BoUpSLP::computeMinimumValueSizes() (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x42e03d0)
#15 0x000000000431e02d (anonymous namespace)::HorizontalReduction::tryToReduce(llvm::slpvectorizer::BoUpSLP&, llvm::DataLayout const&, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo const&, llvm::AssumptionCache*) SLPVectorizer.cpp:0:0
#16 0x000000000432015d llvm::SLPVectorizerPass::vectorizeHorReduction(llvm::PHINode*, llvm::Instruction*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::SmallVectorImpl<llvm::WeakTrackingVH>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x432015d)
#17 0x000000000432494b llvm::SLPVectorizerPass::vectorizeRootInstruction(llvm::PHINode*, llvm::Instruction*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (.constprop.0) SLPVectorizer.cpp:0:0
#18 0x000000000432904f llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x432904f)
#19 0x000000000432fa86 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#20 0x00000000043305bb llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x43305bb)
#21 0x0000000003036f1e llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3036f1e)
#22 0x000000000507d7f0 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x507d7f0)
#23 0x0000000000e7023e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe7023e)
#24 0x000000000507c10b llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x507c10b)
#25 0x0000000000e6f8ce llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe6f8ce)
#26 0x000000000507bb10 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x507bb10)
#27 0x000000000094448a llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x94448a)
#28 0x0000000000936a29 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x936a29)
#29 0x0000776446c29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#30 0x0000776446c29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#31 0x000000000092e305 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x92e305)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

llvm version: 7e01a322f850e86be9eefde8ae5a30e532d22cfa
I am working to provide a single-pass reproducer.


Comments: author: dtcxzyw
body: Missing poison check: https://github.com/llvm/llvm-project/blob/6c5941b09fca487efc5000c82bbce6054bf36a7c/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp#L18000

author: dtcxzyw
body: > I am working to provide a single-pass reproducer.

It is weird that the single-pass reproducer doesn't work even with `--preserve-ll-uselistorder`.


Fix patch:
commit 092d6283838dea79670750b9415955c5f0cb5178
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Mon Jan 13 09:02:56 2025 -0800

    [SLP]Check for div/rem instructions before extending with poisons
    
    Need to check if the instructions can be safely extended with poison
    before actually doing this to avoid incorrect transformations.
    
    Fixes #122691

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index df46c69ff3ab..4b0ed5b30179 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -8091,6 +8091,13 @@ void BoUpSLP::buildTree_rec(ArrayRef<Value *> VL, unsigned Depth,
             NonUniqueValueVL.append(
                 PWSz - UniqueValues.size(),
                 PoisonValue::get(UniqueValues.front()->getType()));
+            // Check that extended with poisons operations are still valid for
+            // vectorization (div/rem are not allowed).
+            if (!getSameOpcode(NonUniqueValueVL, *TLI).valid()) {
+              LLVM_DEBUG(dbgs() << "SLP: Scalar used twice in bundle.\n");
+              newTreeEntry(VL, std::nullopt /*not vectorized*/, S, UserTreeIdx);
+              return false;
+            }
             VL = NonUniqueValueVL;
           }
           return true;
@@ -17818,7 +17825,7 @@ bool BoUpSLP::collectValuesToDemote(
   };
   if (E.isGather() || !Visited.insert(&E).second ||
       any_of(E.Scalars, [&](Value *V) {
-        return all_of(V->users(), [&](User *U) {
+        return !isa<PoisonValue>(V) && all_of(V->users(), [&](User *U) {
           return isa<InsertElementInst>(U) && !getTreeEntry(U);
         });
       }))


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/X86/div-possibly-extended-with-poisons.ll
commands: opt -S -O2 < %s
tests: test_name: <module>
test_body: target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

@g_3 = internal unnamed_addr global i64 0
@g_127 = external local_unnamed_addr global [3 x i32]
@g_211 = external local_unnamed_addr global i32

define i8 @func_125() {
entry:
  %call42 = call ptr @func_178()
  ret i8 0
}

define ptr @func_178() {
entry:
  %0 = load i32, ptr @g_211, align 4
  %tobool158.not = icmp eq i32 %0, 0
  br i1 %tobool158.not, label %for.inc434, label %for.cond166.preheader

for.cond166.preheader:                            ; preds = %entry
  br label %for.cond166

