Bug type: crash
Component: SimplifyCFG
Bug location: llvm/lib/Transforms/Utils/SimplifyCFG.cpp: passingValueIsAlwaysUndefined
Issue title: [SimplifyCFG] Assertion `getArgOperand(ArgNo)->getType()->isPointerTy() && "Argument must be a pointer"' failed.
Labels: crash-on-valid
llvm:transforms
Reported by: dtcxzyw

Reproducer:
```
; bin/opt -passes=simplifycfg test.ll -S
define void @test9(i1 %X, ptr %Y) {
entry:
  br i1 %X, label %if, label %else
if:
  br label %else
else:
  %phi = phi ptr [ %Y, %entry ], [ null, %if ]
  %gep = getelementptr i8, ptr %phi, <2 x i64> zeroinitializer
  call void @fn_arg_vec(<2 x ptr> %gep)
  ret void
}

declare void @fn_arg_vec(<2 x ptr>)
```
```
opt: /home/dtcxzyw/WorkSpace/Projects/compilers/llvm-project/llvm/lib/IR/Instructions.cpp:446: bool llvm::CallBase::paramHasNonNullAttr(unsigned int, bool) const: Assertion `getArgOperand(ArgNo)->getType()->isPointerTy() && "Argument must be a pointer"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: bin/opt -passes=simplifycfg test.ll -S
1.      Running pass "function(simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;no-switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>)" on module "test.ll"
2.      Running pass "simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;no-switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>" on function "test9"
 #0 0x000073bf132279f2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMSupport.so.21.0git+0x2279f2)
 #1 0x000073bf132248cf llvm::sys::RunSignalHandlers() (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMSupport.so.21.0git+0x2248cf)
 #2 0x000073bf13224a14 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x000073bf12c45330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
 #4 0x000073bf12c9eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x000073bf12c9eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x000073bf12c9eb2c pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x000073bf12c4527e raise ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x000073bf12c288ff abort ./stdlib/abort.c:81:7
 #9 0x000073bf12c2881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x000073bf12c3b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x000073bf098908a3 llvm::CallBase::paramHasNonNullAttr(unsigned int, bool) const (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x2908a3)
#12 0x000073bf0a6c321f passingValueIsAlwaysUndefined(llvm::Value*, llvm::Instruction*, bool) SimplifyCFG.cpp:0:0
#13 0x000073bf0a6c30db passingValueIsAlwaysUndefined(llvm::Value*, llvm::Instruction*, bool) SimplifyCFG.cpp:0:0
#14 0x000073bf0a6c61ab (anonymous namespace)::SimplifyCFGOpt::speculativelyExecuteBB(llvm::BranchInst*, llvm::BasicBlock*) SimplifyCFG.cpp:0:0
#15 0x000073bf0a6daeb2 (anonymous namespace)::SimplifyCFGOpt::simplifyCondBranch(llvm::BranchInst*, llvm::IRBuilder<llvm::ConstantFolder, llvm::IRBuilderDefaultInserter>&) SimplifyCFG.cpp:0:0
#16 0x000073bf0a6dc91e llvm::simplifyCFG(llvm::BasicBlock*, llvm::TargetTransformInfo const&, llvm::DomTreeUpdater*, llvm::SimplifyCFGOptions const&, llvm::ArrayRef<llvm::WeakVH>) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMTransformUtils.so.21.0git+0x2dc91e)
#17 0x000073bf0afb76c6 iterativelySimplifyCFG(llvm::Function&, llvm::TargetTransformInfo const&, llvm::DomTreeUpdater*, llvm::SimplifyCFGOptions const&) SimplifyCFGPass.cpp:0:0
#18 0x000073bf0afb852c simplifyFunctionCFGImpl(llvm::Function&, llvm::TargetTransformInfo const&, llvm::DominatorTree*, llvm::SimplifyCFGOptions const&) SimplifyCFGPass.cpp:0:0
#19 0x000073bf0afb93b5 simplifyFunctionCFG(llvm::Function&, llvm::TargetTransformInfo const&, llvm::DominatorTree*, llvm::SimplifyCFGOptions const&) SimplifyCFGPass.cpp:0:0
#20 0x000073bf0afb9510 llvm::SimplifyCFGPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMScalarOpts.so.21.0git+0x3b9510)
#21 0x000073bf0cfac495 llvm::detail::PassModel<llvm::Function, llvm::SimplifyCFGPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libPolly.so.21.0git+0x1ac495)
#22 0x000073bf09927164 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x327164)
#23 0x000073bf11edb7c5 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0xdb7c5)
#24 0x000073bf09927680 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x327680)
#25 0x000073bf11edc185 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0xdc185)
#26 0x000073bf09928805 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x328805)
#27 0x000073bf135203d9 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMOptDriver.so.21.0git+0x2d3d9)
#28 0x000073bf1352b416 optMain (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMOptDriver.so.21.0git+0x38416)
#29 0x000073bf12c2a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#30 0x000073bf12c2a28b call_init ./csu/../csu/libc-start.c:128:20
#31 0x000073bf12c2a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#32 0x000056ddb347a095 _start (bin/opt+0x1095)

Aborted (core dumped)
```
Reported by https://github.com/llvm/llvm-project/pull/125383#issuecomment-2932967834




