Bug type: crash
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: BoUpSLP::getSpillCost
Issue title: slpvectorizer crash
Labels: llvm:SLPVectorizer
crash
Reported by: TatyanaDoubts

To reproduce run opt with the test below with -passes=slp-vectorizer -slp-threshold=-99999
```
; ModuleID = './reduced.ll'
source_filename = "./reduced.ll"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128-ni:1-p2:32:8:8:32-ni:2"
target triple = "x86_64-unknown-linux-gnu"

define void @wombat(i32 %arg) #0 gc "statepoint-example" {
bb:
  %load = load i32, ptr addrspace(3) null, align 4
  %load1 = load i32, ptr addrspace(3) null, align 4
  %load2 = load i32, ptr addrspace(3) null, align 4
  %load3 = load i32, ptr addrspace(3) null, align 4
  br label %bb4

bb4:                                              ; preds = %bb
  switch i32 0, label %bb8 [
    i32 0, label %bb7
    i32 1, label %bb21
  ]

bb5:                                              ; No predecessors!
  %srem = srem i32 0, 0
  br label %bb21

bb6:                                              ; No predecessors!
  br label %bb12

bb7:                                              ; preds = %bb4
  ret void

bb8:                                              ; preds = %bb4
  %phi = phi i32 [ 0, %bb4 ]
  %phi9 = phi i32 [ 0, %bb4 ]
  %phi10 = phi i32 [ 0, %bb4 ]
  %phi11 = phi i32 [ 0, %bb4 ]
  br label %bb12

bb12:                                             ; preds = %bb8, %bb6
  %phi13 = phi i32 [ %load, %bb8 ], [ 0, %bb6 ]
  %phi14 = phi i32 [ %load1, %bb8 ], [ 0, %bb6 ]
  %phi15 = phi i32 [ %load2, %bb8 ], [ %arg, %bb6 ]
  %phi16 = phi i32 [ %load3, %bb8 ], [ 0, %bb6 ]
  %phi17 = phi i32 [ %phi, %bb8 ], [ %srem, %bb6 ]
  %phi18 = phi i32 [ %phi11, %bb8 ], [ 0, %bb6 ]
  %phi19 = phi i32 [ %phi9, %bb8 ], [ 0, %bb6 ]
  %phi20 = phi i32 [ %phi10, %bb8 ], [ 0, %bb6 ]
  ret void

bb21:                                             ; preds = %bb5, %bb4
  ret void
}

attributes #0 = { "target-features"="+prfchw,-cldemote,+avx,+aes,+sahf,+pclmul,-xop,+crc32,-amx-fp8,+xsaves,-avx512fp16,-usermsr,-sm4,-egpr,+sse4.1,-avx512ifma,+xsave,+sse4.2,-tsxldtrk,-sm3,-ptwrite,-widekl,-movrs,-invpcid,+64bit,+xsavec,-avx10.1-512,-avx512vpopcntdq,+cmov,-avx512vp2intersect,-avx512cd,+movbe,-avxvnniint8,-ccmp,-amx-int8,-kl,-avx10.1-256,-sha512,-avxvnni,-rtm,+adx,+avx2,-hreset,-movdiri,-serialize,-vpclmulqdq,-avx512vl,-uintr,-cf,+clflushopt,-raoint,-cmpccxadd,+bmi,-amx-tile,+sse,-avx10.2-256,-gfni,-avxvnniint16,-amx-fp16,-zu,-ndd,+xsaveopt,+rdrnd,-avx512f,-amx-bf16,-avx512bf16,-avx512vnni,-push2pop2,+cx8,-avx512bw,+sse3,-pku,-nf,-amx-tf32,-amx-avx512,+fsgsbase,+clzero,-mwaitx,-lwp,+lzcnt,+sha,-movdir64b,-ppx,+wbnoinvd,-enqcmd,-amx-transpose,-avx10.2-512,-avxneconvert,-tbm,-pconfig,-amx-complex,+ssse3,+cx16,+bmi2,+fma,+popcnt,-avxifma,+f16c,-avx512bitalg,-rdpru,+clwb,+mmx,+sse2,+rdseed,-avx512vbmi2,-prefetchi,-amx-movrs,+rdpid,-fma4,-avx512vbmi,-shstk,-vaes,-waitpkg,-sgx,+fxsr,-avx512dq,+sse4a" }
```
Reproducer: https://godbolt.org/z/1E6shqxdd

Stack dump:
```
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=slp-vectorizer -slp-threshold=-99999 <source>
1.	Running pass "function(slp-vectorizer)" on module "<source>"
2.	Running pass "slp-vectorizer" on function "wombat"
 #0 0x000000000549f758 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x549f758)
 #1 0x000000000549d0e4 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007d8bfda42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00000000017c9e90 llvm::BasicBlock::getTerminator() const (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x17c9e90)
 #4 0x0000000004492866 llvm::slpvectorizer::BoUpSLP::getSpillCost() (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4492866)
 #5 0x00000000044fbea8 llvm::slpvectorizer::BoUpSLP::getTreeCost(llvm::ArrayRef<llvm::Value*>, llvm::InstructionCost) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x44fbea8)
