Bug type: crash
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: BoUpSLP::getLastInstructionInBundle
BoUpSLP::vectorizeTree
Issue title: Instruction does not dominate all uses! LLVM ERROR: Broken module found, compilation aborted!
Labels: llvm:SLPVectorizer
crash
Reported by: TatyanaDoubts

To reproduce run opt with the test below, using `-passes=slp-vectorizer -slp-threshold=-99999 `
```
; ModuleID = './reduced.ll'
source_filename = "./reduced.ll"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128-ni:1-p2:32:8:8:32-ni:2"
target triple = "x86_64-unknown-linux-gnu"

define i64 @wombat(i32 %arg) #0 gc "statepoint-example" {
bb:
  %freeze = freeze i32 0
  br i1 false, label %bb1, label %bb1

bb1:                                              ; preds = %bb, %bb
  %load = load i32, ptr addrspace(1) null, align 4
  %icmp = icmp eq i32 0, 0
  %icmp2 = icmp ult i32 0, 0
  %add = add i32 %freeze, 0
  %icmp3 = icmp ult i32 %add, 0
  %icmp4 = icmp ugt i32 0, 0
  %icmp5 = icmp ult i32 %freeze, 0
  %icmp6 = icmp ult i32 0, 0
  %icmp7 = icmp ult i32 %add, %arg
  %and = and i1 %icmp7, false
  %icmp8 = icmp ugt i32 0, 0
  %icmp9 = icmp ugt i32 %arg, 0
  %icmp10 = icmp ult i32 %freeze, %load
  br i1 false, label %bb11, label %bb12

bb11:                                             ; preds = %bb1
  %zext = zext i32 %add to i64
  ret i64 0

bb12:                                             ; preds = %bb1
  %zext13 = zext i32 %add to i64
  ret i64 0
}

attributes #0 = { "target-features"="+prfchw,-cldemote,+avx,+aes,+sahf,+pclmul,-xop,+crc32,-amx-fp8,+xsaves,-avx512fp16,-usermsr,-sm4,-egpr,+sse4.1,-avx10.1,-avx512ifma,+xsave,+sse4.2,-tsxldtrk,-sm3,-ptwrite,-widekl,-movrs,-invpcid,+64bit,+xsavec,-avx512vpopcntdq,+cmov,-avx512vp2intersect,-avx512cd,+movbe,-avxvnniint8,-ccmp,-amx-int8,-kl,-sha512,-avxvnni,-rtm,+adx,+avx2,-hreset,-movdiri,-serialize,-vpclmulqdq,-avx512vl,-uintr,-cf,+clflushopt,-raoint,-cmpccxadd,+bmi,-amx-tile,+sse,-gfni,-avxvnniint16,-amx-fp16,-zu,-ndd,+xsaveopt,+rdrnd,-avx512f,-amx-bf16,-avx512bf16,-avx512vnni,-push2pop2,+cx8,-avx512bw,+sse3,-pku,-nf,-amx-tf32,-amx-avx512,+fsgsbase,+clzero,-mwaitx,-lwp,+lzcnt,+sha,-movdir64b,-ppx,+wbnoinvd,-enqcmd,-amx-transpose,-avxneconvert,-tbm,-pconfig,-amx-complex,+ssse3,+cx16,-avx10.2,+bmi2,+fma,+popcnt,-avxifma,+f16c,-avx512bitalg,-rdpru,+clwb,+mmx,+sse2,+rdseed,-avx512vbmi2,-prefetchi,-amx-movrs,+rdpid,-fma4,-avx512vbmi,-shstk,-vaes,-waitpkg,-sgx,+fxsr,-avx512dq,+sse4a" }
```
Reproducer: https://godbolt.org/z/nY8fvjv8f

Stack dump:
```
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=slp-vectorizer -slp-threshold=-99999 <source>
1.	Running pass "verify" on module "<source>"
 #0 0x00000000058da2e8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x58da2e8)
 #1 0x00000000058d7194 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007cfd67242520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007cfd672969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x00007cfd67242476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x00007cfd672287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x000000000082fa8d llvm::json::operator==(llvm::json::Value const&, llvm::json::Value const&) (.cold) JSON.cpp:0:0
 #7 0x00000000058112c1 (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x58112c1)
 #8 0x0000000005701d78 (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5701d78)
 #9 0x000000000097292e llvm::detail::PassModel<llvm::Module, llvm::VerifierPass, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x97292e)
#10 0x00000000056bf8e1 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x56bf8e1)
