Bug type: crash
Component: LoopVectorize
Bug location: llvm/lib/Transforms/Vectorize/VPlan.h: classof
Issue title: [vplan] Assertion: found instruction with poison generating flags not covered by VPRecipeWithIRFlags
Labels: release:backport
vectorizers
crash
Reported by: ashermancinelli

```
clang++ -O3 -mcpu=neoverse-v2 -c reduced.ll

clang++: llvm/lib/Transforms/Vectorize/VPlanTransforms.cpp:1926: llvm::VPlanTransforms::dropPoisonGeneratingRecipes(llvm::VPlan&, const std::function<bool(llvm::BasicBlock*)>&)::<lambda(llvm::VPRecipeBase*)>: Assertion `(!Instr || !Instr->hasPoisonGeneratingFlags()) && "found instruction with poison generating flags not covered by " "VPRecipeWithIRFlags"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: clang++ -O3 -mcpu=neoverse-v2 -c reduced.ll
1.      Optimizer
2.      Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,chr,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O3>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "reduced.ll"
3.      Running pass "loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>" on function "foo"
 #0 0x0000aaaaaf09abe8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int)
 #1 0x0000aaaaaf098908 llvm::sys::RunSignalHandlers()
 #2 0x0000aaaaaf098c88 llvm::sys::CleanupOnSignal(unsigned long)
 #3 0x0000aaaaaefee5bc CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #4 0x0000fffff7fb08dc (linux-vdso.so.1+0x8dc)
 #5 0x0000fffff7c2f200 __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #6 0x0000fffff7bea67c gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #7 0x0000fffff7bd7130 abort ./stdlib/abort.c:81:7
 #8 0x0000fffff7be3fd0 __assert_fail_base ./assert/assert.c:89:7
 #9 0x0000fffff7be4040 __assert_perror_fail ./assert/assert-perr.c:31:1
#10 0x0000aaaab0bfd210 llvm::VPlanTransforms::dropPoisonGeneratingRecipes(llvm::VPlan&, std::function<bool (llvm::BasicBlock*)> const&)::'lambda'(llvm::VPRecipeBase*)::operator()(llvm::VPRecipeBase*) const (.isra.0) VPlanTransforms.cpp:0:0
#11 0x0000aaaab0c065b4 llvm::VPlanTransforms::dropPoisonGeneratingRecipes(llvm::VPlan&, std::function<bool (llvm::BasicBlock*)> const&) 
#12 0x0000aaaab0b99078 llvm::LoopVectorizationPlanner::tryToBuildVPlanWithVPRecipes(llvm::VFRange&)
#13 0x0000aaaab0b99634 llvm::LoopVectorizationPlanner::buildVPlansWithVPRecipes(llvm::ElementCount, llvm::ElementCount)
#14 0x0000aaaab0b99c1c llvm::LoopVectorizationPlanner::plan(llvm::ElementCount, unsigned int)
#15 0x0000aaaab0b9b05c llvm::LoopVectorizePass::processLoop(llvm::Loop*) 
#16 0x0000aaaab0b9d464 llvm::LoopVectorizePass::runImpl(llvm::Function&) 
#17 0x0000aaaab0b9da1c llvm::LoopVectorizePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) 
#18 0x0000aaaab07856fc llvm::detail::PassModel<llvm::Function, llvm::LoopVectorizePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) PassBuilder.cpp:0:0
#19 0x0000aaaaaeb3fef8 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&)
#20 0x0000aaaaadbd51dc llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) NVPTXTargetMachine.cpp:0:0
#21 0x0000aaaaaeb3e97c llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&)
#22 0x0000aaaaadbd513c llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) NVPTXTargetMachine.cpp:0:0
#23 0x0000aaaaaeb3e3a4 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) 
#24 0x0000aaaaafa2b598 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#25 0x0000aaaaafa2e258 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*)
