<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/111887>111887</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [SLP-Vectorizer] Segfault in `HorizontalReduction::matchAssociativeReduction`
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          patrick-rivos
      </td>
    </tr>
</table>

<pre>
    Testcase:
```llvm ir
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"

define i32 @main() #0 {
for.body.preheader:
  %0 = load i16, ptr null, align 2
  %1 = xor i16 %0, 0
  %2 = tail call i16 @llvm.smax.i16(i16 %1, i16 %0)
  %3 = tail call i16 @llvm.smax.i16(i16 0, i16 %2)
  %4 = load i16, ptr getelementptr inbounds (i8, ptr null, i64 6), align 2
  %5 = xor i16 %4, 0
  %6 = tail call i16 @llvm.smax.i16(i16 %5, i16 %0)
  %7 = tail call i16 @llvm.smax.i16(i16 %3, i16 %6)
  %8 = load i16, ptr getelementptr (i8, ptr null, i64 12), align 2
  %9 = xor i16 %8, 0
  %10 = tail call i16 @llvm.smax.i16(i16 %9, i16 %0)
  %11 = tail call i16 @llvm.smax.i16(i16 %7, i16 %10)
  %12 = load i16, ptr getelementptr (i8, ptr null, i64 18), align 2
  %13 = xor i16 %12, 0
  %14 = tail call i16 @llvm.smax.i16(i16 %13, i16 %0)
  %15 = tail call i16 @llvm.smax.i16(i16 %11, i16 %14)
 %16 = tail call i16 @llvm.smax.i16(i16 %15, i16 0)
  ret i32 0
}

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare i16 @llvm.smax.i16(i16, i16) #1

; uselistorder directives
uselistorder ptr null, { 3, 2, 1, 0 }
uselistorder ptr @llvm.smax.i16, { 8, 7, 6, 5, 4, 3, 2, 1, 0 }

attributes #0 = { "target-features"="+64bit,+a,+c,+d,+f,+m,+relax,+v,+zicsr,+zifencei,+zmmul,+zve32f,+zve32x,+zve64d,+zve64f,+zve64x,+zvl128b,+zvl32b,+zvl64b,-b,-e,-experimental-smctr,-experimental-smmpm,-experimental-smnpm,-experimental-ssctr,-experimental-ssnpm,-experimental-sspm,-experimental-supm,-experimental-zalasr,-experimental-zicfilp,-experimental-zicfiss,-experimental-zvbc32e,-experimental-zvkgs,-h,-shcounterenw,-shgatpa,-shtvala,-shvsatpa,-shvstvala,-shvstvecd,-smaia,-smcdeleg,-smcsrind,-smepmp,-smstateen,-ssaia,-ssccfg,-ssccptr,-sscofpmf,-sscounterenw,-sscsrind,-ssqosid,-ssstateen,-ssstrict,-sstc,-sstvala,-sstvecd,-ssu64xl,-svade,-svadu,-svbare,-svinval,-svnapot,-svpbmt,-xcvalu,-xcvbi,-xcvbitmanip,-xcvelw,-xcvmac,-xcvmem,-xcvsimd,-xsfcease,-xsfvcp,-xsfvfnrclipxfqf,-xsfvfwmaccqqq,-xsfvqmaccdod,-xsfvqmaccqoq,-xsifivecdiscarddlone,-xsifivecflushdlone,-xtheadba,-xtheadbb,-xtheadbs,-xtheadcmo,-xtheadcondmov,-xtheadfmemidx,-xtheadmac,-xtheadmemidx,-xtheadmempair,-xtheadsync,-xtheadvdot,-xventanacondops,-xwchc,-za128rs,-za64rs,-zaamo,-zabha,-zacas,-zalrsc,-zama16b,-zawrs,-zba,-zbb,-zbc,-zbkb,-zbkc,-zbkx,-zbs,-zca,-zcb,-zcd,-zce,-zcf,-zcmop,-zcmp,-zcmt,-zdinx,-zfa,-zfbfmin,-zfh,-zfhmin,-zfinx,-zhinx,-zhinxmin,-zic64b,-zicbom,-zicbop,-zicboz,-ziccamoa,-ziccif,-zicclsm,-ziccrse,-zicntr,-zicond,-zihintntl,-zihintpause,-zihpm,-zimop,-zk,-zkn,-zknd,-zkne,-zknh,-zkr,-zks,-zksed,-zksh,-zkt,-ztso,-zvbb,-zvbc,-zvfbfmin,-zvfbfwma,-zvfh,-zvfhmin,-zvkb,-zvkg,-zvkn,-zvknc,-zvkned,-zvkng,-zvknha,-zvknhb,-zvks,-zvksc,-zvksed,-zvksg,-zvksh,-zvkt,-zvl1024b,-zvl16384b,-zvl2048b,-zvl256b,-zvl32768b,-zvl4096b,-zvl512b,-zvl65536b,-zvl8192b" }
attributes #1 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }
```

Command/backtrace:
```
> /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt -passes=slp-vectorizer reduced.ll
WARNING: You're attempting to print out a bitcode file.
