<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/56463>56463</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            InstCombine pass crashed with "Instructions.cpp:528: void llvm::CallInst::init(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::ArrayRef<llvm::OperandBundleDefT<llvm::Value*> >, const llvm::Twine&): Assertion `(i >= FTy->getNumParams() || FTy->getParamType(i) == Args[i]->getType()) && "Calling a function with a bad signature!"' failed."
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          Hatsunespica
      </td>
    </tr>
</table>

<pre>
    https://gcc.godbolt.org/z/ov8Tf1PcT

`opt -instcombine` crashed with this IR
```
@percent_s = constant [3 x i8] c"%s\00"

declare i32 @sprintf(i8**, i32*, ...)

define void @PR51200(i8** %p, i32* %p2) {
  %call = call i32 (i8**, i32*, ...) @sprintf(i8** %p, i32* bitcast ([3 x i8]* @percent_s to i32*), i32* %p2)
  ret void
}
```
It calls a function `sprintf` and returns. This case is mutated from [Transforms/InstCombine/stpcpy-1.ll](https://github.com/llvm/llvm-project/blob/main/llvm/test/Transforms/InstCombine/stpcpy-1.ll#L84)
The difference is the original file returns `%call`  directly but here it returns void. By the way, it also crashes if it returns another i32 except `%call`. Example: [Another example returning i32](https://gcc.godbolt.org/z/jjoG9r3aK)

Error message:
```
opt: /home/spica/GitRepo/llvm-project/llvm/lib/IR/Instructions.cpp:528: void llvm::CallInst::init(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::ArrayRef<llvm::OperandBundleDefT<llvm::Value*> >, const llvm::Twine&): Assertion `(i >= FTy->getNumParams() || FTy->getParamType(i) == Args[i]->getType()) && "Calling a function with a bad signature!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: opt stpcpy-16.ll -O2
 #0 0x00007f7ddc8f80d4 PrintStackTraceSignalHandler(void*) Signals.cpp:0:0
 #1 0x00007f7ddc8f5114 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007f7ddc2ff0c0 (/lib/x86_64-linux-gnu/libc.so.6+0x430c0)
 #3 0x00007f7ddc2ff03b raise /build/glibc-sMfBJT/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #4 0x00007f7ddc2de859 abort /build/glibc-sMfBJT/glibc-2.31/stdlib/abort.c:81:7
 #5 0x00007f7ddc2de729 get_sysdep_segment_value /build/glibc-sMfBJT/glibc-2.31/intl/loadmsgcat.c:509:8
 #6 0x00007f7ddc2de729 _nl_load_domain /build/glibc-sMfBJT/glibc-2.31/intl/loadmsgcat.c:970:34
 #7 0x00007f7ddc2f0006 (/lib/x86_64-linux-gnu/libc.so.6+0x34006)
 #8 0x00007f7ddcbdbdf1 llvm::CallInst::init(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::ArrayRef<llvm::OperandBundleDefT<llvm::Value*>>, llvm::Twine const&) (/usr/local/bin/../lib/libLLVMCore.so.15git+0x244df1)
 #9 0x00007f7ddd7ce9dc llvm::IRBuilderBase::CreateCall(llvm::FunctionType*, llvm::Value*, llvm::ArrayRef<llvm::Value*>, llvm::Twine const&, llvm::MDNode*) (.constprop.0) BuildLibCalls.cpp:0:0
#10 0x00007f7ddd7d2000 emitLibCall(llvm::LibFunc, llvm::Type*, llvm::ArrayRef<llvm::Type*>, llvm::ArrayRef<llvm::Value*>, llvm::IRBuilderBase&, llvm::TargetLibraryInfo const*, bool) BuildLibCalls.cpp:0:0
