<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/64036>64036</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
[InstCombine] Crash folding binop of vector-typed select and zext since past few days
</td>
</tr>
<tr>
<th>Labels</th>
<td>
new issue
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
Benjins
</td>
</tr>
</table>
<pre>
The following is a minimal repro, when run through `opt -passes=instcombine`:
```llvm
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"
define <16 x i8> @do_stuff(<16 x i8> %0, <16 x i8> %1, <16 x i1> %cmp.i.i) {
entry:
%zext.i.i = zext <16 x i1> %cmp.i.i to <16 x i8>
%sel = select <16 x i1> %cmp.i.i, <16 x i8> %0, <16 x i8> %1
%add.i = add <16 x i8> %sel, %zext.i.i
ret <16 x i8> %add.i
}
attributes #0 = { nocallback nofree nosync nounwind willreturn memory(none) }
```
which will crash with the error:
```
clang++: /llvm-project/llvm/include/llvm/Support/Casting.h:578: decltype(auto) llvm::cast(From*) [with To = llvm::IntegerType; From = const llvm::Type]: Assertion `isa<To>(Val) && "cast<Ty>() argument of incompatible type!"' failed.
```
in `llvm::InstCombinerImpl::foldBinOpOfSelectAndCastOfSelectCondition`
Note: the issue seems to be recent enough that it does not repro on Godbolt, even with a nightly compiler
A bisect shows that this started happening since f12a5561b2cbfae384c9a31293938ee2acea79fd, which looks to fold binops of select operations and a sext/zext of their condition. This ends up mostly working for vector types as well, but the code for zexts:
https://github.com/llvm/llvm-project/blob/f12a5561b2cbfae384c9a31293938ee2acea79fd/llvm/lib/Transforms/InstCombine/InstructionCombining.cpp#L914-L916
will crash due to `getIntegerBitWidth` assuming scalar types
I have verified this is still occurring on the latest trunk, 1d0759e6c3c2eaa8cbacfd76d409ed80ffd9fe9d
For priority/triage purposes: this was not in manually-written code, but was found with a fuzzer to test SIMD codegen
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJyUVs2O47gRfhr6UrAhUZYsHXzwTxwMsMkeppEcFxRZkrhNkQJJtdvz9EFRdrdnZgfIAobAouq_vq8sEYLuLeKelUdWnldijoPz-yPaP7UNq9ap2_5lQOicMe6qbQ86gIBRWz0KAx4n7xg_wXVAC362EAfv5n4AVmVuirCeRAgYWHHWNkTpxlZbZFXGigPLziw70Dn9jHkbl6sofI8RlIjCiJubI7DiDIxzXI-sOOB64jtyUPD0IDH_XqRTtU2PtX4cupqMcl6vbU2H6mFTbddfc14zzr-LH72eDD5iv9fVH9V2PdtX6652bbSd39e9nT-slqfCTlsyOuUVvIOuWfEPYNtMuT9CnLuO8fqHd7zMqIE_3ebf3eb3WzlOG73RjDfAdsclJtrobx8NBVL7hu-R9FL2JPzSE0T3fewnLwFNchDQoPy1i79M_1dFfXoXSt0TFEr9rBrQJBefxTxsPcaf1ZO3-yR25-eRiBi9bueIARgvsmWguyNYJ4UxrZCvYF3nEcG6cLMSrJvtVVsFV22Mxzh7CyOOzt8Yr62zuHT__AOAF_E6aDkkS5BeBDrGAeKAgN47_zPuF1EaYXvGj_QrDsD4hfiwnrz7E2W8i4xftJVmVvh58XWeJudJ4yRC1LbfDKw4lDuCOCiUJt4mZLwWc3SUdzIrDqw4SBEi4_XFu5HxQ6qpPKZsX1xq0qfqFxuxR_9CroojkEnSkM6G-KSXFMozhT6EgD5qZ2kT6CBYcXpxBC9e_0eYFI1XjFfErZRJcXq5Le_ppfD9PKKN4DrQVrpxElG3BmEpJyfa8R10QhtUm79sqU6hn4sI8bQsIP9lnMxy2zmjjtr-Pv3efU0wP1hFnXyIJ2eVpjo-_C7Pf7uIVCdNVocwIwTEMRCdWgSPkpJHm3ZhHEQEHUE5DGBdXNYmOAv_dKp1JhLQ8Q3tAhYBVvdDNDegurVB_xz4AK0ORMcwuGtYfMdBBwhR-IgKBjFNaGlVB20lQpdzUZZV3nLZdgKLeisbUeS8KZqiRuRCotg1nVrWOKHXOPeaKqHmQKutmwIN4r4H3IReUEsCCKtAQMB3AmDaM66jlmhP2Fgat4EXSg-tCjBPMLpApV2df6UcO-fhDWV0Po02gAhwRZO4384x9Vc6hUmRIoQPCg0xTkniF8YvvY7D3G4koflBjh841BrXMn75_xvy4UeT3YsXNnTOj4HxyxOa7pKfJZW7XBIR5TQxXvzW5Nv1b01e3ffD52ZQM6btW2U9xjvFjjr-V6s4sCoDEcI8pjlKYcS9P89Q-AKDeEN4Q687jWqBQUICBXFSzt6TvbOpjUZEDPS_NttXam-usl3ZYCULyVGIWrZCdmpXqW3WoKqzrlNNh416DnlxHiavndfxxvglei16hGn2k0t_84cliatYgK4tjMLOwpjb-up1jGjTNB_TJb3OzWnXJuR387dv6KktKdevX_51TgY92pXaF6opGrHCfV41WbbdNbxYDXtel6KRbSZ3XSNVqbDa8a7Ly21ZYMV5t9J7nvEi23Ge77Yl55uM80LUAmtebKtc1Wyb4Si02dC8N873q0TpfbXNimplRIsmpC8kzi1eF77TBirPK79PIGvnPrBtZnSI4dNL1NGkT6tntJRnOKX5E7toPIlgRJyFB2uas3qQjRiWiLWQeRIhQodXUOIWVrM3-7_NgpQ9QThV978AAAD___ACGSA">