<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/65015>65015</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [AArch64] Crash "Invalid child # of SDNode!" in tryCombineMULLWithUZP1
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          Benjins
      </td>
    </tr>
</table>

<pre>
    The following is a reduced repro of the issue, when compiled with `llc` with assertions enabled:
```llvm
target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
target triple = "aarch64-unknown-linux-gnu"

define <2 x i32> @do_stuff(<2 x i64> %0, <2 x i64> %1) {
  %bc.1 = bitcast <2 x i64> %1 to <4 x i32>

 %trunc.0 = trunc <2 x i64> %0 to <2 x i32>

  %shuff.hi = shufflevector <4 x i32> %bc.1, <4 x i32> zeroinitializer, <2 x i32> <i32 2, i32 3>
 %shuff.lo = shufflevector <4 x i32> %bc.1, <4 x i32> zeroinitializer, <2 x i32> <i32 0, i32 1>

  %smull = tail call <2 x i64> @llvm.aarch64.neon.smull.v2i64(<2 x i32> %shuff.hi, <2 x i32> %trunc.0)

  %trunc.smull = trunc <2 x i64> %smull to <2 x i32>
 %final = add <2 x i32> %trunc.smull, %shuff.lo
  ret <2 x i32> %final
}

; Function Attrs: nocallback nofree nosync nounwind willreturn
declare <2 x i64> @llvm.aarch64.neon.smull.v2i64(<2 x i32>, <2 x i32>) #0

attributes #0 = { nocallback nofree nosync nounwind willreturn }
```

Godbolt link: https://godbolt.org/z/doobex9e9

A bisect showed that this started happening in 16daaf0887f9579bfaf0ffd18838504ad28cb25b, with the introduction of `tryCombineMULLWithUZP1`

>From looking at the code, it appears that the logic is correct, but there needs to be some guards in place to avoid the crash: if `ExtractLowUser` does not have the expected operand, we set `HasFoundMULLow` to false, but still check its operands. If the first operand matches we will try to check the second one's opcode, but the second one may not exist if `ExtractLowUser` was some other opcode to begin with
https://github.com/llvm/llvm-project/blob/b6bab6db9bea2793634bec2e33385f3d89a5e7f3/llvm/lib/Target/AArch64/AArch64ISelLowering.cpp#L22976-L22984

I have confirmed this still repros on the latest trunk, b6bab6db9bea2793634bec2e33385f3d89a5e7f3

For triage/priority: this was not found in manually-written code, but was found by a fuzzer to test SIMD codegen
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJy0Vs1u4zgSfhr6UrAhkZYsHXxwkvZugPRigXRjgb0MKLJksUOTBknFcZ5-UFScOJ00MI3BAIklsf4-flUslozR7BzimlVXrLqZyTENPqyv0P0wLs46r0_rbwNC7631R-N2YCJICKhHhRoCHoIH30MaEEyMIzJ-DccBHSi_PxiLGo4mDcDqwlrF6mL6lDFiSMa7COhkZ1EzsWHFDSs2rC6mP2sf99NSkmGHCbRM0sqTHxMwcQOMc5zvmdjg3DRMbOhf8LkpayY2-Ye-6iUTm3o5NyUnhZI3cyf4tHZPa5y_C5KCOVg8B5AyqKFezkf34PzRza1x49N858ZXs-lXY28cWV1zeAJDAb4AWxba_xHT2PeMgk8yAvQFGK8KourDasl4C2x1NfkFWurUosyAOpOUjOkTI0ieVpevwS_BkUYKo1OLIrvJ7x-dFC9O-OdOSCUOY98vBpPd5A-Lj6iSD--jn1G_7PBC8IzBG2eSkdY8Y7ik4MVSXBvBgZOEXsQrjjcA1v_zAIozgPJTIvajtROZ0lhQMn-9I3SZC3jxUkELh94tstnikZPOW0W8Ij7T-wmo1wwy3n5AM4kuMH2e4Enh8ySTvDdOTg6k1r8CkJ1kgG_ZOEMJmD6aZa8vkFc3l9iZuILt6BT1AdikFCITG3Ce2OykegDn-4AIzseTU-D86I7GUUOxNmAagzsfPmVlwL-ZgA-k54PIRXEJWaYUTDcmjFk0tYnV1W-Bhjcazq3uMsS_vO68TWCNeyA-hpQORAzjW8a3u0m68GHH-PaZ8a32vsOnFt-VxQY6E1EliIM_ooY0yARpMBFikiGhhkEeDuhyQ3dQ1lrKvmiaVd9Wq7brZV_0vS6bRjRVsZSaN6rjVZebO_Xv3O5dCl6PU_p8Ty0-hdO133fG4dfvd3f_M2n4_v__lj9tcBv8Hqz3DxQ8w0JQXuebwyQgXDLEM2QE63dG0bWjfAioEul1Y5YFBIeoIxV1hxD9HmE3yqAj7epgpUISyUdv9BQnyDgQqybj_fKUglTpzh-_Rwx0O2mPEZxPMMhHzCb4dEBFjPkDBul05gAhUq3Xxb9l3PrRadqvP5KH5KGXNuIZZkzGWlADqgcwKZ7dxAXcTtdmb0JM52XYy6QGjBSCSgZSOJHLyZ7UIyrvNHiHjK_I3Zm7F04uFGAvT3kz-GRi-uWejzJO1Hmi9MXjROnOuJzwKXM_laJJw9gtlN8zvs2X9fSYH4L_kfO07azv6FF3sqt113Yo-aoVtVh2qDgKIZqqF7ppZYWrXlz4MWT3LV_JjG83m3yG395u79He-SMG43YLdTgwLu44b1f1nB7N8rLebqdcKu96E_b5MORzQOzm-SWCd1OlyYQx5fb5kBn9q7gvq9sHmiHkDhnfHoLxwaQTVVyOSlRTQnqqGarRvXSjtPY0PwaTUh6b3rJJ2pNmdwIJ_fj8jIESk2He3369yeo7dDO9FroVrZzhuqxbUTRlW5WzYa3KRqlSSiywRN42RVHwYimrskJslFzOzJoXXBQNr3khuCgXXVl15apvseiqSjQNWxa4l8Yucjf1YTfLc966roqymlnZoY15euTc4fE8BHIaJsM610M37iJ1YxNTfPOSTLJ57Dwnt7qBazqeNHfdukdpjQY1GKup1VKDub_5TyanZJwTd593m9kY7Pq3KzXDjoxv87b-DAAA__8RfF8g">