#26 0x0000aaaaafb69e8c clang::CodeGenAction::ExecuteAction()
#27 0x0000aaaaafef684c clang::FrontendAction::Execute()
#28 0x0000aaaaafe8bb30 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) 
#29 0x0000aaaaaffe49b0 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) 
#30 0x0000aaaaadb8f874 cc1_main(llvm::ArrayRef<char const*>, char const*, void*)
#31 0x0000aaaaadb87f34 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#32 0x0000aaaaafcd7778 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#33 0x0000aaaaaefeeac0 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>)
#34 0x0000aaaaafcd7d48 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#35 0x0000aaaaafc9daf4 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const
#36 0x0000aaaaafc9e744 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const 
#37 0x0000aaaaafca6268 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) 
#38 0x0000aaaaadb8c654 clang_main(int, char**, llvm::ToolContext const&)
#39 0x0000aaaaadb9c06c main
#40 0x0000fffff7bd73fc __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#41 0x0000fffff7bd74cc call_init ./csu/../csu/libc-start.c:128:20
#42 0x0000fffff7bd74cc __libc_start_main ./csu/../csu/libc-start.c:379:5
#43 0x0000aaaaadb87a24 _start
clang++: error: clang frontend command failed with exit code 134 (use -v to see invocation)
clang version 21.0.0git (https://github.com/llvm/llvm-project 82b923defe27cc46ecf3084f3a8f1c0d1c36199e)
Target: aarch64-unknown-linux-gnu
Thread model: posix
InstalledDir: 
Build config: +assertions
clang++: note: diagnostic msg: Error generating preprocessed source(s) - no preprocessable inputs.
```
```
# works ok
clang++ -O3 -mcpu=neoverse-n1 -c reduced.ll
```

```
; ModuleID = '<bc file>'
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128-Fn32"
target triple = "aarch64-unknown-linux-gnu"

define void @foo(ptr %0, ptr %1, ptr %bar, i64 %2) {
  br label %4

4:                                                ; preds = %5, %3
  br label %5

5:                                                ; preds = %26, %4
  %6 = phi i32 [ %27, %26 ], [ 0, %4 ]
  %7 = phi i64 [ %28, %26 ], [ %2, %4 ]
  %8 = icmp sgt i64 %7, 0
  br i1 %8, label %9, label %4

9:                                                ; preds = %5
  %10 = load double, ptr %1, align 8
  %11 = call nnan double @llvm.fabs.f64(double %10)
  %12 = fcmp olt double %11, 1.000000e+00
  br i1 %12, label %13, label %21

13:                                               ; preds = %9
  %14 = load double, ptr %bar, align 8
  %15 = zext i32 %6 to i64
  %16 = add i64 %15, -1
  %17 = getelementptr double, ptr %0, i64 %16
  store double 0.000000e+00, ptr %17, align 8
  %18 = fcmp oeq double %14, 0.000000e+00
  br i1 %18, label %19, label %26

19:                                               ; preds = %13
  %20 = getelementptr i32, ptr null, i64 %16
  store i32 0, ptr %20, align 4
  br label %26

21:                                               ; preds = %9
  %22 = zext i32 %6 to i64
  %23 = add i64 %22, -1
  %24 = getelementptr double, ptr %0, i64 %23
  store double 0.000000e+00, ptr %24, align 8
  %25 = getelementptr i32, ptr null, i64 %23
  store i32 0, ptr %25, align 4
  br label %26

26:                                               ; preds = %21, %19, %13
  %27 = add nsw i32 %6, 1
  %28 = add i64 %7, -1
  br label %5
}

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare double @llvm.fabs.f64(double) #0

attributes #0 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }
```

