Rebase

In D144958#4206872, @aeubanks wrote:

a more succinct version: https://godbolt.org/z/7YTqP89Mv shows that slp-vectorizer introduces loads from poison

In D144958#4206872, @aeubanks wrote:

a more succinct version: https://godbolt.org/z/7YTqP89Mv shows that slp-vectorizer introduces loads from poison

In D144958#4203422, @rupprecht wrote:

We're still seeing issues with this at trunk, even after the followup assertion fix in 874c49f55454cb285282e6d184f809945c0beca1.

One strange thing I noticed is an entire method that now gets replaced w/ unreachable. This may just be a bug in SimplifyCFGPass that this patch triggers: https://godbolt.org/z/1G6PTd6os

(That method isn't the one that's causing problems for us, but maybe it has the same root cause)

Rebase

Restore some deleted code

Rebase

In D145823#4195082, @jdoerfert wrote:

In D145823#4194245, @ddpagan wrote:

In D145823#4192464, @ABataev wrote:

Also, can any clause affect the behavior?

If I understand your question, I don't believe that any of the allowed clauses affect the behavior in a way that would invalidate transforming the combined loops in such a manner.

At least the way we tried to design them, they should not. That said, we need to ensure the clauses apply properly, e.g., the reduction is applied to all loop-associated directives, but that should happen automagically, I think. The AMDGPU test case shows at least the right reduction.

LG

Also, can any clause affect the behavior?

Can we add also simd for such loops?

LG

Restore accidentally removed lines, address comments

Rebase

LG with a nit

Restore deleted code/update test

Rebase

LG

Address comment

Rebase

In D132261#4172316, @dyung wrote:

@ABataev, one of our internal tests seems to hit an infinite loop in the compiler after this change. I have filed issue 61224 for the issue, can you take a look?

Address comments

Address comments, allow to shuffle nodes with different VF.

In D145093#4164877, @jyu2 wrote:

I mean we shall emit the same mapping for (*a)[:3] and for a[0][:3]

Yes I mean emit (*a)[:3] as a[0][:3]

The difficulty is during the process array section of
OMPArraySectionExpr 0x12aa37e0 '<OpenMP array section type>' lvalue

-ImplicitCastExpr 0x12a8a918 'int *' <ArrayToPointerDecay>
`-ArraySubscriptExpr 0x12a8a8d8 'int[3]':'int[3]' lvalue
	-ImplicitCastExpr 0x12a8a8c0 'int (*)[3]' <LValueToRValue>
	`-DeclRefExpr 0x12a8a880 'int (*)[3]' lvalue ParmVar 0x12a8a000 'a' 'int (*)[3]'
`-IntegerLiteral 0x12a8a8a0 'int' 0
-<<<NULL>>>
-IntegerLiteral 0x12a8a8f8 'int' 3

`-<<<NULL>>>

It is not easy to set section base as a[0].

In D145093#4164854, @jyu2 wrote:

In D145093#4164528, @ABataev wrote:

What result produces map(a[0][:3]?

Yes, that would be another way to fix the runtime problem. However the difficulty is when process array section, section base is different.
with a[0][:3]
the section base is a[0]
with (*a)[:3], the section base is (*a); It is hard to set a[0] as section base during processing the array section.

That is why I am adding dereference pointer not a[0].

What result produces map(a[0][:3]?

Address comments

LG

In D144770#4157230, @vdmitrie wrote:

In D144770#4157226, @ABataev wrote:

In D144770#4157187, @vdmitrie wrote:

In D144770#4153415, @RKSimon wrote:

I'd expect this to cause cost changes - have you had any luck creating tests demonstrating that?

I was not able to make one. Existing tests that are sensitive to this cost modeling are:

• for plain wide loads:

llvm/test/Transforms/SLPVectorizer/X86/remark_horcost.ll
llvm/test/Transforms/SLPVectorizer/X86/remark_not_all_parts.ll

• for gather loads:

llvm/test/Transforms/SLPVectorizer/X86/remark_gather-load-redux-cost.ll

But yep, I agree that this is not a great coverage.

Make them to emit remarks with costs estimations?

I'm not sure I understand. All these tests do already check for pass-remarks output which includes vec tree cost. Did you mean something else?

In D144770#4157187, @vdmitrie wrote:

In D144770#4153415, @RKSimon wrote:

I'd expect this to cause cost changes - have you had any luck creating tests demonstrating that?

