Bug type: crash
Component: SLPVectorizer
Bug location: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp: BoUpSLP::isGatherShuffledEntry
BoUpSLP::isGatherShuffledSingleRegisterEntry
Issue title: [SLPVectorizer] Assertion `"Expected splat or extractelements only node."' failed.
Labels: llvm:SLPVectorizer
crash-on-valid
generated by fuzzer
Reported by: dtcxzyw

Reproducer: https://godbolt.org/z/9jx1xejoe
```
; bin/opt -passes=slp-vectorizer test.ll -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

@g = global [8 x i8] zeroinitializer

define i32 @main() {
entry:
  %.promoted42.i.i.i.i = load i8, ptr getelementptr inbounds nuw (i8, ptr @g, i64 5), align 1
  %.promoted.i.i.i.i = load i8, ptr getelementptr inbounds nuw (i8, ptr @g, i64 4), align 1
  %.promoted51.i.i.i.i = load i8, ptr getelementptr inbounds nuw (i8, ptr @g, i64 7), align 1
  %.promoted56.i.i.i.i = load i8, ptr getelementptr inbounds nuw (i8, ptr @g, i64 6), align 1
  br i1 false, label %if.end151.1.i.i.1.i.i.i, label %if.end151.1.i.1.i.i.i.i

for.cond79.preheader.us.preheader.1.i.1.i.i.i.i:
  br label %if.end151.1.i.1.i.i.i.i

if.end151.1.i.1.i.i.i.i:
  %0 = phi i8 [ 0, %for.cond79.preheader.us.preheader.1.i.1.i.i.i.i ], [ %.promoted.i.i.i.i, %entry ]
  %1 = phi i8 [ 0, %for.cond79.preheader.us.preheader.1.i.1.i.i.i.i ], [ %.promoted42.i.i.i.i, %entry ]
  %2 = phi i8 [ 0, %for.cond79.preheader.us.preheader.1.i.1.i.i.i.i ], [ %.promoted56.i.i.i.i, %entry ]
  %3 = phi i8 [ 0, %for.cond79.preheader.us.preheader.1.i.1.i.i.i.i ], [ %.promoted51.i.i.i.i, %entry ]
  %4 = phi i8 [ 0, %for.cond79.preheader.us.preheader.1.i.1.i.i.i.i ], [ %.promoted51.i.i.i.i, %entry ]
  %5 = phi i8 [ 0, %for.cond79.preheader.us.preheader.1.i.1.i.i.i.i ], [ %.promoted56.i.i.i.i, %entry ]
  %6 = phi i8 [ 0, %for.cond79.preheader.us.preheader.1.i.1.i.i.i.i ], [ %.promoted42.i.i.i.i, %entry ]
  %7 = phi i8 [ 0, %for.cond79.preheader.us.preheader.1.i.1.i.i.i.i ], [ %.promoted.i.i.i.i, %entry ]
  br label %if.end151.1.i.i.1.i.i.i

if.end151.1.i.i.1.i.i.i:
  %8 = phi i8 [ %.promoted.i.i.i.i, %entry ], [ %7, %if.end151.1.i.1.i.i.i.i ]
  %9 = phi i8 [ %.promoted42.i.i.i.i, %entry ], [ %6, %if.end151.1.i.1.i.i.i.i ]
  %10 = phi i8 [ %.promoted56.i.i.i.i, %entry ], [ %5, %if.end151.1.i.1.i.i.i.i ]
  %11 = phi i8 [ %.promoted51.i.i.i.i, %entry ], [ %4, %if.end151.1.i.1.i.i.i.i ]
  %12 = phi i8 [ %.promoted51.i.i.i.i, %entry ], [ %3, %if.end151.1.i.1.i.i.i.i ]
  %13 = phi i8 [ 0, %entry ], [ %2, %if.end151.1.i.1.i.i.i.i ]
  %14 = phi i8 [ %.promoted42.i.i.i.i, %entry ], [ %1, %if.end151.1.i.1.i.i.i.i ]
  %15 = phi i8 [ %.promoted.i.i.i.i, %entry ], [ %0, %if.end151.1.i.1.i.i.i.i ]
  %16 = phi i8 [ 0, %entry ], [ %6, %if.end151.1.i.1.i.i.i.i ]
  %17 = phi i8 [ %.promoted51.i.i.i.i, %entry ], [ %4, %if.end151.1.i.1.i.i.i.i ]
  %18 = phi i8 [ %.promoted56.i.i.i.i, %entry ], [ %5, %if.end151.1.i.1.i.i.i.i ]
  %19 = phi i8 [ %.promoted51.i.i.i.i, %entry ], [ %4, %if.end151.1.i.1.i.i.i.i ]
  %20 = phi i8 [ %.promoted56.i.i.i.i, %entry ], [ %5, %if.end151.1.i.1.i.i.i.i ]
  %21 = phi i8 [ %.promoted42.i.i.i.i, %entry ], [ %6, %if.end151.1.i.1.i.i.i.i ]
  %22 = phi i8 [ %.promoted.i.i.i.i, %entry ], [ %7, %if.end151.1.i.1.i.i.i.i ]
  %tobool.not.i.1121.i.1.i.i.i = icmp ne i8 %18, 0
  %cmp258.1.i.1.1117.i.1.i9.i.i = icmp eq i8 %17, 0
  %cmp258.1.i.i.1.i.i.i = icmp eq i8 %16, 0
  %cmp258.1.i.1.i.i.i.i = icmp eq i8 %12, 0
  %cmp258.i.1.i.i.i.i = icmp eq i8 %13, 0