This is inadvisable as it may cause display problems. If
you REALLY want to taste LLVM bitcode first-hand, you
can force output with the `-f' option.

PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt -passes=slp-vectorizer reduced.ll
1.      Running pass "function(slp-vectorizer)" on module "reduced.ll"
2.      Running pass "slp-vectorizer" on function "main"
 #0 0x0000602da32b35e0 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x30fe5e0)
 #1 0x0000602da32b09ef llvm::sys::RunSignalHandlers() (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x30fb9ef)
 #2 0x0000602da32b0b45 SignalHandler(int) Signals.cpp:0:0
 #3 0x00007ea045842520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x0000602da29cea64 llvm::getUnderlyingObject(llvm::Value const*, unsigned int) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2819a64)
 #5 0x0000602da22d706d (anonymous namespace)::HorizontalReduction::matchAssociativeReduction(llvm::slpvectorizer::BoUpSLP&, llvm::Instruction*, llvm::ScalarEvolution&, llvm::DataLayout const&, llvm::TargetLibraryInfo const&)::'lambda0'(unsigned long, llvm::LoadInst*)::operator()(unsigned long, llvm::LoadInst*) const SLPVectorizer.cpp:0:0
 #6 0x0000602da22d797e generateKeySubkey(llvm::Value*, llvm::TargetLibraryInfo const*, llvm::function_ref<llvm::hash_code (unsigned long, llvm::LoadInst*)>, bool) (.constprop.0) SLPVectorizer.cpp:0:0
 #7 0x0000602da230d085 (anonymous namespace)::HorizontalReduction::matchAssociativeReduction(llvm::slpvectorizer::BoUpSLP&, llvm::Instruction*, llvm::ScalarEvolution&, llvm::DataLayout const&, llvm::TargetLibraryInfo const&) SLPVectorizer.cpp:0:0
 #8 0x0000602da231f7cc llvm::SLPVectorizerPass::vectorizeHorReduction(llvm::PHINode*, llvm::Instruction*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*, llvm::SmallVectorImpl<llvm::WeakTrackingVH>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x216a7cc)
 #9 0x0000602da2323ec2 llvm::SLPVectorizerPass::vectorizeRootInstruction(llvm::PHINode*, llvm::Instruction*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::TargetTransformInfo*) (.constprop.0) SLPVectorizer.cpp:0:0
#10 0x0000602da2327dfb llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2172dfb)
#11 0x0000602da232e400 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#12 0x0000602da232ef62 llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2179f62)
#13 0x0000602da1071366 llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0xebc366)
#14 0x0000602da30bc88f llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2f0788f)
#15 0x0000602da1073bb6 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0xebebb6)
#16 0x0000602da30bac1b llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2f05c1b)
#17 0x0000602da106fcc6 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0xebacc6)
#18 0x0000602da30bb77d llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x2f0677d)
#19 0x0000602da088061b llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x6cb61b)
#20 0x0000602da0872331 optMain (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x6bd331)
#21 0x00007ea045829d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#22 0x00007ea045829e40 call_init ./csu/../csu/libc-start.c:128:20
#23 0x00007ea045829e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#24 0x0000602da0868855 _start (/scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt+0x6b3855)
zsh: segmentation fault (core dumped) /scratch/tc-testing/tc-compiler-fuzz-trunk/build-gcv/build-llvm-linux/bin/opt
```

Godbolt: https://godbolt.org/z/nbar8q6ej

Found via fuzzer (C program before reduction).