I was not able to make one. Existing tests that are sensitive to this cost modeling are:

• for plain wide loads:

llvm/test/Transforms/SLPVectorizer/X86/remark_horcost.ll
llvm/test/Transforms/SLPVectorizer/X86/remark_not_all_parts.ll

• for gather loads:

llvm/test/Transforms/SLPVectorizer/X86/remark_gather-load-redux-cost.ll

But yep, I agree that this is not a great coverage.

LG, thanks!

In D141940#4155254, @eaeltsin wrote:

Failing assertion is

assert.h assertion failed at ...llvm/include/llvm/ADT/SmallVector.h:298 in const_reference llvm::SmallVectorTemplateCommon<llvm::Value *>::operator[](size_type) const [T = llvm::Value *]: idx < size()

In D141940#4155223, @eaeltsin wrote:

Heads up: this commits crashes one of our tests, the stack trace is:

In D140580#4151643, @DaniilSuchkov wrote:

This patch is causing a crash even after the 26fec4e845a833214d2b0036ea90f1b1c2418d50
IR:

target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128-ni:1-p2:32:8:8:32-ni:2"
target triple = "x86_64-unknown-linux-gnu"

define void @foo() #0 {
bb:
  br label %bb1

bb1:                                              ; preds = %bb1, %bb
  %inst = phi i32 [ poison, %bb ], [ %inst58, %bb1 ]
  %inst2 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 poison
  %inst3 = load i32, ptr addrspace(1) %inst2, align 4
  %inst4 = add i32 %inst3, -1
  store i32 %inst4, ptr addrspace(1) %inst2, align 4
  %inst5 = add i32 poison, -1
  %inst6 = mul i32 %inst4, %inst
  %inst7 = mul i32 %inst6, %inst5
  %inst8 = add nuw nsw i64 poison, 1
  %inst9 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 %inst8
  %inst10 = load i32, ptr addrspace(1) %inst9, align 4
  %inst11 = add i32 %inst10, -1
  store i32 %inst11, ptr addrspace(1) %inst9, align 4
  %inst12 = add i32 poison, -1
  %inst13 = mul i32 %inst11, %inst7
  %inst14 = mul i32 %inst13, %inst12
  %inst15 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 poison
  %inst16 = load i32, ptr addrspace(1) %inst15, align 4
  %inst17 = add i32 %inst16, -1
  store i32 %inst17, ptr addrspace(1) %inst15, align 4
  %inst18 = add i32 poison, -1
  %inst19 = mul i32 %inst17, %inst14
  %inst20 = mul i32 %inst19, %inst18
  %inst21 = add nuw nsw i64 poison, 1
  %inst22 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 %inst21
  %inst23 = load i32, ptr addrspace(1) %inst22, align 4
  %inst24 = add i32 %inst23, -1
  store i32 %inst24, ptr addrspace(1) %inst22, align 4
  %inst25 = add i32 poison, -1
  %inst26 = mul i32 %inst24, %inst20
  %inst27 = mul i32 %inst26, %inst25
  %inst28 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 poison
  %inst29 = load i32, ptr addrspace(1) %inst28, align 4
  %inst30 = add i32 %inst29, -1
  store i32 %inst30, ptr addrspace(1) %inst28, align 4
  %inst31 = mul i32 %inst30, 47961
  %inst32 = add i32 %inst31, -1
  %inst33 = mul i32 %inst30, %inst27
  %inst34 = mul i32 %inst33, %inst32
  %inst35 = add nuw nsw i64 poison, 1
  %inst36 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 %inst35
  %inst37 = load i32, ptr addrspace(1) %inst36, align 4
  %inst38 = add i32 %inst37, -1
  store i32 %inst38, ptr addrspace(1) %inst36, align 4
  %inst39 = mul i32 %inst38, 47961
  %inst40 = add i32 %inst39, -1
  %inst41 = mul i32 %inst38, %inst34
  %inst42 = mul i32 %inst41, %inst40
  %inst43 = add nuw nsw i64 %inst35, 1
  %inst44 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 %inst43
  %inst45 = load i32, ptr addrspace(1) %inst44, align 4
  %inst46 = add i32 %inst45, -1
  store i32 %inst46, ptr addrspace(1) %inst44, align 4
  %inst47 = mul i32 %inst46, 47961
  %inst48 = add i32 %inst47, -1
  %inst49 = mul i32 %inst46, %inst42
  %inst50 = mul i32 %inst49, %inst48
  %inst51 = add nuw nsw i64 %inst43, 1
  %inst52 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 %inst51
  %inst53 = load i32, ptr addrspace(1) %inst52, align 4
  %inst54 = add i32 %inst53, -1
  store i32 %inst54, ptr addrspace(1) %inst52, align 4
  %inst55 = mul i32 %inst54, 47961
  %inst56 = add i32 %inst55, -1
  %inst57 = mul i32 %inst54, %inst50
  %inst58 = mul i32 %inst57, %inst56
  br label %bb1
}