Comments: author: fhahn
body: @ashermancinelli it looks like `reduced.ll` is missing from the issue here? Could you attach it (or share a link to godbolt)?
author: ashermancinelli
body: @fhahn Sorry about that! I updated the description.

Fix patch:
commit 75b922dccfc35ec25a520b1941e6682a300802b8
Author: Florian Hahn <flo@fhahn.com>
Date:   Sat Feb 1 21:40:58 2025 +0000

    [VPlan] Check VPWidenIntrinsicSC in VPRecipeWithIRFlags::classof.
    
    When VPWidenIntrinsicRecipe was changed to inhert from VPRecipeWithIRFlags,
    VPRecipeWithIRFlags::classof wasn't updated accordingly. Also check for
    VPWidenIntrinsicSC in VPRecipeWithIRFlags::classof.
    
    Fixes https://github.com/llvm/llvm-project/issues/125301.

diff --git a/llvm/lib/Transforms/Vectorize/VPlan.h b/llvm/lib/Transforms/Vectorize/VPlan.h
index 459222234bc3..87ef2dc6d8ea 100644
--- a/llvm/lib/Transforms/Vectorize/VPlan.h
+++ b/llvm/lib/Transforms/Vectorize/VPlan.h
@@ -1058,6 +1058,7 @@ public:
            R->getVPDefID() == VPRecipeBase::VPWidenEVLSC ||
            R->getVPDefID() == VPRecipeBase::VPWidenGEPSC ||
            R->getVPDefID() == VPRecipeBase::VPWidenCastSC ||
+           R->getVPDefID() == VPRecipeBase::VPWidenIntrinsicSC ||
            R->getVPDefID() == VPRecipeBase::VPReplicateSC ||
            R->getVPDefID() == VPRecipeBase::VPReverseVectorPointerSC ||
            R->getVPDefID() == VPRecipeBase::VPVectorPointerSC;


Regression tests:
file: llvm/test/Transforms/LoopVectorize/AArch64/drop-poison-generating-flags.ll
commands: opt -p loop-vectorize -mcpu=neoverse-v2 -force-vector-width=4 -S %s
tests: test_name: <module>
test_body: 
target triple = "aarch64-unknown-linux"

; Test case where we visit a VPWidenIntrinsic (for @llvm.fabs) with nnan flags.
; For https://github.com/llvm/llvm-project/issues/125301.
define void @check_widen_intrinsic_with_nnan(ptr noalias %dst.0, ptr noalias %dst.1, ptr noalias %src.1, ptr %src.2) {
;
entry:
  br label %loop.header

loop.header:
  %iv = phi i64 [ 0, %entry ], [ %iv.next, %loop.latch ]
  %gep.src.1 = getelementptr inbounds double, ptr %src.1, i64 %iv
  %l.1 = load double, ptr %gep.src.1, align 8
  %abs = tail call nnan double @llvm.fabs.f64(double %l.1)
  %c.0 = fcmp olt double %abs, 1.000000e+00
  br i1 %c.0, label %then, label %else

then:
  %l.2 = load double, ptr %src.2, align 8
  %iv.sub.1 = add nsw i64 %iv, -1
  %gep.iv.sub.1 = getelementptr double, ptr %dst.0, i64 %iv.sub.1
  store double 0.000000e+00, ptr %gep.iv.sub.1, align 8
  %c.1 = fcmp oeq double %l.2, 0.000000e+00
  br i1 %c.1, label %merge, label %loop.latch

else:
  %iv.sub.2 = add nsw i64 %iv, -1
  %gep.iv.sub.2 = getelementptr double, ptr %dst.0, i64 %iv.sub.2
  store double 0.000000e+00, ptr %gep.iv.sub.2, align 8
  br label %merge

merge:
  %merge.iv = phi i64 [ %iv.sub.2, %else ], [ %iv.sub.1, %then ]
  %gep.dst.1 = getelementptr inbounds i32, ptr %dst.1, i64 %merge.iv
  store i32 10, ptr %gep.dst.1, align 4
  br label %loop.latch

loop.latch:
  %iv.next = add nuw nsw i64 %iv, 1
  %exitcond.not = icmp eq i64 %iv.next, 1000
  br i1 %exitcond.not, label %exit, label %loop.header

exit:
ret void
}

declare double @llvm.fabs.f64(double)