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzsWlFz4yjy_zTKC2WXhCxZfsiDk0xupi6zm0rm5uqeUgi1bC4INICU2J_-X4AkS44zM5nbTd3V_qcypoHupvvXDQIkojXbCIDzILkIkqsz0pitVOc1MYrRx5lirdRnuSx2519AG0o0BPE6CK-CcB2kof_jvK0QU77VELUBgwpiCCc72RgUxFcowBhmVRCvYVYH8TpduJ8ZG4gIZ0G8jnA2EzH2bfe2DeOJWqNYzaFXqZimbbqYNeJRyCcx40w0z7ONaAYx_1tAyQQgFmMULMKKMBFY1SsU4DhEwfLCs5VSza2r81rBFkgBavAVoQAnoRuXS1IgFqUBvkS1UUg0nFuacLYRCI_4I8f_LJVldwosXzjiwI7DEMYRJZx7voUDdK4r8jx342SdeGTFD6pWI0XxzysKR1rwVMvipIMbMMChAmFsjYlcNqLQyKrLjkFg6QKlVulJQJJjQBbHgKRvAiR5HZDlmxTFI0XpVFH2E5i8CkWEX8VidYxFdoxFFL7Jh9XrYETRmzQtR5qiY1X4P8IjexWPKD4GxIJ3hMjibfMl_g4kydtUjedetDjostW3JW00ZO3YJAXGrU-du8HyaryABfEFum4ENUwKtDZG6SBeIyHtcDmhj0jIUgEgIfVOUCRkI56YKJCugTacGJJzQE-McwWmUQJVUEm1C3AmpIDBigIoJwq-Y39nebd0RscmNho400aqAhQqmAJqWAvaM0w6x4kRLC-Qi5SLtwPaLspXr4i9tMyrcAnnUtc1OZTd-vK6bv9LjFEsbwzo7nlgHy7LC_uA8U-dWQnENAq0fazEV_YXX6SLnJkAXwb4gviC-qLwRemLyhcKOHn2ZOuLPaNa9WQJggLralXV8I5sIcbliH4e6HRRjOhyRA88PMJZPlRifKDThaVn7gfcz3MNitnpS_hMV9SoE61VXZ1oFada9UkN-jTvqcbmROOecKJfqt0zWjJen27X-mV7m9MYv3R73z5uHPfW_ugtlY0woEA8-fqGmJp40rSEd2SrD82tnnSYFmjhKhVhvrWiBXDYdLRWTHQMUFe1p7QhBkC4iu7lNKXlpqdqj63WVJZ1Vfb0xFo9Uq6_Sc06cqJd2z2e8bShXTl4MLJfN-nimTuyJQX0ROOJnKiuiYmWdGyC1NKrbuu8ctQzbQlvOipnA2EqIljdVYE_dVRFaE9B1VGaVc6iZ11SsHtRT7e07qlSKMpZ_Vx-K4emp4pQ-u3bt77hm60XspjUv8mun5XMOs40JaoouFsgD-0lb_T20GrsPjEnIzof0fpA00qOKlIUlWwPDWUFFSueDw29875y3AlVTZg6NNhF_1BrC4_8c2sTWxA7mqy9LU906zj3JMKZ0p5MFz1FvJV7km-JJyjpurjSnWRFojT35FMn6BHYe-f3uWfMH7vqY19_9qWXoV6GeiafaXsKvih9Ucm6I_rSebYvmPC6Sq-kzMuKCU9uu2Jo6Hm3Y6LvZbRbDPeM5rIaqHqg9h1FSSVJT7Oyp7juhajyCblnVPgpumcWe09tmTDC8EOlJk3Pv607Hb2_j_5XdEXRldCV3sVHP8aj7gro2HTX7aEy2oe07YLTdtFpR5hZ-qkiHb3ty6G7C2T7uOnKvl3QnugGbx_FwNOlkKV6ed2XvZwe5HQv15nfdva3PApxF6KWR2mcDRUcLrKBTtKejPEyHdoX4WroSCLck2mSxEN7Fq1sBz5sDKZbgmjYEvxxO67RJqQ_Ro_3JJeyqoiN-7UdzChCT5y7-43XBxTga00VMXQb4GtDZwa0YTYStkJlVTMOalY2-_3MqEY8Wr0N48VsQ9uBtrsqf4S2TTb217I2aFYTrUEH8ZXm9awFaqRie1BIQdFQKOace0P-ub777dNvf7M703_JJsBLBYgYA1VtbUFGoloxYZBsDCIoZ4bKAlDJOMy9gi9bppH9E6RomXYQEo2YQRXZIWrnCyqYrjnZoVrJnEOl5-hT6aV3skF3H9Y3N_9CT0QYO54h2gC6ufn6eTSc0ma2ddheop1svDAlApVSUbDW1Y1BT8xskdkCCtJwVgZ4iWRtd9_zcZRubz6s7z8g3eQVcz41G6SglsqNvjWmtvv0AF8H-HrDzLbJ59SuMdcW6q6Y1Ur-G-xj-Jpp3dhN5jUiokBMUN4U4IygiugtGlKhM-Le2EQsmqoeciOcI_fvVsmNIhUiatPY_Y07L_xXZEnUWXjXCGHTwsrZrXbZHW8CnE01uBMjRlKgShYNB3fxc1Da3_TgV_QeK3Oa-sEsg78OwsN5Lg5R-ByGYZiGuCAxzuMEQuQiFq-DeK132hO3NptdDL64-YmzA5MiTw9SGwWkCrA_Ngnjj03ZnxiGAF-Ez3FYQgLh-IwaR0c-hSsoT_l014h7thGEfySi4GAf79n7mZ2voJyYjY_NzhcJmhhoz6UeWd-s57S20yF0_wdFcadoCSRcJNkCJzjsnOIsD_D1c5Y-pIvxDaLtoHMt56kzz4lMjFuMjcMrCiRdjDDdgPmHKEDxHROb33M_x0cp8pXwBhCVQpsAr22KNMLdxRbvmCs4i1YkndxnxMnEL1wsw7SwthAhxa6SjUaCVKBrl_Mr78xHO72kPUfd2anpJrLrqKzta60lZcSwFg7dYyw0r0dz1DVdyH_U9ze33ew5sH4S2qhexXrad08JJ-pDK3nj-49kr4ghN_5SusP9iOGLO-_fsFwRtfskSjni6zwN8JKTKi9IGOBlgLMhaFy6rc9I240kxac-vJ24rEERI5WfV2-R96ag-5vbrwNUp5M9PQ7gagloA8KODH-H3X2TP8LuZTK-wPNVOI74-uX0QUEZxJeHji3R2wf33H0bUh9sdy4l76bB3I1bK1nPQzfXfwzCcgJCHBZhlvx_Fv8cdtkUu6hcUjo2cKzhluju2TH4_lGq0wDdfvz0myxe5tn30LggmtELLunji6434O0h-aKI0KVUlQXlJe4V4dw79qmq-SSR_wnEPeUfmdh8_egSNH2vJTpKyZLSyRK9mgYIx0DxGwJ0J6WZYP5fHaNfWQHslic8AmlZlPkbQLrcEib0J9H5lf0R7r5TwixxUeZDwlgsoiMsYBGGP8ZCNcLNhLHz18M-Pf3BsnXyYfL9Kfhi5XrBsV7fgW640S96bqSsT4pcyYoJ-8z9ouBlXq-1bip3tLskdPuy_wrsQRyKC3ZizN9rwyq2J1b8DiqiHj9UzBi7LR0StybK_HTO4uM4lelPTGzViJ-L0VoQvtNMfyaCbGyCXp4Qet_FbbkqUzzJ1XiMQRQuozhNRz4UYAjj3WJFtP4sC-CnPZnm5wvsfgka-_e_jTnkNE7TCeSTo0wc5jTLxsdDB_P3zP-LIonLcJll5QTK5Ch74zz_I7L3TwvBXzR0kEOeTydBejQJCI3G-4XP7vbpi-zNtRFZF6S2h7mTYHiBN0HRibxzDic0mu4WltMcTktK35bDveuXP4nfLwD0Wgr-b6AOOaF0mn7ZUfrly2XxEwvAKaj_CgjiMkyXy2IC4eRYFGZZmE5msGpc0t2yGjgT0wvbe6OY2NxBeSppXzmqfCZ06_T8aBfrN9HHXFLy393LhmvGTyj5j7pfcWetFNndHV3SOEx4s2Hi5fPgwK9NMb3sCeLLVjJ3MzjVdWFDZ7fAaXeXc6xV1ubBSNmtIN6Lv_uvFV7l-gqKlQxUz-cvh95avktmpjRPpwsqDqeJucRxHCFZm8-EiXcxKS_iOJqYFE1vxPGqWIXo4YGznD5oQ5R5oITzh8paOA_wNdVNgK_nltQ7XUCtA3wtasO7m_Jjofk2iNeJ-6g3PYyKj0eFReg-mntggpnjgTxptc-c9jn13wgH8RofDk04PqV04sopL04qj5cra_ZB92IauTTLkgR5re8TuDhLkiFwe21RRRo27qMl9wqrJA13tlCpwL0NhMJn-p9n2usvrv8mi1xyY608ev_pO-ZSWRP2NnlyorJvKfx7LH8tG1GglhFkLQP3LeklqrvXmTmU1kl1uF1czc-K87hYxStyBufREmdJlkRRdrY9j_JFHIdxHEZJvqJJHq5SiNNkVUYEhykpz9g5DvEiCqMwyuIoyeZpkSZxhFdxTvByFa-CRQgVYXxuYbCWn7lXtOdRFGXZ8oyTHLh2X85jLOAJud4A4yC5OlPnDru82ehgEXKmjT6oMcxw98n9_c3t7HAqDZIrdA8bH1G7MqThL1xJp-FZo_j5r79-7txrz_H_BQAA___o1PPd">