attributes #0 = { "target-features"="+avx" }

Command:

opt -passes=slp-vectorizer -disable-output ir.ll

Result:

opt: llvm-project/llvm/include/llvm/ADT/DenseMap.h:1251: llvm::DenseMapIterator<KeyT, ValueT, KeyInfoT, Bucket, IsConst>::value_type* llvm::DenseMapIterator<KeyT, ValueT, KeyInfoT, Bucket, IsConst>::operator->() const [with KeyT = llvm::Value*; ValueT = llvm::SmallVector<llvm::Instruction*>; KeyInfoT = llvm::DenseMapInfo<llvm::Value*, void>; Bucket = llvm::detail::DenseMapPair<llvm::Value*, llvm::SmallVector<llvm::Instruction*> >; bool IsConst = false; llvm::DenseMapIterator<KeyT, ValueT, KeyInfoT, Bucket, IsConst>::pointer = llvm::detail::DenseMapPair<llvm::Value*, llvm::SmallVector<llvm::Instruction*> >*; llvm::DenseMapIterator<KeyT, ValueT, KeyInfoT, Bucket, IsConst>::value_type = llvm::detail::DenseMapPair<llvm::Value*, llvm::SmallVector<llvm::Instruction*> >]: Assertion `Ptr != End && "dereferencing end() iterator"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: bin/opt -passes=slp-vectorizer -disable-output bugpoint-reduced-simplified-minimized.ll
 #0 0x0000000003ab5864 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) llvm-project/llvm/lib/Support/Unix/Signals.inc:565:0
 #1 0x0000000003ab5c53 PrintStackTraceSignalHandler(void*) llvm-project/llvm/lib/Support/Unix/Signals.inc:639:0
 #2 0x0000000003ab3783 llvm::sys::RunSignalHandlers() llvm-project/llvm/lib/Support/Signals.cpp:104:0
 #3 0x0000000003ab529f SignalHandler(int) llvm-project/llvm/lib/Support/Unix/Signals.inc:410:0
 #4 0x00007f1bd34035e0 __restore_rt sigaction.c:0:0
 #5 0x00007f1bd1f691f7 raise (/lib64/libc.so.6+0x351f7)
 #6 0x00007f1bd1f6a8e8 abort (/lib64/libc.so.6+0x368e8)
 #7 0x00007f1bd1f62266 __assert_fail_base (/lib64/libc.so.6+0x2e266)
 #8 0x00007f1bd1f62312 (/lib64/libc.so.6+0x2e312)
 #9 0x0000000003dd059a llvm::DenseMapIterator<llvm::Value*, llvm::SmallVector<llvm::Instruction*, 6u>, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, llvm::SmallVector<llvm::Instruction*, 6u>>, false>::operator->() const llvm-project/llvm/include/llvm/ADT/DenseMap.h:1252:0
#10 0x0000000003d87336 (anonymous namespace)::HorizontalReduction::tryToReduce(llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo const&) llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:13046:0
#11 0x0000000003d8a956 llvm::SLPVectorizerPass::vectorizeHorReduction(llvm::PHINode*, llvm::Value*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*, llvm::SmallVectorImpl<llvm::WeakTrackingVH>&)::'lambda'(llvm::Instruction*, llvm::Value*&, llvm::Value*&)::operator()(llvm::Instruction*, llvm::Value*&, llvm::Value*&) const llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:13745:0
#12 0x0000000003d8abcb llvm::SLPVectorizerPass::vectorizeHorReduction(llvm::PHINode*, llvm::Value*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*, llvm::SmallVectorImpl<llvm::WeakTrackingVH>&) llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:13760:0
#13 0x0000000003d8af43 llvm::SLPVectorizerPass::vectorizeRootInstruction(llvm::PHINode*, llvm::Value*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*) llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:13812:0
#14 0x0000000003d8d040 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:14254:0
#15 0x0000000003d7ef19 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:11703:0
#16 0x0000000003d7ea2f llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:11634:0
#17 0x0000000003f47c92 llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:90:0
#18 0x000000000312d1bc llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) llvm-project/llvm/include/llvm/IR/PassManager.h:521:0
#19 0x0000000003f506ce llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:90:0
#20 0x000000000312cb92 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) llvm-project/llvm/lib/IR/PassManager.cpp:125:0
#21 0x0000000003f50632 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:90:0
#22 0x000000000312cecc llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) llvm-project/llvm/include/llvm/IR/PassManager.h:521:0
#23 0x0000000001bf4eeb llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool) llvm-project/llvm/tools/opt/NewPMDriver.cpp:522:0
#24 0x0000000001c1f4f2 main llvm-project/llvm/tools/opt/opt.cpp:719:0
#25 0x00007f1bd1f55c05 __libc_start_main (/lib64/libc.so.6+0x21c05)
#26 0x0000000001bed2a9 _start (llvm-project/buildDA/bin/opt+0x1bed2a9)