for.cond166:                                      ; preds = %for.cond166.preheader, %for.cond166
  %1 = phi i64 [ %2, %for.cond166 ], [ poison, %for.cond166.preheader ]
  %2 = phi i64 [ %inc255, %for.cond166 ], [ 0, %for.cond166.preheader ]
  %cmp167 = icmp samesign ult i64 %2, 61
  %inc255 = add nuw nsw i64 %2, 1
  br i1 %cmp167, label %for.cond166, label %for.inc434.loopexit

for.inc434.loopexit:                              ; preds = %for.cond166
  %.lcssa = phi i64 [ %1, %for.cond166 ]
  store i64 %.lcssa, ptr @g_3, align 8
  br label %for.inc434

for.inc434:                                       ; preds = %for.inc434.loopexit, %entry
  store i32 1, ptr @g_211, align 4
  %3 = load i64, ptr @g_3, align 8
  %conv.i = trunc nuw nsw i64 %3 to i32
  %4 = load i32, ptr @g_127, align 4
  %and.i = and i32 %4, %conv.i
  %cmp.i = icmp eq i32 %and.i, 0
  %conv8.i = sext i32 %and.i to i64
  %sext = shl i64 %3, 32
  %conv9.i = ashr exact i64 %sext, 32
  %g_211.promoted5 = load i32, ptr @g_211, align 4
  br label %for.body447

for.body447:                                      ; preds = %for.inc434, %cleanup552
  %p_181.addr.08 = phi i64 [ -13, %for.inc434 ], [ %conv564, %cleanup552 ]
  %and14.i1.lcssa67 = phi i32 [ %g_211.promoted5, %for.inc434 ], [ %and14.i.lcssa, %cleanup552 ]
  br label %if.then489

if.then489:                                       ; preds = %for.body447, %safe_div_func_int64_t_s_s.exit
  %l_317.03 = phi i32 [ 2, %for.body447 ], [ %sub, %safe_div_func_int64_t_s_s.exit ]
  %and14.i12 = phi i32 [ %and14.i1.lcssa67, %for.body447 ], [ %and14.i, %safe_div_func_int64_t_s_s.exit ]
  br i1 %cmp.i, label %safe_div_func_int64_t_s_s.exit, label %lor.lhs.false.i

lor.lhs.false.i:                                  ; preds = %if.then489
  %div.i = sdiv i64 %conv8.i, %conv9.i
  %5 = trunc i64 %div.i to i16
  br label %safe_div_func_int64_t_s_s.exit

safe_div_func_int64_t_s_s.exit:                   ; preds = %lor.lhs.false.i, %if.then489
  %cond.i = phi i16 [ %5, %lor.lhs.false.i ], [ 0, %if.then489 ]
  %call12.i = tail call i16 @llvm.bswap.i16(i16 %cond.i)
  %conv13.i = zext i16 %call12.i to i32
  %and14.i = and i32 %and14.i12, %conv13.i
  %call26.i = load volatile ptr, ptr null, align 8
  %sub = add nsw i32 %l_317.03, -1
  %cmp482 = icmp sgt i32 %l_317.03, 0
  br i1 %cmp482, label %if.then489, label %cleanup552

cleanup552:                                       ; preds = %safe_div_func_int64_t_s_s.exit
  %and14.i.lcssa = phi i32 [ %and14.i, %safe_div_func_int64_t_s_s.exit ]
  %add.i = add nsw i64 %p_181.addr.08, 7
  %conv564 = and i64 %add.i, 255
  %6 = and i64 %p_181.addr.08, 255
  %cmp445.not = icmp eq i64 %6, 22
  br i1 %cmp445.not, label %for.end565, label %for.body447

for.end565:                                       ; preds = %cleanup552
  %and14.i.lcssa.lcssa = phi i32 [ %and14.i.lcssa, %cleanup552 ]
  store i32 %conv.i, ptr getelementptr inbounds nuw (i8, ptr @g_127, i64 8), align 4
  store i32 %and14.i.lcssa.lcssa, ptr @g_211, align 4
  ret ptr null
}

define ptr @func_183(i64 %p_185) {
entry:
  %call = call i64 @builtin_uaddl_overflow(i64 %p_185, i64 0)
  unreachable
}

define i64 @builtin_uaddl_overflow(i64 %x, i64 %y) {
entry:
  %0 = call { i64, i1 } @llvm.uadd.with.overflow.i64(i64 %x, i64 %y)
  %1 = extractvalue { i64, i1 } %0, 1
  %conv = zext i1 %1 to i64
  ret i64 %conv
}