Bug type: crash
Component: VectorCombine
Bug location: llvm/lib/Transforms/Vectorize/VectorCombine.cpp: translateExtract
Issue title: recent "cast<Ty>() argument of incompatible type!" failure in vector-combine
Labels: crash-on-valid
llvm::vectorcombine
Reported by: gregbedwell

Bisected to 777d6b5de90b7e0d1ceaa1424c6da4590539c007 (#146350)
Confirmed still present as of 01c97b4953e87ae455bd4c41e3de3f0f0f29c61c

https://godbolt.org/z/7qhKaavjs
https://godbolt.org/z/EdP1T5nxM

```
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-unknown"

define i64 @_Z2akv(<4 x i64> %call.i.i) {
entry:
  %0 = bitcast <4 x i64> %call.i.i to <8 x i32>
  %insert.i.i = shufflevector <8 x i32> %0, <8 x i32> zeroinitializer, <8 x i32> <i32 8, i32 9, i32 10, i32 11, i32 4, i32 5, i32 6, i32 7>
  %bc3.i = bitcast <8 x i32> %insert.i.i to <4 x i64>
  %1 = extractelement <4 x i64> zeroinitializer, i64 0
  %2 = extractelement <4 x i64> %bc3.i, i64 1
  %add.1.i.i = or i64 %2, %1
  ret i64 %add.1.i.i
}
```

```
opt: /root/llvm-project/llvm/include/llvm/Support/Casting.h:578: decltype(auto) llvm::cast(From*) [with To = llvm::ExtractElementInst; From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=vector-combine <source>
1.	Running pass "function(vector-combine)" on module "<source>"
2.	Running pass "vector-combine" on function "_Z2akv"
 #0 0x000000000560a898 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x560a898)
 #1 0x0000000005607774 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x000073ae71e42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x000073ae71e969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x000073ae71e42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x000073ae71e287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x000073ae71e2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x000073ae71e39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x0000000003563e41 (anonymous namespace)::VectorCombine::foldExtractExtract(llvm::Instruction&) (.part.0) VectorCombine.cpp:0:0
 #9 0x000000000357e963 (anonymous namespace)::VectorCombine::run()::'lambda'(llvm::Instruction&)::operator()(llvm::Instruction&) const (.isra.0) VectorCombine.cpp:0:0
#10 0x000000000357f65b llvm::VectorCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x357f65b)
#11 0x0000000002d6387e llvm::detail::PassModel<llvm::Function, llvm::VectorCombinePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2d6387e)
#12 0x0000000005402ba1 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5402ba1)
#13 0x0000000000ea794e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xea794e)
#14 0x0000000005403074 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5403074)
#15 0x0000000000ea677e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xea677e)
#16 0x0000000005400c41 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5400c41)
#17 0x0000000000961fda llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x961fda)
#18 0x000000000095576c optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x95576c)
#19 0x000073ae71e29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#20 0x000073ae71e29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#21 0x000000000094d355 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x94d355)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```





Comments: author: RKSimon
body: ```
VECTORCOMBINE on _Z2akv
VC: Visiting:   %0 = bitcast <4 x i64> %call.i.i to <8 x i32>
VC: Visiting:   %insert.i.i = shufflevector <8 x i32> %0, <8 x i32> zeroinitializer, <8 x i32> <i32 8, i32 9, i32 10, i32 11, i32 4, i32 5, i32 6, i32 7>
VC: Visiting:   %bc3.i = bitcast <8 x i32> %insert.i.i to <4 x i64>
Found a bitcasted shuffle:   %bc3.i = bitcast <8 x i32> %insert.i.i to <4 x i64>
  OldCost: 0 vs NewCost: 0
VC: Replacing:   %bc3.i = bitcast <8 x i32> %insert.i.i to <4 x i64>
         With:   %1 = shufflevector <4 x i64> %call.i.i, <4 x i64> zeroinitializer, <4 x i32> <i32 4, i32 5, i32 2, i32 3>
ADD:   %3 = extractelement <4 x i64> %bc3.i, i64 1
ADD:   %bc3.i = shufflevector <4 x i64> %call.i.i, <4 x i64> zeroinitializer, <4 x i32> <i32 4, i32 5, i32 2, i32 3>
ADD:   %1 = bitcast <8 x i32> %insert.i.i to <4 x i64>
VC: Visiting:   %2 = extractelement <4 x i64> zeroinitializer, i64 0
VC: Visiting:   %3 = extractelement <4 x i64> %bc3.i, i64 1
VC: Visiting:   %add.1.i.i = or i64 %3, %2
opt: /root/llvm-project/llvm/include/llvm/Support/Casting.h:578: decltype(auto) llvm::cast(From*) [with To = llvm::ExtractElementInst; From = llvm::Value]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=vector-combine -debug <source>