 #6 0x0000000004504152 llvm::SLPVectorizerPass::tryToVectorizeList(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4504152)
 #7 0x000000000450937d bool tryToVectorizeSequence<llvm::Value>(llvm::SmallVectorImpl<llvm::Value*>&, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::ArrayRef<llvm::Value*>, bool)>, bool, llvm::slpvectorizer::BoUpSLP&) (.constprop.0) SLPVectorizer.cpp:0:0
 #8 0x000000000450ad55 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x450ad55)
 #9 0x0000000004512cbe llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#10 0x000000000451387b llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x451387b)
#11 0x00000000031ad81e llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x31ad81e)
#12 0x000000000529b7a0 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x529b7a0)
#13 0x0000000000e7a28e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe7a28e)
#14 0x000000000529a073 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x529a073)
#15 0x0000000000e792ae llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe792ae)
#16 0x0000000005299a80 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5299a80)
#17 0x000000000093f60a llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x93f60a)
#18 0x0000000000932cfc optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x932cfc)
#19 0x00007d8bfda29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#20 0x00007d8bfda29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#21 0x000000000092a935 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x92a935)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```


Fix patch:
commit 1bfc61064ab46e44865453d2c2176f5e7f96987c
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Fri Mar 28 11:37:42 2025 -0700

    [SLP]Fix spill cost analysis for split vectorized nodes
    
    If the entry is SplitVectorize, it can be skipped in favor of its
    operands, operands allow correctly detect spill costs.
    
    Fixes #133288

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index f29fb6780253..850895895d44 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -13347,7 +13347,8 @@ InstructionCost BoUpSLP::getSpillCost() {
     for (const TreeEntry *Op : Operands) {
       if (!Op->isGather())
         LiveEntries.push_back(Op);
-      if ((Entry->getOpcode() != Instruction::PHI && Op->isGather()) ||
+      if (Entry->State == TreeEntry::SplitVectorize ||
+          (Entry->getOpcode() != Instruction::PHI && Op->isGather()) ||
           (Op->isGather() && allConstant(Op->Scalars)))
         continue;
       Budget = 0;


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/X86/split-node-parent-operands-in-spill.ll
commands: opt -S --passes=slp-vectorizer -mtriple=x86_64-unknown-linux-gnu -slp-threshold=-99999 -mattr=+sse4.1 < %s
tests: test_name: <module>
test_body: 
define void @test(i32 %arg) {
;
bb:
  %load = load i32, ptr addrspace(3) null, align 4
  %load1 = load i32, ptr addrspace(3) null, align 4
  %load2 = load i32, ptr addrspace(3) null, align 4
  %load3 = load i32, ptr addrspace(3) null, align 4
  br label %bb4

bb4:
  switch i32 0, label %bb8 [
  i32 0, label %bb7
  i32 1, label %bb21
  ]

bb5:
  %srem = srem i32 0, 0
  br label %bb21

bb6:
  br label %bb12

bb7:
  ret void

bb8:
  %phi = phi i32 [ 0, %bb4 ]
  %phi9 = phi i32 [ 0, %bb4 ]
  %phi10 = phi i32 [ 0, %bb4 ]
  %phi11 = phi i32 [ 0, %bb4 ]
  br label %bb12

bb12:
  %phi13 = phi i32 [ %load, %bb8 ], [ 0, %bb6 ]
  %phi14 = phi i32 [ %load1, %bb8 ], [ 0, %bb6 ]
  %phi15 = phi i32 [ %load2, %bb8 ], [ %arg, %bb6 ]
  %phi16 = phi i32 [ %load3, %bb8 ], [ 0, %bb6 ]
  %phi17 = phi i32 [ %phi, %bb8 ], [ %srem, %bb6 ]
  %phi18 = phi i32 [ %phi11, %bb8 ], [ 0, %bb6 ]
  %phi19 = phi i32 [ %phi9, %bb8 ], [ 0, %bb6 ]
  %phi20 = phi i32 [ %phi10, %bb8 ], [ 0, %bb6 ]
  ret void

bb21:
  ret void
}