Fix patch:
commit 7e1fa09ce2a228c949ce4490c98f2c73ed8ada00
Author: Yingwei Zheng <dtcxzyw2333@gmail.com>
Date:   Wed Jun 4 12:37:30 2025 +0800

    [SimplifyCFG] Bail out on vector GEPs in `passingValueIsAlwaysUndefined` (#142526)
    
    Closes https://github.com/llvm/llvm-project/issues/142522.

diff --git a/llvm/lib/Transforms/Utils/SimplifyCFG.cpp b/llvm/lib/Transforms/Utils/SimplifyCFG.cpp
index 245d0c4f073d..e221022bb836 100644
--- a/llvm/lib/Transforms/Utils/SimplifyCFG.cpp
+++ b/llvm/lib/Transforms/Utils/SimplifyCFG.cpp
@@ -8108,6 +8108,7 @@ bool SimplifyCFGOpt::simplifyCondBranch(BranchInst *BI, IRBuilder<> &Builder) {
 
 /// Check if passing a value to an instruction will cause undefined behavior.
 static bool passingValueIsAlwaysUndefined(Value *V, Instruction *I, bool PtrValueMayBeModified) {
+  assert(V->getType() == I->getType() && "Mismatched types");
   Constant *C = dyn_cast<Constant>(V);
   if (!C)
     return false;
@@ -8165,6 +8166,10 @@ static bool passingValueIsAlwaysUndefined(Value *V, Instruction *I, bool PtrValu
     // Look through GEPs. A load from a GEP derived from NULL is still undefined
     if (GetElementPtrInst *GEP = dyn_cast<GetElementPtrInst>(User))
       if (GEP->getPointerOperand() == I) {
+        // The type of GEP may differ from the type of base pointer.
+        // Bail out on vector GEPs, as they are not handled by other checks.
+        if (GEP->getType()->isVectorTy())
+          return false;
         // The current base address is null, there are four cases to consider:
         // getelementptr (TY, null, 0)                 -> null
         // getelementptr (TY, null, not zero)          -> may be modified


Regression tests:
file: llvm/test/Transforms/SimplifyCFG/UnreachableEliminate.ll
commands: opt < %s -passes=simplifycfg -simplifycfg-require-and-preserve-domtree=1  -S
tests: test_name: test9_gep_splat
test_body: declare void @fn_arg_vec(<2 x ptr>)

define void @test9_gep_splat(i1 %X, ptr %Y) {
entry:
  br i1 %X, label %if, label %else

if:                                               ; preds = %entry
  br label %else

else:                                             ; preds = %if, %entry
  %phi = phi ptr [ %Y, %entry ], [ null, %if ]
  %gep = getelementptr i8, ptr %phi, <2 x i64> zeroinitializer
  call void @fn_arg_vec(<2 x ptr> %gep)
  ret void
}

test_name: test9
test_body: declare ptr @fn_nonnull_noundef_arg(ptr noundef nonnull)

define void @test9(i1 %X, ptr %Y) {
entry:
  br i1 %X, label %if, label %else

if:                                               ; preds = %entry
  br label %else

else:                                             ; preds = %if, %entry
  %phi = phi ptr [ %Y, %entry ], [ null, %if ]
  %0 = call ptr @fn_nonnull_noundef_arg(ptr %phi)
  ret void
}