  %cmp258.1.i.i.i.i.i = icmp eq i8 %14, 0
  %cmp258.i.i.i.i.i = icmp eq i8 %15, 0
  %cmp258.1.i.1.1.i.i.i.i = icmp eq i8 %11, 0
  %cmp258.i.1.1.i.i.i.i = icmp eq i8 %10, 0
  %cmp258.1.i.187.i.i.i.i = icmp eq i8 %9, 0
  %cmp258.i.185.i.i.i.i = icmp eq i8 %8, 0
  %cmp258.1.i.1.1117.i.i.i.i = icmp eq i8 %19, 0
  %cmp258.i.1.1115.i.i.i.i = icmp eq i8 %20, 0
  %cmp258.1.i.1113.i.i.i.i = icmp eq i8 %21, 0
  %cmp258.i.1111.i.i.i.i = icmp eq i8 %22, 0
  %cmp258.1.i.187.1.i.i.i.i = icmp eq i8 %16, 0
  ret i32 0
}
```
```
opt: /root/llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:13878: llvm::SmallVector<std::optional<llvm::TargetTransformInfo::ShuffleKind> > llvm::slpvectorizer::BoUpSLP::isGatherShuffledEntry(const llvm::slpvectorizer::BoUpSLP::TreeEntry*, llvm::ArrayRef<llvm::Value*>, llvm::SmallVectorImpl<int>&, llvm::SmallVectorImpl<llvm::SmallVector<const llvm::slpvectorizer::BoUpSLP::TreeEntry*> >&, unsigned int, bool): Assertion `(TE->Idx == 0 || (TE->hasState() && TE->getOpcode() == Instruction::ExtractElement) || isSplat(TE->Scalars) || getSameValuesTreeEntry(TE->getMainOp(), TE->Scalars)) && "Expected splat or extractelements only node."' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=slp-vectorizer <source>
1.	Running pass "function(slp-vectorizer)" on module "<source>"
2.	Running pass "slp-vectorizer" on function "main"
 #0 0x0000000005447b18 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5447b18)
 #1 0x00000000054454d4 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x000072c4b8a42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x000072c4b8a969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x000072c4b8a42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x000072c4b8a287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x000072c4b8a2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x000072c4b8a39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x000000000447b405 llvm::slpvectorizer::BoUpSLP::isGatherShuffledEntry(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::ArrayRef<llvm::Value*>, llvm::SmallVectorImpl<int>&, llvm::SmallVectorImpl<llvm::SmallVector<llvm::slpvectorizer::BoUpSLP::TreeEntry const*, 6u>>&, unsigned int, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x447b405)
 #9 0x000000000447c786 llvm::InstructionCost llvm::slpvectorizer::BoUpSLP::processBuildVector<llvm::slpvectorizer::BoUpSLP::ShuffleCostEstimator, llvm::InstructionCost, llvm::TargetTransformInfo, llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP, llvm::SmallPtrSetImpl<llvm::Value*>>(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::Type*, llvm::TargetTransformInfo&, llvm::ArrayRef<llvm::Value*>&, llvm::slpvectorizer::BoUpSLP&, llvm::SmallPtrSetImpl<llvm::Value*>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x447c786)
#10 0x000000000447ec37 llvm::slpvectorizer::BoUpSLP::getEntryCost(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::ArrayRef<llvm::Value*>, llvm::SmallPtrSetImpl<llvm::Value*>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x447ec37)
#11 0x00000000044b3879 llvm::slpvectorizer::BoUpSLP::getTreeCost(llvm::ArrayRef<llvm::Value*>) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x44b3879)
#12 0x00000000044bd45d llvm::SLPVectorizerPass::tryToVectorizeList(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x44bd45d)