#11 0x00007f7ddd7d2cdd llvm::emitStrCpy(llvm::Value*, llvm::Value*, llvm::IRBuilderBase&, llvm::TargetLibraryInfo const*) (/usr/local/bin/../lib/libLLVMTransformUtils.so.15git+0xb0cdd)
#12 0x00007f7ddd9c2710 llvm::LibCallSimplifier::optimizeSPrintFString(llvm::CallInst*, llvm::IRBuilderBase&) (/usr/local/bin/../lib/libLLVMTransformUtils.so.15git+0x2a0710)
#13 0x00007f7ddd9c28e0 llvm::LibCallSimplifier::optimizeSPrintF(llvm::CallInst*, llvm::IRBuilderBase&) (/usr/local/bin/../lib/libLLVMTransformUtils.so.15git+0x2a08e0)
#14 0x00007f7ddd9ca05d llvm::LibCallSimplifier::optimizeCall(llvm::CallInst*, llvm::IRBuilderBase&) (/usr/local/bin/../lib/libLLVMTransformUtils.so.15git+0x2a805d)
#15 0x00007f7dddde0a1c llvm::InstCombinerImpl::tryOptimizeCall(llvm::CallInst*) (/usr/local/bin/../lib/libLLVMInstCombine.so.15git+0x9ca1c)
#16 0x00007f7dddde64e1 llvm::InstCombinerImpl::visitCallBase(llvm::CallBase&) (/usr/local/bin/../lib/libLLVMInstCombine.so.15git+0xa24e1)
#17 0x00007f7dddde9e24 llvm::InstCombinerImpl::visitCallInst(llvm::CallInst&) (/usr/local/bin/../lib/libLLVMInstCombine.so.15git+0xa5e24)
#18 0x00007f7dddd911e4 llvm::InstCombinerImpl::run() (/usr/local/bin/../lib/libLLVMInstCombine.so.15git+0x4d1e4)
#19 0x00007f7dddd93148 combineInstructionsOverFunction(llvm::Function&, llvm::InstructionWorklist&, llvm::AAResults*, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::TargetTransformInfo&, llvm::DominatorTree&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::ProfileSummaryInfo*, unsigned int, llvm::LoopInfo*) InstructionCombining.cpp:0:0
#20 0x00007f7dddd93a81 llvm::InstCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/usr/local/bin/../lib/libLLVMInstCombine.so.15git+0x4fa81)
#21 0x00007f7ddf605516 llvm::detail::PassModel<llvm::Function, llvm::InstCombinePass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/usr/local/bin/../lib/libLLVMPasses.so.15git+0xa6516)
#22 0x00007f7ddcc713a4 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/usr/local/bin/../lib/libLLVMCore.so.15git+0x2da3a4)
#23 0x00007f7ddf5ff246 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/usr/local/bin/../lib/libLLVMPasses.so.15git+0xa0246)
#24 0x00007f7ddcc6fed6 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/usr/local/bin/../lib/libLLVMCore.so.15git+0x2d8ed6)
#25 0x00007f7ddf607ad6 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/usr/local/bin/../lib/libLLVMPasses.so.15git+0xa8ad6)
#26 0x00007f7ddcc6df71 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/usr/local/bin/../lib/libLLVMCore.so.15git+0x2d6f71)
#27 0x00005566b3955345 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::StringRef>, llvm::ArrayRef<llvm::PassPlugin>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool) (/usr/local/bin/opt+0x34345)
#28 0x00005566b3945a7b main (/usr/local/bin/opt+0x24a7b)
#29 0x00007f7ddc2e00b3 __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:342:3
#30 0x00005566b39464fe _start (/usr/local/bin/opt+0x254fe)
```

cc @regehr 