1.	Running pass "function(vector-combine)" on module "<source>"
2.	Running pass "vector-combine" on function "_Z2akv"
 #0 0x000000000560a358 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x560a358)
 #1 0x0000000005607234 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007ec36bc42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007ec36bc969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x00007ec36bc42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x00007ec36bc287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x00007ec36bc2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x00007ec36bc39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x0000000003563871 (anonymous namespace)::VectorCombine::foldExtractExtract(llvm::Instruction&) (.part.0) VectorCombine.cpp:0:0
 #9 0x000000000357e393 (anonymous namespace)::VectorCombine::run()::'lambda'(llvm::Instruction&)::operator()(llvm::Instruction&) const (.isra.0) VectorCombine.cpp:0:0
#10 0x000000000357f08b llvm::VectorCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x357f08b)
#11 0x0000000002d635ce llvm::detail::PassModel<llvm::Function, llvm::VectorCombinePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2d635ce)
#12 0x0000000005402641 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5402641)
#13 0x0000000000ea794e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xea794e)
#14 0x0000000005402b14 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5402b14)
#15 0x0000000000ea677e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xea677e)
#16 0x00000000054006e1 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x54006e1)
#17 0x0000000000961fda llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x961fda)
#18 0x000000000095576c optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x95576c)
#19 0x00007ec36bc29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#20 0x00007ec36bc29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#21 0x000000000094d355 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x94d355)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

Fix patch:
commit 1113224f9444f5c2cf69784cd3c110b8dd560897
Author: Florian Hahn <flo@fhahn.com>
Date:   Mon Jul 7 13:23:39 2025 +0200

    [VectorCombine] Account for IRBuilder simplification in translateExt.
    
    After https://github.com/llvm/llvm-project/pull/146350,
    CreateExtractElement may return a folded value and not create an
    ExtractElement instruction.
    
    Replace cast with dyn_cast. Note that the function returns nullptr
    already earlier if the extract may be constant folded.
    
    Fixes https://github.com/llvm/llvm-project/issues/147218

diff --git a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
index b9ce20ebd3e6..fe8d74c43dfd 100644
--- a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
+++ b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
@@ -563,7 +563,8 @@ static ExtractElementInst *translateExtract(ExtractElementInst *ExtElt,
 
   Value *Shuf = createShiftShuffle(X, cast<ConstantInt>(C)->getZExtValue(),
                                    NewIndex, Builder);
-  return cast<ExtractElementInst>(Builder.CreateExtractElement(Shuf, NewIndex));
+  return dyn_cast<ExtractElementInst>(
+      Builder.CreateExtractElement(Shuf, NewIndex));
 }
 
 /// Try to reduce extract element costs by converting scalar compares to vector


Regression tests:
file: llvm/test/Transforms/VectorCombine/X86/extract-binop.ll
commands: opt < %s -passes=vector-combine -S -mtriple=x86_64-- -mattr=SSE2
opt < %s -passes=vector-combine -S -mtriple=x86_64-- -mattr=AVX2
tests: test_name: instsimplify_folder_crash
test_body: define i64 @instsimplify_folder_crash(<4 x i64> %in) {
entry:
  %shuffle.1 = shufflevector <4 x i64> %in, <4 x i64> zeroinitializer, <4 x i32> <i32 4, i32 5, i32 2, i32 3>
  %e.0 = extractelement <4 x i64> zeroinitializer, i64 0
  %e.1 = extractelement <4 x i64> %shuffle.1, i64 1
  %shift = shufflevector <4 x i64> %shuffle.1, <4 x i64> poison, <4 x i32> <i32 1, i32 poison, i32 poison, i32 poison>
  %or = or i64 %e.1, %e.0
  ret i64 %or
}

test_name: constant_fold_crash_commute
test_body: define float @constant_fold_crash_commute(<4 x float> %x) {
  %a = extractelement <4 x float> <float 1.600000e+01, float 1.700000e+01, float 1.800000e+01, float 1.900000e+01>, i32 3
  %b = extractelement <4 x float> %x, i32 1
  %c = fadd float %b, %a
  ret float %c
}