Bug type: crash
Component: LoopVectorize
Bug location: llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp: getOpcodeOrIntrinsicID
isEqual
Issue title: [LoopVectorize] Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
Labels: vectorizers
crash-on-valid
generated by fuzzer
Reported by: dtcxzyw

Reproducer: https://godbolt.org/z/Wqj66T1xq
```
; bin/opt -passes=loop-vectorize test.ll -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define i32 @main(ptr %p) {
entry:
  %conv518.i.i = trunc i32 8 to i8
  %conv517.i.i = and i8 0, 0
  br label %for.cond418.preheader.i.i

for.cond418.preheader.i.i:                        ; preds = %for.inc781.3.i.i, %entry
  %storemerge982.i.i = phi i32 [ 0, %entry ], [ %inc802.i.i, %for.inc781.3.i.i ]
  br i1 false, label %for.inc781.3.i.i, label %safe_mod_func_int8_t_s_s.exit925.i.i

safe_mod_func_int8_t_s_s.exit925.i.i:             ; preds = %for.cond418.preheader.i.i
  %rem16.i923945.i.i = srem i8 %conv517.i.i, %conv518.i.i
  %rem16.i923945.1.i.i = srem i8 %conv517.i.i, %conv518.i.i
  %0 = or i8 %rem16.i923945.i.i, %rem16.i923945.1.i.i
  %.not4006 = icmp eq i8 %0, 0
  br i1 %.not4006, label %for.inc781.3.i.i, label %1

1:                                                ; preds = %safe_mod_func_int8_t_s_s.exit925.i.i
  store i16 0, ptr %p, align 2
  br label %for.inc781.3.i.i

for.inc781.3.i.i:                                 ; preds = %1, %safe_mod_func_int8_t_s_s.exit925.i.i, %for.cond418.preheader.i.i
  %inc802.i.i = add i32 %storemerge982.i.i, 1
  %cmp31.not.i.i = icmp eq i32 %storemerge982.i.i, 1
  br i1 %cmp31.not.i.i, label %if.then.i, label %for.cond418.preheader.i.i

if.then.i:                                        ; preds = %for.inc781.3.i.i
  ret i32 0
}

```
```
opt: /root/llvm-project/llvm/include/llvm/Support/Casting.h:578: decltype(auto) llvm::cast(From*) [with To = llvm::InsertElementInst; From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=loop-vectorize <source>
1.	Running pass "function(loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>)" on module "<source>"
2.	Running pass "loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>" on function "main"
 #0 0x00000000057a4688 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x57a4688)
 #1 0x00000000057a1534 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007fe33d442520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007fe33d4969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x00007fe33d442476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x00007fe33d4287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x00007fe33d42871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x00007fe33d439e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x00000000036de712 llvm::VPPredInstPHIRecipe::execute(llvm::VPTransformState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x36de712)
 #9 0x00000000036846a3 llvm::VPBasicBlock::executeRecipes(llvm::VPTransformState*, llvm::BasicBlock*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x36846a3)
#10 0x000000000369a3be llvm::VPBasicBlock::execute(llvm::VPTransformState*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x369a3be)
#11 0x000000000368e1e1 llvm::VPRegionBlock::execute(llvm::VPTransformState*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x368e1e1)
#12 0x00000000036a0219 llvm::VPlan::execute(llvm::VPTransformState*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x36a0219)
#13 0x0000000003512c88 llvm::LoopVectorizationPlanner::executePlan(llvm::ElementCount, unsigned int, llvm::VPlan&, llvm::InnerLoopVectorizer&, llvm::DominatorTree*, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3512c88)
#14 0x0000000003532d63 llvm::LoopVectorizePass::processLoop(llvm::Loop*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3532d63)
#15 0x0000000003534da0 llvm::LoopVectorizePass::runImpl(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3534da0)
#16 0x000000000353544d llvm::LoopVectorizePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x353544d)
#17 0x0000000002e2b1ee llvm::detail::PassModel<llvm::Function, llvm::LoopVectorizePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2e2b1ee)
#18 0x00000000055904d1 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x55904d1)
#19 0x0000000000ee0cbe llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xee0cbe)
#20 0x000000000558ea3a llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x558ea3a)
#21 0x000000000096d5ae llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x96d5ae)
#22 0x000000000558e3f1 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x558e3f1)
#23 0x00000000009778a8 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x9778a8)
#24 0x000000000096b917 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x96b917)
#25 0x00007fe33d429d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#26 0x00007fe33d429e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#27 0x0000000000962a35 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x962a35)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

Comments: author: AbhinavMir
body: I'd like to investigate this issue. I can reproduce the crash locally and will start debugging.

Edit: I was able to reproduce, seems like I can come up with a solution!
author: dtcxzyw
body: @AbhinavMir I am not an expert on LoopVectorize. You can ask for help from @fhahn :)
author: fhahn
body: @AbhinavMir yes feel free to reach out. Did you manage to come up with a fix?
author: AbhinavMir
body: @fhahn Hi, yes! I did come up with one! Was just busy, sending in a fix!