#11 0x000000000097cb18 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x97cb18)
#12 0x0000000000970cb7 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x970cb7)
#13 0x00007cfd67229d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#14 0x00007cfd67229e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#15 0x0000000000967dc5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x967dc5)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```


Fix patch:
commit 57947ace14ebfadba46a99aa80589e021c757037
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Thu Sep 25 13:38:27 2025 -0700

    [SLP]Correctly set the insert point for insertlements with copyable arguments
    
    Need to find the last insertelement instruction in the list for the
    copyable arguments, otherwise wrong def-use chain may be built
    
    Fixes #160671

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index 1814d9a6811c..065622efc7ec 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -17519,7 +17519,9 @@ Instruction &BoUpSLP::getLastInstructionInBundle(const TreeEntry *E) {
                   return !isa<GetElementPtrInst>(V) && isa<Instruction>(V);
                 })) ||
         all_of(E->Scalars, [&](Value *V) {
-          return isa<PoisonValue>(V) || E->isCopyableElement(V) ||
+          return isa<PoisonValue>(V) ||
+                 (E->Idx == 0 && isa<InsertElementInst>(V)) ||
+                 E->isCopyableElement(V) ||
                  (!isVectorLikeInstWithConstOps(V) && isUsedOutsideBlock(V));
         }))
       Res = FindLastInst();
@@ -19119,7 +19121,12 @@ Value *BoUpSLP::vectorizeTree(TreeEntry *E) {
     }
     case Instruction::InsertElement: {
       assert(E->ReuseShuffleIndices.empty() && "All inserts should be unique");
-      Builder.SetInsertPoint(cast<Instruction>(E->Scalars.back()));
+      if (const TreeEntry *OpE = getOperandEntry(E, 1);
+          OpE && !OpE->isGather() && OpE->hasState() &&
+          !OpE->hasCopyableElements())
+        Builder.SetInsertPoint(cast<Instruction>(E->Scalars.back()));
+      else
+        setInsertPointAfterBundle(E);
       Value *V = vectorizeOperand(E, 1);
       ArrayRef<Value *> Op = E->getOperand(1);
       Type *ScalarTy = Op.front()->getType();


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/X86/insertelement-with-copyable-args.ll
commands: opt -S --passes=slp-vectorizer -mtriple=x86_64-unknown-linux-gnu -slp-threshold=-99999 < %s
tests: test_name: <module>
test_body: 
define i64 @test(i32 %arg) {
;
bb:
  %freeze = freeze i32 0
  br i1 false, label %bb1, label %bb1

bb1:
  %load = load i32, ptr addrspace(1) null, align 4
  %0 = insertelement <4 x i32> <i32 0, i32 poison, i32 poison, i32 0>, i32 %freeze, i32 2
  %1 = insertelement <4 x i32> <i32 0, i32 0, i32 0, i32 poison>, i32 %arg, i32 3
  %add = add i32 %freeze, 0
  %2 = insertelement <2 x i32> poison, i32 %freeze, i32 0
  %3 = shufflevector <2 x i32> %2, <2 x i32> poison, <2 x i32> zeroinitializer
  %4 = add <2 x i32> %3, zeroinitializer
  %5 = insertelement <2 x i32> poison, i32 %arg, i32 0
  %6 = insertelement <2 x i32> %5, i32 %load, i32 1
  %7 = icmp ult <2 x i32> %4, %6
  %8 = extractelement <2 x i1> %7, i32 0
  %and = and i1 %8, false
  %9 = insertelement <4 x i32> %0, i32 %add, i32 1
  %10 = icmp eq <4 x i32> %9, %1
  %11 = icmp ult <4 x i32> %9, %1
  %12 = shufflevector <4 x i1> %10, <4 x i1> %11, <4 x i32> <i32 0, i32 5, i32 6, i32 7>
  br i1 false, label %bb11, label %bb12

bb11:
  %zext = zext i32 %add to i64
  ret i64 0

bb12:
  %zext13 = zext i32 %add to i64
  ret i64 0
}