#13 0x00000000044c1701 bool llvm::SLPVectorizerPass::vectorizeCmpInsts<std::reverse_iterator<llvm::CmpInst* const*>>(llvm::iterator_range<std::reverse_iterator<llvm::CmpInst* const*>>, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x44c1701)
#14 0x00000000044c1fab llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&)::'lambda3'(bool)::operator()(bool) const SLPVectorizer.cpp:0:0
#15 0x00000000044c575f llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x44c575f)
#16 0x00000000044cbef6 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#17 0x00000000044cca4b llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x44cca4b)
#18 0x0000000003182e1e llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3182e1e)
#19 0x00000000052431d0 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x52431d0)
#20 0x0000000000e6e03e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe6e03e)
#21 0x0000000005241aeb llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5241aeb)
#22 0x0000000000e6d34e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe6d34e)
#23 0x00000000052414f0 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x52414f0)
#24 0x0000000000935a5a llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x935a5a)
#25 0x00000000009290cc optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x9290cc)
#26 0x000072c4b8a29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#27 0x000072c4b8a29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#28 0x00000000009209a5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x9209a5)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```
llvm version: dbd219aef4be56754c793589c60bd787b7de60c2



Fix patch:
commit eb14d2a1d48fe76c5faed71a08547135a35ee742
Author: Alexey Bataev <a.bataev@outlook.com>
Date:   Mon Feb 24 06:02:56 2025 -0800

    [SLP]Fix check for matched gather node, if it is a subvector node
    
    If the gather node is a subvector node, it may match the existing
    vector/gather node in the graph, but still may require reordering. in
    this case need to fully check its dependencies to prevent a compiler
    crash.
    
    Fixes #128401

diff --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index bf256d82ae17..5fc5fb10fad5 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -13320,9 +13320,16 @@ BoUpSLP::isGatherShuffledSingleRegisterEntry(
   Entries.clear();
   // TODO: currently checking only for Scalars in the tree entry, need to count
   // reused elements too for better cost estimation.
-  const EdgeInfo &TEUseEI = TE == VectorizableTree.front().get()
-                                ? EdgeInfo(const_cast<TreeEntry *>(TE), 0)
-                                : TE->UserTreeIndex;
+  auto GetUserEntry = [&](const TreeEntry *TE) {
+    while (TE->UserTreeIndex && TE->UserTreeIndex.EdgeIdx == UINT_MAX)
+      TE = TE->UserTreeIndex.UserTE;
+    if (TE == VectorizableTree.front().get())
+      return EdgeInfo(const_cast<TreeEntry *>(TE), 0);
+    return TE->UserTreeIndex;
+  };
+  const EdgeInfo TEUseEI = GetUserEntry(TE);
+  if (!TEUseEI)
+    return std::nullopt;
   const Instruction *TEInsertPt = &getLastInstructionInBundle(TEUseEI.UserTE);
   const BasicBlock *TEInsertBlock = nullptr;
   // Main node of PHI entries keeps the correct order of operands/incoming
@@ -13874,15 +13881,13 @@ BoUpSLP::isGatherShuffledEntry(
   assert(VL.size() % NumParts == 0 &&
          "Number of scalars must be divisible by NumParts.");