Fix patch:
commit b4dbb1cdc46bfe41244f4313582ce3270f5fe845
Author: Florian Hahn <flo@fhahn.com>
Date:   Mon Oct 20 11:53:47 2025 +0100

    [VPlan] Be more careful with CSE in replicate regions. (#162110)
    
    Recipes in replicate regions implicitly depend on the region's
    predicate. Limit CSE to recipes in the same block, when either recipe is
    in a replicate region.
    
    This allows handling VPPredInstPHIRecipe during CSE. If we perform CSE
    on recipes inside a replicate region, we may end up with 2
    VPPredInstPHIRecipes sharing the same operand. This is incompatible with
    current VPPredInstPHIRecipe codegen, which re-sets the current value of
    its operand in VPTransformState. This can cause crashes in the added
    test cases.
    
    Note that this patch only modifies ::isEqual to check for replicating
    regions and not getHash, as CSE across replicating regions should be
    uncommon.
    
    Fixes https://github.com/llvm/llvm-project/issues/157314.
    Fixes https://github.com/llvm/llvm-project/issues/161974.
    
    PR: https://github.com/llvm/llvm-project/pull/162110

diff --git a/llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp b/llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp
index 64bbe630e317..e060e7081042 100644
--- a/llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp
+++ b/llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp
@@ -2012,7 +2012,7 @@ struct VPCSEDenseMapInfo : public DenseMapInfo<VPSingleDefRecipe *> {
         .Case<VPWidenIntrinsicRecipe>([](auto *I) {
           return std::make_pair(true, I->getVectorIntrinsicID());
         })
-        .Case<VPVectorPointerRecipe>([](auto *I) {
+        .Case<VPVectorPointerRecipe, VPPredInstPHIRecipe>([](auto *I) {
           // For recipes that do not directly map to LLVM IR instructions,
           // assign opcodes after the last VPInstruction opcode (which is also
           // after the last IR Instruction opcode), based on the VPDefID.
@@ -2089,6 +2089,15 @@ struct VPCSEDenseMapInfo : public DenseMapInfo<VPSingleDefRecipe *> {
           LFlags->getPredicate() !=
               cast<VPRecipeWithIRFlags>(R)->getPredicate())
         return false;
+    // Recipes in replicate regions implicitly depend on predicate. If either
+    // recipe is in a replicate region, only consider them equal if both have
+    // the same parent.
+    const VPRegionBlock *RegionL = L->getParent()->getParent();
+    const VPRegionBlock *RegionR = R->getParent()->getParent();
+    if (((RegionL && RegionL->isReplicator()) ||
+         (RegionR && RegionR->isReplicator())) &&
+        L->getParent() != R->getParent())
+      return false;
     const VPlan *Plan = L->getParent()->getPlan();
     VPTypeAnalysis TypeInfo(*Plan);
     return TypeInfo.inferScalarType(L) == TypeInfo.inferScalarType(R);


Regression tests:
file: llvm/test/Transforms/LoopVectorize/cse-replicate-regions.ll
commands: opt -p loop-vectorize -force-vector-width=2 -force-widen-divrem-via-safe-divisor=false -S %s
tests: test_name: <module>
test_body: 
define void @multiple_vppredinstphi_with_same_predicate(ptr %A, i32 %d) {
;
entry:
  br label %loop.header

loop.header:
  %iv = phi i32 [ 0, %entry ], [ %iv.next, %loop.latch ]
  %gep.A = getelementptr inbounds i32, ptr %A, i32 %iv
  %l = load i32, ptr %gep.A
  %c = icmp sgt i32 %l, 0
  br i1 %c, label %then, label %loop.latch

then:
  %div.0 = sdiv i32 -10, %d
  %div.1 = sdiv i32 -10, %d
  %add  = add i32 %div.1, %div.0
  br label %loop.latch

loop.latch:
  %merge = phi i32 [ %add, %then ], [ 0, %loop.header ]
  store i32 %merge, ptr %gep.A
  %iv.next = add i32 %iv, 1
  %ec = icmp eq i32 %iv.next, 100
  br i1 %ec, label %exit, label %loop.header

exit:
  ret void
}

define void @multiple_vppredinstphi_with_different_predicate(ptr %A, i32 %d) {
;
entry:
  br label %loop.header

loop.header:
  %iv = phi i32 [ 0, %entry ], [ %iv.next, %loop.latch ]
  %gep.A = getelementptr inbounds i32, ptr %A, i32 %iv
  %l = load i32, ptr %gep.A
  %c.0 = icmp sgt i32 %l, 0
  br i1 %c.0, label %then.0, label %continue

then.0:
  %div.0 = sdiv i32 -10, %d
  br label %continue

continue:
  %merge.0 = phi i32 [ %div.0, %then.0 ], [ 0, %loop.header ]
  %c.1 = icmp sgt i32 %l, 20
  br i1 %c.1, label %then.1, label %loop.latch

then.1:
  %div.1 = sdiv i32 -10, %d
  br label %loop.latch

loop.latch:
  %merge.1 = phi i32 [ %div.1, %then.1 ], [ 0, %continue ]
  %add = add i32 %merge.0, %merge.1
  store i32 %add, ptr %gep.A
  %iv.next = add i32 %iv, 1
  %ec = icmp eq i32 %iv.next, 100
  br i1 %ec, label %exit, label %loop.header

exit:
  ret void
}