Bug type: crash
Component: InstCombine
Bug location: llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp: PointerReplacer::collectUsers
Issue title: [InstCombine] Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
Labels: llvm:instcombine
crash-on-valid
Reported by: XChy

Reproducer: https://godbolt.org/z/TY1ozhPWs
Testcase reduced from an OpenCL C program:
```llvm
target datalayout = "e-m:e-p:64:64-p1:64:64-p2:32:32-p3:32:32-p4:64:64-p5:32:32-p6:32:32-p7:160:256:256:32-p8:128:128:128:48-p9:192:256:256:32-i64:64-v16:16-v24:32-v32:32-v48:64-v96:128-v192:256-v256:256-v512:512-v1024:1024-v2048:2048-n32:64-S32-A5-G1-ni:7:8:9"
target triple = "amdgcn-amd-hsa"

@__const.backsmith_pure_0.l_632 = addrspace(4) constant <{ ptr addrspace(5), ptr addrspace(5), ptr addrspace(5), ptr addrspace(5) }> <{ ptr addrspace(5) addrspacecast (ptr null to ptr addrspace(5)), ptr addrspace(5) addrspacecast (ptr null to ptr addrspace(5)), ptr addrspace(5) addrspacecast (ptr null to ptr addrspace(5)), ptr addrspace(5) addrspacecast (ptr null to ptr addrspace(5)) }>

define <6 x i32> @backsmith_pure_0(i32 %0, i1 %tobool) {
entry:
  %l_632 = alloca [4 x ptr addrspace(5)], align 4, addrspace(5)
  %l_631 = alloca ptr addrspace(5), align 4, addrspace(5)
  switch i32 %0, label %sw.epilog [
    i32 1, label %BS_LABEL_3
    i32 0, label %BS_LABEL_3
  ]

sw.epilog:                                        ; preds = %entry
  call void @llvm.memcpy.p5.p4.i64(ptr addrspace(5) %l_632, ptr addrspace(4) @__const.backsmith_pure_0.l_632, i64 16, i1 false)
  %arrayidx = getelementptr inbounds [4 x ptr addrspace(5)], ptr addrspace(5) %l_632, i64 0, i64 3
  store ptr addrspace(5) %arrayidx, ptr addrspace(5) %l_631, align 4
  br i1 %tobool, label %BS_LABEL_7, label %BS_LABEL_3

BS_LABEL_7:                                       ; preds = %BS_LABEL_3, %sw.epilog
  br label %BS_LABEL_3

BS_LABEL_3:                                       ; preds = %BS_LABEL_7, %sw.epilog, %entry, %entry
  %1 = load ptr addrspace(5), ptr addrspace(5) %l_631, align 4
  %cmp = icmp ugt ptr addrspace(5) %1, null
  br label %BS_LABEL_7
}

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p5.p4.i64(ptr addrspace(5) noalias writeonly captures(none), ptr addrspace(4) noalias readonly captures(none), i64, i1 immarg) #0

attributes #0 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }
```

Dump:
```
opt: /root/llvm-project/llvm/include/llvm/Support/Casting.h:572: decltype(auto) llvm::cast(From*) [with To = llvm::Instruction; From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -O1 <source>
1.	Running pass "function<eager-inv>(mem2reg,instcombine<max-iterations=1;no-verify-fixpoint>,amdgpu-usenative,amdgpu-simplifylib,amdgpu-uniform-intrinsic-combine,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-arithmetic;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>)" on module "<source>"
2.	Running pass "instcombine<max-iterations=1;no-verify-fixpoint>" on function "backsmith_pure_0"
 #0 0x0000000005a06d68 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5a06d68)
 #1 0x0000000005a03c14 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007597d2c42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007597d2c969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x00007597d2c42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x00007597d2c287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x00007597d2c2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x00007597d2c39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x0000000004a0ff38 llvm::InstCombinerImpl::visitAllocaInst(llvm::AllocaInst&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4a0ff38)
 #9 0x000000000494e2c3 llvm::InstCombinerImpl::run() (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x494e2c3)
#10 0x00000000049501a6 combineInstructionsOverFunction(llvm::Function&, llvm::InstructionWorklist&, llvm::AAResults*, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::TargetTransformInfo&, llvm::DominatorTree&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::BranchProbabilityInfo*, llvm::ProfileSummaryInfo*, llvm::InstCombineOptions const&) (.isra.0) InstructionCombining.cpp:0:0
#11 0x0000000004951714 llvm::InstCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4951714)
#12 0x0000000002cb6bae llvm::detail::PassModel<llvm::Function, llvm::InstCombinePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2cb6bae)
#13 0x00000000057e4471 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x57e4471)
#14 0x0000000000f0f07e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xf0f07e)
#15 0x00000000057e2b3a llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x57e2b3a)
#16 0x00000000009793be llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x9793be)
#17 0x00000000057e24f1 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x57e24f1)
#18 0x00000000009836da llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x9836da)
#19 0x0000000000977578 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x977578)
#20 0x00007597d2c29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#21 0x00007597d2c29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#22 0x000000000096e025 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x96e025)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

Comments: author: milos1397
body: Hey @XChy , this test has infinite loop, is that something we want?
author: milos1397
body: Can you assign this one to me? @XChy 

author: XChy
body: > Hey [@XChy](https://github.com/XChy) , this test has infinite loop, is that something we want?