It doesn't crash if I revert 26fec4e845a833214d2b0036ea90f1b1c2418d50 and 5dccea5a68fb5181ab88ce6faac4668934f35cd7.

In D141940#4155223, @eaeltsin wrote:

Heads up: this commits crashes one of our tests, the stack trace is:

...
 #2 0x000055c65640bbd6 CrashRecoverySignalHandler(int) (clang+0x800bbd6)
 #3 0x00007fda88e7b1c0 __restore_rt (/usr/grte/v5/lib64/libpthread.so.0+0x151c0)
 #4 0x000055c655b71964 llvm::slpvectorizer::BoUpSLP::isGatherShuffledEntry(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::ArrayRef<llvm::Value*>, llvm::SmallVectorImpl<int>&, llvm::SmallVectorImpl<llvm::slpvectorizer::BoUpSLP::TreeEntry const*>&) (clang+0x7771964)
 #5 0x000055c655b6c47c llvm::slpvectorizer::BoUpSLP::getEntryCost(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::ArrayRef<llvm::Value*>) (clang+0x776c47c)
 #6 0x000055c655b74903 llvm::slpvectorizer::BoUpSLP::getTreeCost(llvm::ArrayRef<llvm::Value*>) (clang+0x7774903)
 #7 0x000055c655b8d3a5 llvm::SLPVectorizerPass::tryToVectorizeList(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, bool) (clang+0x778d3a5)
 #8 0x000055c655b92a0a bool tryToVectorizeSequence<llvm::Value>(llvm::SmallVectorImpl<llvm::Value*>&, llvm::function_ref<unsigned int (llvm::Value*)>, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::ArrayRef<llvm::Value*>, bool)>, bool) (clang+0x7792a0a)
 #9 0x000055c655b89681 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (clang+0x7789681)
#10 0x000055c655b87eb5 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (clang+0x7787eb5)
#11 0x000055c655b877e6 llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (clang+0x77877e6)
#12 0x000055c654ce1e32 llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (clang+0x68e1e32)
#13 0x000055c6562b07cb llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (clang+0x7eb07cb)
#14 0x000055c651f02472 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (clang+0x3b02472)
#15 0x000055c6562b2b27 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (clang+0x7eb2b27)
#16 0x000055c651f04512 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (clang+0x3b04512)
#17 0x000055c6562afcab llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (clang+0x7eafcab)
#18 0x000055c651efa03d (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::__u::unique_ptr<llvm::raw_pwrite_stream, std::__u::default_delete<llvm::raw_pwrite_stream>>&, std::__u::unique_ptr<llvm::ToolOutputFile, std::__u::default_delete<llvm::ToolOutputFile>>&) (clang+0x3afa03d)
#19 0x000055c651ef2d47 clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::__u::unique_ptr<llvm::raw_pwrite_stream, std::__u::default_delete<llvm::raw_pwrite_stream>>) (clang+0x3af2d47)
#20 0x000055c651eef4ca clang::CodeGenAction::ExecuteAction() (clang+0x3aef4ca)
#21 0x000055c6529aad5a clang::FrontendAction::Execute() (clang+0x45aad5a)
#22 0x000055c652919a04 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (clang+0x4519a04)
#23 0x000055c651b958ce clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (clang+0x37958ce)
#24 0x000055c651b8a4af cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (clang+0x378a4af)
...