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJztWlt34jgS_jXkRScc37Ef8gAkmclOMslJ2N5HjmzJoG5jeyU5HebXT5VswDZOh_Rkrrs5hItdqvrqq4suEBdse7HWulQjdzpyruGxSpLxqmBxkelxIVdw5Rf4L57DRWo_JIuRdTmyps1zYBWlJuciVzopNrHIOVwiiaRqzRn5KvSa6LVQ5OZxP6B51B89q-Qy4bleKjJyL0lSgCaaazLyZy55ISIc-XB15Dgjx1cjf25Z-L4FgfEko5IT4ToE1KlSilynIyeEoc7UPOZ4s3k3Ho9HTtRVkAJs8lwIhgoeHn3bQSt7BQRMlwct5iO8ichoMqtVELyW0CyrfcA3Bs63QQzD7VuLhU6o0qiszYmRbLOni72BaADsDqjk2rjaMDC5HIzLjTZeKEJJWuWJFkVO4OYOLYSY5gx1VTJXY7LAEANKiIIim0pTDcFPZbHBMC4kzVVayI2CLLqB8M6bRHGulS6Tcntuj7PMuBT2EhHSp4rHkFjwIcuedy_npSw-80TDxzgrYnjZUJEfZDRXeO9Ew457G3p7hhZrTphIUy55nhh_NFwppFiJnGYkFRnf-Y2MNHFHRmCYBFDZlsSVJmuOOan3ssj5mMy2Rt1XujUh0oRmqmjKRRGRtkfQvABZaTKJvyQc6qxjcEyuXuimzDjwhTxPG3leX230iHxlUmGI3sE6__y5-CGSLv2pVyZXUhaSbLhSdIUmB_MGmoFB41yvi40huhQJhdcfhH7kZXEcwF1YBYYRukQdKVmZnFPjpCxBoQ-5D2pNiZoBYN6dzoEHFK4_iVyAvvBw-7pJ3MW25E3dHW5-oll1fHUqJd0-8nTkzgdE3asTpO-hIqE2ZlXOMn7J08Vrukijz3S8ltbFV5OiAdIPPk-V4nJXf9gmzDjoMteL7Tm8XXH9c7V5oJJimod1W5rDoyVg7tY0hMJIuJeoYipX0FJnApKjkWyETAsBMUQRwIuDVGMmtdqB6e2UxJQRJVY5hWSDobbp1BOSUigUNq6z4uH2avp0RVQVbzDloT5WkJ1lITV2rXfXvFCq4ljTpgmJPMkqxk1dmUICSMkXLWnCG_NPGi4QVm3KfdpacCt6kMUKiCFUrqoNNFEEQXA623WHANoDOb9vphvgwbWI9WLB3ySdMJaEaWgxjzxgUzRGFmj1CdnIfqSYABLINN3WtGVS39pltWX-97rtnm7ftj3SVwaW3lTkdBQ5aWollpk-dmX2EgbLwDuHiFYv56u8qm8kY1WMIeAz68VzYchh0gCd7pFONyaSCmj52IUrkTEMHqo5V3fp7F-L_Udn7NrYCQxkeINz37XaKsZLDGKVi5f6wrPBAZjg1ageJ1j7NjzZByReFwnjoR8RGmMynYpEs5oHM8oYCdHI5GDE7xuZAOlQH8sa91LxFWbM8hnr-VS7EDv0Pyso26hVQmvTvoV1Hh5sB0O2l3m2xIFLVuBc99tMRhPMGNc72Jz0wgtvg_eljOvBkE7KhB2dMYtZav9juveROtO262ZeN--GvkpJE4DE5H5slimmAmpe4fn29tPdvJAcubT9FfIAfDqeB3x1CI3ahLJJwiOWtBDcPM4wI7icwUKs4VhyWIoh038st30y2vfuLn8uGG8aIsAaGzHo7uUYWw4xTtyKGFEPNDhslFaXCAbLdYtwmFuaYR1n4Rr62wM45PmgjzvJk9LnVUK6selTsoAZiCN4SeX2Jk-LHXUGYFwU2YnE2H1iEtZeMCFFT1rOy22HoeGID1_9fkfeVxD7tfu_tQBvO6URW-DWYXUKfndmPBYlzgRypJMCSNqTgHWxSAVMpOYyTPViI37hT2YCvwZmYInTYWbfo96m4ePcc6gF8Dv-uX3_Qv5-__4SngHwjmdezzNq-ex0z46K_U9yKwTUHbc66wfGuEXtTqs-bEblDbhWX9Vye3-SY--D3jLWxQ1s20kHdtCDHXjcfhP2s1BCI76a2h7o7-T7VdDUAUwd0JMe6Ig73umga1IHmf5A0D5g6oAOu6Aj2-Zvg5ZVvtvifQQqj4HRDqqohwrqMyTNuV57W37_zOVuETG4sjiaGVqj_1PIL5kYWBlMp49cVRnsw45mZtjxbUocPKfJ-oR55xWJfRUPylwWGwH72EIuJD-20ZQmRRSPfEPllyuYTjXuynqSM4jIl2vJ_1vxPGng9ByCrSeeJD1Vm80esRGpctwncdzW6u6Q26Io94IRaRFaBxfmrsFFgWP1g0rDV4r6gSrVzrQT4jqFPd1WCXVHc7rC9jwfGISroY8rJi8FB9pp63SWPWlg-T50sgMOxjUVTQmhi3ew_syGkR7lbJuZXgS54vKZs5oBrr6PF3z8RQhHH3lvaqMBUNnhunu4kExsl7Ybl-H3W9D-7iwN7NQYBQ46JHXWa6mfpo73EQn5u5H7v5jZFsSkE7TuwVISpJy1gwZBqjK-KHZQUOmU0RLmi2FH6wHvcrMZ8mGJGYILHR_9XqecUPa-xNw5NT-RmY_KrAMzr-XVH0z3YE6FtMd30Msplk7sEwp6iOW_FTtDyRiA7x1ydgt33w-C2I183_X8FjZwAfl5ECXPzFciLXfqvToevwxk4iuLvztYOho90zcWj2bBfSRVFNl9pctKX4tsQMlvuv2KO4NnTAfZk46kDIVZtRL5kTzsopcaD5fq9a2B95PI2bekPnFp9uE7ufpw6q3XbyUPfmVYHyBD-Dv5EXbzw_PpJCbN6fdb2hwPhDvaou4RN7es2CXLJZ5iL5WmUi_fc7CeqGqX-PXbWhb1mCN213PweW9-_83RzpnASzmpDZ_ijg_iB3d6P6Iwz0mCvweQfMXXkpyxCxdW-hE900Jn_KK1lCUlZET3Fxojx_n_l67_oC9dHeeskln_Vz3v-GLVD7zAPVtfcKgbFsWezylzAzcKXBYmsetFUWx5Np2cZTTmmboAf8CdM3HhWI6Dp5fWxA9sb5zQgKc2bNes0I0tK4UEhZ2zyMZoGH9zcCYvDIa4AlI8C48F1OEmJCpuhvlOP630upAXP1KtqpybnxacGcwXBvCvmTIfow">