   if (TE->UserTreeIndex && TE->UserTreeIndex.UserTE->isGather() &&
-      TE->UserTreeIndex.EdgeIdx == UINT_MAX) {
-    assert(
-        (TE->Idx == 0 ||
-         (TE->hasState() && TE->getOpcode() == Instruction::ExtractElement) ||
-         isSplat(TE->Scalars) ||
-         getSameValuesTreeEntry(TE->getMainOp(), TE->Scalars)) &&
-        "Expected splat or extractelements only node.");
+      TE->UserTreeIndex.EdgeIdx == UINT_MAX &&
+      (TE->Idx == 0 ||
+       (TE->hasState() && TE->getOpcode() == Instruction::ExtractElement) ||
+       isSplat(TE->Scalars) ||
+       (TE->hasState() &&
+        getSameValuesTreeEntry(TE->getMainOp(), TE->Scalars))))
     return {};
-  }
   unsigned SliceSize = getPartNumElems(VL.size(), NumParts);
   SmallVector<std::optional<TTI::ShuffleKind>> Res;
   for (unsigned Part : seq<unsigned>(NumParts)) {


Regression tests:
file: llvm/test/Transforms/SLPVectorizer/X86/bv-matched-node-reorder.ll
commands: opt -passes=slp-vectorizer -S -mtriple=x86_64-unknown-linux-gnu < %s
tests: test_name: <module>
test_body: 
@g = global [8 x i8] zeroinitializer

define i32 @main() {
;
entry:
  %l2.i.i.i.i = load i8, ptr getelementptr inbounds nuw (i8, ptr @g, i64 5), align 1
  %li.i.i.i = load i8, ptr getelementptr inbounds nuw (i8, ptr @g, i64 4), align 1
  %l1.i.i.i.i = load i8, ptr getelementptr inbounds nuw (i8, ptr @g, i64 7), align 1
  %l6.i.i.i.i = load i8, ptr getelementptr inbounds nuw (i8, ptr @g, i64 6), align 1
  br i1 false, label %if.end151.1.i.i.1.i.i.i, label %end

pre:
  br label %end

end:
  %0 = phi i8 [ 0, %pre ], [ %li.i.i.i, %entry ]
  %1 = phi i8 [ 0, %pre ], [ %l2.i.i.i.i, %entry ]
  %2 = phi i8 [ 0, %pre ], [ %l6.i.i.i.i, %entry ]
  %3 = phi i8 [ 0, %pre ], [ %l1.i.i.i.i, %entry ]
  %4 = phi i8 [ 0, %pre ], [ %l1.i.i.i.i, %entry ]
  %5 = phi i8 [ 0, %pre ], [ %l6.i.i.i.i, %entry ]
  %6 = phi i8 [ 0, %pre ], [ %l2.i.i.i.i, %entry ]
  %7 = phi i8 [ 0, %pre ], [ %li.i.i.i, %entry ]
  br label %if.end151.1.i.i.1.i.i.i

if.end151.1.i.i.1.i.i.i:
  %8 = phi i8 [ %li.i.i.i, %entry ], [ %7, %end ]
  %9 = phi i8 [ %l2.i.i.i.i, %entry ], [ %6, %end ]
  %10 = phi i8 [ %l6.i.i.i.i, %entry ], [ %5, %end ]
  %11 = phi i8 [ %l1.i.i.i.i, %entry ], [ %4, %end ]
  %12 = phi i8 [ %l1.i.i.i.i, %entry ], [ %3, %end ]
  %13 = phi i8 [ 0, %entry ], [ %2, %end ]
  %14 = phi i8 [ %l2.i.i.i.i, %entry ], [ %1, %end ]
  %15 = phi i8 [ %li.i.i.i, %entry ], [ %0, %end ]
  %16 = phi i8 [ 0, %entry ], [ %6, %end ]
  %17 = phi i8 [ %l1.i.i.i.i, %entry ], [ %4, %end ]
  %18 = phi i8 [ %l6.i.i.i.i, %entry ], [ %5, %end ]
  %19 = phi i8 [ %l1.i.i.i.i, %entry ], [ %4, %end ]
  %20 = phi i8 [ %l6.i.i.i.i, %entry ], [ %5, %end ]
  %21 = phi i8 [ %l2.i.i.i.i, %entry ], [ %6, %end ]
  %22 = phi i8 [ %li.i.i.i, %entry ], [ %7, %end ]
  %tobool.not.i.1121.i.1.i.i.i = icmp ne i8 %18, 0
  %c1.1.1117.i.1.i9.i.i = icmp eq i8 %17, 0
  %c1.i.1.i.i.i = icmp eq i8 %16, 0
  %c1.1.i.i.i.i = icmp eq i8 %12, 0
  %cmp258.i.1.i.i.i.i = icmp eq i8 %13, 0
  %c1.i.i.i.i = icmp eq i8 %14, 0
  %cmp258.i.i.i.i.i = icmp eq i8 %15, 0
  %c1.1.1.i.i.i.i = icmp eq i8 %11, 0
  %cmp258.i.1.1.i.i.i.i = icmp eq i8 %10, 0
  %c1.187.i.i.i.i = icmp eq i8 %9, 0
  %cmp258.i.185.i.i.i.i = icmp eq i8 %8, 0
  %c1.1.1117.i.i.i.i = icmp eq i8 %19, 0
  %cmp258.i.1.1115.i.i.i.i = icmp eq i8 %20, 0
  %c1.1113.i.i.i.i = icmp eq i8 %21, 0
  %cmp258.i.1111.i.i.i.i = icmp eq i8 %22, 0
  %c1.187.1.i.i.i.i = icmp eq i8 %16, 0
  ret i32 0
}