In D140580#4151643, @DaniilSuchkov wrote:

This patch is causing a crash even after the 26fec4e845a833214d2b0036ea90f1b1c2418d50
IR:

target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128-ni:1-p2:32:8:8:32-ni:2"
target triple = "x86_64-unknown-linux-gnu"

define void @foo() #0 {
bb:
  br label %bb1

bb1:                                              ; preds = %bb1, %bb
  %inst = phi i32 [ poison, %bb ], [ %inst58, %bb1 ]
  %inst2 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 poison
  %inst3 = load i32, ptr addrspace(1) %inst2, align 4
  %inst4 = add i32 %inst3, -1
  store i32 %inst4, ptr addrspace(1) %inst2, align 4
  %inst5 = add i32 poison, -1
  %inst6 = mul i32 %inst4, %inst
  %inst7 = mul i32 %inst6, %inst5
  %inst8 = add nuw nsw i64 poison, 1
  %inst9 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 %inst8
  %inst10 = load i32, ptr addrspace(1) %inst9, align 4
  %inst11 = add i32 %inst10, -1
  store i32 %inst11, ptr addrspace(1) %inst9, align 4
  %inst12 = add i32 poison, -1
  %inst13 = mul i32 %inst11, %inst7
  %inst14 = mul i32 %inst13, %inst12
  %inst15 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 poison
  %inst16 = load i32, ptr addrspace(1) %inst15, align 4
  %inst17 = add i32 %inst16, -1
  store i32 %inst17, ptr addrspace(1) %inst15, align 4
  %inst18 = add i32 poison, -1
  %inst19 = mul i32 %inst17, %inst14
  %inst20 = mul i32 %inst19, %inst18
  %inst21 = add nuw nsw i64 poison, 1
  %inst22 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 %inst21
  %inst23 = load i32, ptr addrspace(1) %inst22, align 4
  %inst24 = add i32 %inst23, -1
  store i32 %inst24, ptr addrspace(1) %inst22, align 4
  %inst25 = add i32 poison, -1
  %inst26 = mul i32 %inst24, %inst20
  %inst27 = mul i32 %inst26, %inst25
  %inst28 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 poison
  %inst29 = load i32, ptr addrspace(1) %inst28, align 4
  %inst30 = add i32 %inst29, -1
  store i32 %inst30, ptr addrspace(1) %inst28, align 4
  %inst31 = mul i32 %inst30, 47961
  %inst32 = add i32 %inst31, -1
  %inst33 = mul i32 %inst30, %inst27
  %inst34 = mul i32 %inst33, %inst32
  %inst35 = add nuw nsw i64 poison, 1
  %inst36 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 %inst35
  %inst37 = load i32, ptr addrspace(1) %inst36, align 4
  %inst38 = add i32 %inst37, -1
  store i32 %inst38, ptr addrspace(1) %inst36, align 4
  %inst39 = mul i32 %inst38, 47961
  %inst40 = add i32 %inst39, -1
  %inst41 = mul i32 %inst38, %inst34
  %inst42 = mul i32 %inst41, %inst40
  %inst43 = add nuw nsw i64 %inst35, 1
  %inst44 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 %inst43
  %inst45 = load i32, ptr addrspace(1) %inst44, align 4
  %inst46 = add i32 %inst45, -1
  store i32 %inst46, ptr addrspace(1) %inst44, align 4
  %inst47 = mul i32 %inst46, 47961
  %inst48 = add i32 %inst47, -1
  %inst49 = mul i32 %inst46, %inst42
  %inst50 = mul i32 %inst49, %inst48
  %inst51 = add nuw nsw i64 %inst43, 1
  %inst52 = getelementptr inbounds i32, ptr addrspace(1) poison, i64 %inst51
  %inst53 = load i32, ptr addrspace(1) %inst52, align 4
  %inst54 = add i32 %inst53, -1
  store i32 %inst54, ptr addrspace(1) %inst52, align 4
  %inst55 = mul i32 %inst54, 47961
  %inst56 = add i32 %inst55, -1
  %inst57 = mul i32 %inst54, %inst50
  %inst58 = mul i32 %inst57, %inst56
  br label %bb1
}

attributes #0 = { "target-features"="+avx" }

Command:

opt -passes=slp-vectorizer -disable-output ir.ll

Result:

opt: llvm-project/llvm/include/llvm/ADT/DenseMap.h:1251: llvm::DenseMapIterator<KeyT, ValueT, KeyInfoT, Bucket, IsConst>::value_type* llvm::DenseMapIterator<KeyT, ValueT, KeyInfoT, Bucket, IsConst>::operator->() const [with KeyT = llvm::Value*; ValueT = llvm::SmallVector<llvm::Instruction*>; KeyInfoT = llvm::DenseMapInfo<llvm::Value*, void>; Bucket = llvm::detail::DenseMapPair<llvm::Value*, llvm::SmallVector<llvm::Instruction*> >; bool IsConst = false; llvm::DenseMapIterator<KeyT, ValueT, KeyInfoT, Bucket, IsConst>::pointer = llvm::detail::DenseMapPair<llvm::Value*, llvm::SmallVector<llvm::Instruction*> >*; llvm::DenseMapIterator<KeyT, ValueT, KeyInfoT, Bucket, IsConst>::value_type = llvm::detail::DenseMapPair<llvm::Value*, llvm::SmallVector<llvm::Instruction*> >]: Assertion `Ptr != End && "dereferencing end() iterator"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: bin/opt -passes=slp-vectorizer -disable-output bugpoint-reduced-simplified-minimized.ll
 #0 0x0000000003ab5864 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) llvm-project/llvm/lib/Support/Unix/Signals.inc:565:0
 #1 0x0000000003ab5c53 PrintStackTraceSignalHandler(void*) llvm-project/llvm/lib/Support/Unix/Signals.inc:639:0
 #2 0x0000000003ab3783 llvm::sys::RunSignalHandlers() llvm-project/llvm/lib/Support/Signals.cpp:104:0
 #3 0x0000000003ab529f SignalHandler(int) llvm-project/llvm/lib/Support/Unix/Signals.inc:410:0
 #4 0x00007f1bd34035e0 __restore_rt sigaction.c:0:0
 #5 0x00007f1bd1f691f7 raise (/lib64/libc.so.6+0x351f7)
 #6 0x00007f1bd1f6a8e8 abort (/lib64/libc.so.6+0x368e8)
 #7 0x00007f1bd1f62266 __assert_fail_base (/lib64/libc.so.6+0x2e266)
 #8 0x00007f1bd1f62312 (/lib64/libc.so.6+0x2e312)
 #9 0x0000000003dd059a llvm::DenseMapIterator<llvm::Value*, llvm::SmallVector<llvm::Instruction*, 6u>, llvm::DenseMapInfo<llvm::Value*, void>, llvm::detail::DenseMapPair<llvm::Value*, llvm::SmallVector<llvm::Instruction*, 6u>>, false>::operator->() const llvm-project/llvm/include/llvm/ADT/DenseMap.h:1252:0
#10 0x0000000003d87336 (anonymous namespace)::HorizontalReduction::tryToReduce(llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo const&) llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:13046:0
#11 0x0000000003d8a956 llvm::SLPVectorizerPass::vectorizeHorReduction(llvm::PHINode*, llvm::Value*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*, llvm::SmallVectorImpl<llvm::WeakTrackingVH>&)::'lambda'(llvm::Instruction*, llvm::Value*&, llvm::Value*&)::operator()(llvm::Instruction*, llvm::Value*&, llvm::Value*&) const llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:13745:0
#12 0x0000000003d8abcb llvm::SLPVectorizerPass::vectorizeHorReduction(llvm::PHINode*, llvm::Value*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*, llvm::SmallVectorImpl<llvm::WeakTrackingVH>&) llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:13760:0
#13 0x0000000003d8af43 llvm::SLPVectorizerPass::vectorizeRootInstruction(llvm::PHINode*, llvm::Value*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*) llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:13812:0
#14 0x0000000003d8d040 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:14254:0
#15 0x0000000003d7ef19 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:11703:0
#16 0x0000000003d7ea2f llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:11634:0
#17 0x0000000003f47c92 llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:90:0
#18 0x000000000312d1bc llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) llvm-project/llvm/include/llvm/IR/PassManager.h:521:0
#19 0x0000000003f506ce llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:90:0
#20 0x000000000312cb92 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) llvm-project/llvm/lib/IR/PassManager.cpp:125:0
#21 0x0000000003f50632 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:90:0
#22 0x000000000312cecc llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) llvm-project/llvm/include/llvm/IR/PassManager.h:521:0
#23 0x0000000001bf4eeb llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool) llvm-project/llvm/tools/opt/NewPMDriver.cpp:522:0
#24 0x0000000001c1f4f2 main llvm-project/llvm/tools/opt/opt.cpp:719:0
#25 0x00007f1bd1f55c05 __libc_start_main (/lib64/libc.so.6+0x21c05)
#26 0x0000000001bed2a9 _start (llvm-project/buildDA/bin/opt+0x1bed2a9)

It doesn't crash if I revert 26fec4e845a833214d2b0036ea90f1b1c2418d50 and 5dccea5a68fb5181ab88ce6faac4668934f35cd7.