Bug type: crash
Component: LoopVectorize
Bug location: llvm/lib/Transforms/Vectorize/LoopVectorize.cpp: findRecipe
Issue title: [LoopVectorizePass] Assertion `detail::isPresent(Val) && "dyn_cast on a non-existent value"' failed.
Labels: vectorizers
crash-on-valid
Reported by: gregbedwell

Very recent regression. Not bisected yet.

https://godbolt.org/z/eMaroco7z

```
target triple = "x86_64-unknown-unknown"

define i1 @_Z1nv(i8 %0) {
entry:
  br label %for.body4

for.cond.cleanup.loopexit:                        ; preds = %for.body4
  ret i1 %tobool8

for.body4:                                        ; preds = %for.body4, %entry
  %h.028 = phi i1 [ %tobool8, %for.body4 ], [ false, %entry ]
  %i.027 = phi i8 [ %inc, %for.body4 ], [ 0, %entry ]
  %tobool8 = or i1 %h.028, true
  %inc = add i8 %i.027, 1
  %exitcond.not = icmp eq i8 %i.027, %0
  br i1 %exitcond.not, label %for.cond.cleanup.loopexit, label %for.body4

; uselistorder directives
  uselistorder i1 %tobool8, { 1, 0 }
}
```

```
opt: /root/llvm-project/llvm/include/llvm/Support/Casting.h:656: decltype(auto) llvm::dyn_cast(From*) [with To = llvm::VPInstruction; From = llvm::VPRecipeBase]: Assertion `detail::isPresent(Val) && "dyn_cast on a non-existent value"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S --passes=loop-vectorize <source>
1.	Running pass "function(loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>)" on module "<source>"
2.	Running pass "loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>" on function "_Z1nv"
 #0 0x0000000005a74d58 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5a74d58)
 #1 0x0000000005a71c04 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007def0e042520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007def0e0969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x00007def0e042476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x00007def0e0287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x00007def0e02871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x00007def0e039e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x00000000037526f4 preparePlanForEpilogueVectorLoop(llvm::VPlan&, llvm::Loop*, llvm::DenseMap<llvm::SCEV const*, llvm::Value*, llvm::DenseMapInfo<llvm::SCEV const*, void>, llvm::detail::DenseMapPair<llvm::SCEV const*, llvm::Value*>> const&, llvm::EpilogueLoopVectorizationInfo&, llvm::LoopVectorizationCostModel&, llvm::ScalarEvolution&) LoopVectorize.cpp:0:0
 #9 0x000000000375aefa llvm::LoopVectorizePass::processLoop(llvm::Loop*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x375aefa)
#10 0x000000000375bd20 llvm::LoopVectorizePass::runImpl(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x375bd20)
#11 0x000000000375c4ad llvm::LoopVectorizePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x375c4ad)
#12 0x000000000303396e llvm::detail::PassModel<llvm::Function, llvm::LoopVectorizePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x303396e)
#13 0x000000000584ee81 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x584ee81)
#14 0x0000000000f1e11e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xf1e11e)
#15 0x000000000584d43a llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x584d43a)
#16 0x000000000097f47e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x97f47e)
#17 0x000000000584cdf1 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x584cdf1)
#18 0x0000000000989730 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x989730)
#19 0x000000000097d658 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x97d658)
#20 0x00007def0e029d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#21 0x00007def0e029e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#22 0x0000000000974055 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x974055)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```


Comments: author: gregbedwell
body: Bisects to 4998280c3f112facece8a7ce10f2788c800b7cba

Fix patch:
commit d620ea7657814943748e2368004fad2be44c7272
Author: Florian Hahn <flo@fhahn.com>
Date:   Sun Jan 11 11:19:30 2026 +0000

    [LV] Handle live-ins in findRecipe.
    
    Skip live-ins in findRecipe to prevent a crash for cases with degenerate
    reductions (where the backedge value is a live-in). Such reductions
    should be removed, but this requires further changes.
    
    Fixes https://github.com/llvm/llvm-project/issues/175229.

diff --git a/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp b/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
index 95fbfddffb29..cdc6ecfa21bc 100644
--- a/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
+++ b/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp
@@ -7286,7 +7286,9 @@ static VPRecipeBase *findRecipe(VPValue *Start, PredT Pred) {
   for (unsigned I = 0; I != Worklist.size(); ++I) {
     VPValue *Cur = Worklist[I];
     auto *R = Cur->getDefiningRecipe();
-    if (Pred(R))
+    // TODO: Skip live-ins once no degenerate reductions (ones with constant
+    // backedge values) are generated.
+    if (R && Pred(R))
       return R;
     for (VPUser *U : Cur->users()) {
       for (VPValue *V : cast<VPRecipeBase>(U)->definedValues())


Regression tests:
file: llvm/test/Transforms/LoopVectorize/epilog-vectorization-reductions.ll
commands: opt -passes=loop-vectorize -force-vector-width=4 -enable-epilogue-vectorization -epilogue-vectorization-force-VF=4 -S %s
tests: test_name: reduction_with_const_or
test_body: define i1 @reduction_with_const_or(ptr %A, i8 %n) {
entry:
  br label %loop

loop:                                             ; preds = %loop, %entry
  %or.red = phi i1 [ false, %entry ], [ %or.next, %loop ]
  %iv = phi i8 [ 0, %entry ], [ %iv.next, %loop ]
  %iv.ext = zext i8 %iv to i64
  %gep = getelementptr inbounds i64, ptr %A, i64 %iv.ext
  store i64 %iv.ext, ptr %gep, align 8
  %or.next = or i1 %or.red, true
  %iv.next = add i8 %iv, 1
  %exitcond = icmp eq i8 %iv, %n
  br i1 %exitcond, label %exit, label %loop

exit:                                             ; preds = %loop
  ret i1 %or.next
}