This testcase is automatically reduced with the tool `llvm-reduce`. I guess the problem can be reproduced without the infinite loop, but I haven't tried to do manual reduction.

Fix patch:
commit 44a52ea8beed75eeaca831d1af3590dac9fa832e
Author: Miloš Poletanović <poletanovicmilos97@gmail.com>
Date:   Wed Dec 17 13:07:40 2025 +0100

    [InstCombine] Fix unsafe PHINode cast and simplify logic in PointerReplacer (#172332)
    
    Fixes #171883.
    
    Basically, if the operand of the phi is an Instruction but it's not
    available, the [condition
    ](https://github.com/llvm/llvm-project/blame/1847a4efae6b0c0c985cecead1f3ef381a1962de/llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp#L300)would
    just break, and when we reach the[ deferral
    check](https://github.com/llvm/llvm-project/blame/1847a4efae6b0c0c985cecead1f3ef381a1962de/llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp#L313),
    execution would continue even though there is a non-Instruction operand,
    leading to a crash in the [subsequent processing
    loop](https://github.com/llvm/llvm-project/blame/1847a4efae6b0c0c985cecead1f3ef381a1962de/llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp#L320).

diff --git a/llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp b/llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp
index 9491610190c1..5bca0bb8846c 100644
--- a/llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp
@@ -296,10 +296,9 @@ bool PointerReplacer::collectUsers() {
       /// TODO: Handle poison and null pointers for PHI and select.
       // If all incoming values are available, mark this PHI as
       // replacable and push it's users into the worklist.
-      bool IsReplaceable = true;
-      if (all_of(PHI->incoming_values(), [&](Value *V) {
-            if (!isa<Instruction>(V))
-              return IsReplaceable = false;
+      bool IsReplaceable = all_of(PHI->incoming_values(),
+                                  [](Value *V) { return isa<Instruction>(V); });
+      if (IsReplaceable && all_of(PHI->incoming_values(), [&](Value *V) {
             return isAvailable(cast<Instruction>(V));
           })) {
         UsersToReplace.insert(PHI);


Regression tests:
file: llvm/test/Transforms/InstCombine/alloca-phi-non-inst.ll
commands: opt < %s -passes=instcombine -S
tests: test_name: <module>
test_body: 
@__const.var1 = addrspace(4) constant <{ ptr addrspace(5), ptr addrspace(5), ptr addrspace(5), ptr addrspace(5) }> <{ ptr addrspace(5) addrspacecast (ptr null to ptr addrspace(5)), ptr addrspace(5) addrspacecast (ptr null to ptr addrspace(5)), ptr addrspace(5) addrspacecast (ptr null to ptr addrspace(5)), ptr addrspace(5) addrspacecast (ptr null to ptr addrspace(5)) }>
define void @test(i32 %0, i1 %tobool, ptr addrspace(4) %const_src) {
;
entry:
  %l_632 = alloca [4 x ptr addrspace(5)], align 4, addrspace(5)
  switch i32 %0, label %sw.epilog [
  i32 1, label %BS_LABEL_3
  i32 0, label %BS_LABEL_3
  ]

sw.epilog:                                        ; preds = %entry
  call void @llvm.memcpy.p5.p4.i64(ptr addrspace(5) %l_632, ptr addrspace(4) @__const.var1, i64 16, i1 false)
  %arrayidx = getelementptr inbounds [4 x ptr addrspace(5)], ptr addrspace(5) %l_632, i64 0, i64 3
  br i1 %tobool, label %BS_LABEL_7, label %BS_LABEL_3

BS_LABEL_7:                                       ; preds = %BS_LABEL_3, %sw.epilog
  %l_631.1 = phi ptr addrspace(5) [ %arrayidx, %sw.epilog ], [ %l_631.0, %BS_LABEL_3 ]
  br label %BS_LABEL_3

BS_LABEL_3:                                       ; preds = %BS_LABEL_7, %sw.epilog, %entry, %entry
  %l_631.0 = phi ptr addrspace(5) [ %l_631.1, %BS_LABEL_7 ], [ %arrayidx, %sw.epilog ], [ poison, %entry ], [ poison, %entry ]
  %cmp = icmp ugt ptr addrspace(5) %l_631.0, null
  br label %BS_LABEL_7
}