<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/116691>116691</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Crash in SLPVectorizer.cpp
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          psteinfeld
      </td>
    </tr>
</table>

<pre>
    I'm seeing a problem that shows up in the flang compiler when compiling a large, proprietary benchmark. Since the benchmark is proprietary, I can't include the source code in this bug report.

The problem happens in in the file `.../llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp` in the function `BoUpSLP::tryToVectorizeGatheredLoads`.

In the code around line 6906, is the statement:

```
ArrayRef<LoadInst *> Slice = ArrayRef(Loads).slice(Cnt, NumElts);
```

The code for `slice()` is in `llvm-project/llvm/include/llvm/ADT/ArrayRef.h`. It contains the line:

```
assert(N+M <= size() && "Invalid specifier");
```

This assertion fails, and the compiler crashes.

I added debug code to `SLPVectorizer.cpp` to trace how the variables `Cnt` and `NumElts` got their values leading up to the point of failure. I've included the output of running the compiler on the test case in the file `log` along with the source code of the modified version of `SLPVectorizer.cpp` in the attached zip file.

At the point of failure, the value of `N` (which corresponds to `Cnt`) is 8. The value of `M` (passed from `NumElts`) is also 8. The call to `size()` returns 14. Since 8 + 8 is not less than or equal to 14, the assert fails and the compiler crashes.

I captured the LLVM IR of the original test case and included it below in the file `x13.f90.ll` in the attached zip file.

If you run this command after downloading `x13.f90.ll`, you'll see the error:

```
#!/bin/bash
../bin/clang -c -O3 -march=native -mllvm -locally-hot-callsite-threshold=4500 x13.f90.ll
```

I also ran the `x13.f90.ll` file through `llvm-reduce` using the following command:

```
llvm-reduce --test pcrash.sh x13.f90.ll
```

This produced a file called `reduced.ll` that I've included in the attached zip file. I've also included the log file `reduced.log` that shows what happend when you run the command:

```
#!/bin/bash
../bin/clang -c -O3 -march=native -mllvm -locally-hot-callsite-threshold=4500 reduced.ll
```

@alexey-bataev, please let me know if someone else should look at this or if I can help out by adding additional debug information.

[Archive.zip](https://github.com/user-attachments/files/17805978/Archive.zip)

</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJy8Vktv2z4S_zT0ZWBBpvw8-ODEzcJA2i2abO80ObK4pUgtSdl1P_1iSNl5NAly-gOGLJGc1-83MxwRgj5YxDWb3bDZdiT62Di_7kJEbWs0arR36rzeMb5oISBqewABnXd7gy3ERkQIjTsF6DvQFmKDUBthDyBd22mDHk4N2uErCxvhD8j4LWnpvMYo_Bn2aGXTCv-rgAdtJSZN10XQ4flpEt6BFJbxRQRtpelVlgiu9xJBOoXZHR1g3x_AY-d8LFi5ZeUmPx8bvMbRiK5DG0jkEoQ2CGxeFkXB-J0xx3bcefdflHH4pD-9Z_zu0QsbaufbwPjdT5TRef0HGb97uP9-_fSF7Do2L6_qeyujdpZM3Lj_dA_331m1YdUm-vOju4r9S8QGPap7J1Qgb54HsMuqUqzCu94qMNoizFflnBDSIUMSRcQWbSQDz8TZvBx-6XPjvTj_wJpVt2RtZ0MExjes-gIPRksEVm3heogvs0t8VQTaZXx5ayNZ_da3X0ykHVbdvGnpCf7keu08oXBRQ4KEUyKDzcu3oR84f1rYbB_pOfhXNAQW7CJIZ6PQNkNB8HyMgggBfWR8-Y3xm6_AqlsKOyRCyTVgfM74HBjnO3sURisIHUpda_SM809ErQNkI8R-LbQJhJqwaiBzqBrpRWgwvCQchFKoQCGldAIvOsLozUyLDqIXEqFxp6T7KLwWe4OBRIiteZnssnl5IW1ewsFFOq09HIXpMYBBoahw-y6ppKpx2kZwdXK_91gAtYcjXioxh-L62PXpmO-tJQ0vAnQ5eyOGCFIEfF14xh2Sg8bZA5x0bP6qb1enpdYpgl_BEX0gUF39LiaDDRGjkA0q-KO7ZPAFzJv4ZpREU4bR9DgY-UZKGV-eGi0bkM57DJ2zKgzEZJQpb3SAZQGPr-S_DvIdpYSC2rv2JR2DqDDBXeSlMGZQ_5SXpMdj7L0NMJleeugSGL-BJWmwLoLBQHUgLDgP-L9eJD2T6SWynJc5KT-bkVJ0sfcD5ff3P7_C7seFGef1QVuyciWZtF6zREfYo3Gn19T_nlRFvSoLYz7N2a6Gs-sp03LPl65tyZaoI3pQ7mSNy2n8Wj8Ff3Y94wtj6IJLxtB75z_uFIxXjE8Yv9trS08RmryRLoy8KNNNOJYw_ncF41Z42bBqa0XUR4RxS60LxsYRo-dx4-KY3oKOOI6Nx9A4o1i1nc7KEp75_H532eVE8SJD9heUCeDYeNcfmmtv9ah6ibTdh0uV1s4Yd9L5GicgP8bimR4YjxPbXUqXIjSf8zz1xc47UqFAZE8JDUz9KetWQxhp6njdct5Nk8vJBM2LDmXc4ZpzVwu57TwbbE70mgcElYeZp0zDz-HzD-fKM7TeR5xNS2HwN57HexEFHtNAZpCK1GCEFuGXpdKsIbgWnUVAE5Aw6Y0C49wvEDEXm_N0LA1k0KDpqPXD_ky3VZr4lNJ02wkz3Fza0rgkaO1FEbPZzcbLRh-x-KM7Ntsyvmxi7AKhy-8Yvzvo2PT7Qjq68vuAfpz5pvGGxi9ik_4ni2U5Wy2WaSR40shX2dBIrSu1qlZihOvJopqs5pzz6ahZzyaqWqp9ySWfLaZiqapluUc1rzhfzKSYjfSal3w6mUyWvKwW5bTgKykFr8RsotRsVUs2LbEV2hREWOH8YaRD6HE9mcznq8nIiD2akIZtzi2eIO3S5DDbjvw6FdK-PwQ2LY0OMTypiToaXN9SVVGu_3W9jXpv1h-gdZlZX45TyXxCLPt3XPP_BwAA___SutMq">