<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/127173>127173</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [clang] Crash at -O2: Assertion `!Src0Elts.isZero() && !Src1Elts.isZero() && "2-source shuffle not found"' failed.
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          cardigan1008
      </td>
    </tr>
</table>

<pre>
    This code crashes at `-O2`:

```c
int a, b;
int c(int *d, int *e) {
  int f = b = 0;
  for (; b <= 14; b++)
    if (b < a && e[b])
      d[f++] = b;
 return f;
}
int g(int d) {
  int h[1];
  int i = c(h, &d);
  return i;
}
```

Compiler Explorer: https://godbolt.org/z/4PdzTE8Es

Bisected to https://github.com/llvm/llvm-project/commit/2ad816648f2719e6c0da507a1a371f2cad4a3f1c, which was committed by @alexey-bataev 

Crash

```console
clang: /root/llvm-project/llvm/lib/IR/Instructions.cpp:2111: static bool llvm::ShuffleVectorInst::isInsertSubvectorMask(llvm::ArrayRef<int>, int, int&, int&): Assertion `!Src0Elts.isZero() && !Src1Elts.isZero() && "2-source shuffle not found"' failed.
```

Backtrace:

```console
Stack dump:
0.      Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang -gdwarf-4 -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics -O2 -Wall -Wextra <source>
1.      <eof> parser at end of file
2.      Optimizer
3.      Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O2>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "<source>"
4.      Running pass "vector-combine" on function "g"
 #0 0x0000000003e84588 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3e84588)
 #1 0x0000000003e82244 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3e82244)
 #2 0x0000000003dce648 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007802bce42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007802bce969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007802bce42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007802bce287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007802bce2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x00007802bce39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x00000000037950cf llvm::ShuffleVectorInst::isInsertSubvectorMask(llvm::ArrayRef<int>, int, int&, int&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x37950cf)
#10 0x0000000002839172 llvm::X86TTIImpl::getShuffleCost(llvm::TargetTransformInfo::ShuffleKind, llvm::VectorType*, llvm::ArrayRef<int>, llvm::TargetTransformInfo::TargetCostKind, int, llvm::VectorType*, llvm::ArrayRef<llvm::Value const*>, llvm::Instruction const*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x2839172)
#11 0x0000000002f0fcad llvm::TargetTransformInfo::getShuffleCost(llvm::TargetTransformInfo::ShuffleKind, llvm::VectorType*, llvm::ArrayRef<int>, llvm::TargetTransformInfo::TargetCostKind, int, llvm::VectorType*, llvm::ArrayRef<llvm::Value const*>, llvm::Instruction const*) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x2f0fcad)
#12 0x0000000005b0d517 (anonymous namespace)::VectorCombine::foldPermuteOfBinops(llvm::Instruction&) VectorCombine.cpp:0:0
#13 0x0000000005b1e10b (anonymous namespace)::VectorCombine::run()::'lambda'(llvm::Instruction&)::operator()(llvm::Instruction&) const (.isra.0) VectorCombine.cpp:0:0
#14 0x0000000005b1efc5 llvm::VectorCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x5b1efc5)
#15 0x000000000553084e llvm::detail::PassModel<llvm::Function, llvm::VectorCombinePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x553084e)
#16 0x0000000003828f90 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3828f90)
#17 0x00000000011a1e9e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x11a1e9e)
#18 0x00000000038278ab llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x38278ab)
#19 0x00000000011a122e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x11a122e)
#20 0x00000000038272b0 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x38272b0)
#21 0x0000000004141a84 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#22 0x000000000414553e clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x414553e)
#23 0x000000000481c240 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x481c240)
#24 0x000000000645efcc clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x645efcc)
#25 0x000000000481c648 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x481c648)
#26 0x0000000004ae3345 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4ae3345)
#27 0x0000000004a66c4e clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4a66c4e)
#28 0x0000000004bd1b3e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4bd1b3e)
#29 0x0000000000d4e78f cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xd4e78f)
#30 0x0000000000d4620a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#31 0x0000000004862c29 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#32 0x0000000003dceaf4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3dceaf4)
#33 0x000000000486321f clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#34 0x000000000482639d clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x482639d)
#35 0x000000000482741e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x482741e)
#36 0x000000000482f3d5 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x482f3d5)
#37 0x0000000000d4b583 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xd4b583)
#38 0x0000000000c143a4 main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xc143a4)
#39 0x00007802bce29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#40 0x00007802bce29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#41 0x0000000000d45cb5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xd45cb5)
```
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJzsW19z7Khy_zT4hZJLQn9GevDDeHycezbZsuvYNzeVlymE0AwxAgWQ7dlPnwKk0R-Pvfbu7L3J5m55j2cEdP_6103TgIy1ZjtB6RVIr0F6c4E7s5fqimBVsR0WURjmF6WsDlePe6YhkRWFRGG9pxpiA0EWBncIZCGI1yB0P1nofwgI10wYiAHawBLE1_13AlBufwO0rmxT_5kCVECwsr2ge1ZDEN_A0v0b-uEQ1lJBgHIQX7uWjW2MEvcVoGv3U7iOELLa9nS9IIYAZQBlkIL0ugTpzdgNwgqk13U_Or3xWnt9ippOCVj7r2B109uw622olqD3IL2OrPx4fMacSGv23toLUGaHDT16FWyq4sihp3Qjm5ZxquC315ZLRRWI13BvTKst6-gWoNudrErJzaVUO4BufwHoNrmvfnn8ln_TXsY105QYWkEjl0OZ2XflJZENQLecPw-_glbJ_6LEAHRLZNMw-wHhKo-yLMlrtIoKmpGwwmm4whGOV1GNCK4SHNcRsXa-7BnZwxdsg8YOt8rLAwRJiDl9pYegxAbTZ9jbaGNqGUFSaMkpCNeEY7GzVgN0q6Q0byEOwFkJ0O33H_YfoY3qiGFS6EvStiBeoyiKrBRtsGEEllJy6AbGaxCvH_ZdXXP675QYqexo_5jp70JTZR668tk1_Yz1E0D5OHCtFD78oDWIN0wYEH_rw_r4K5t-KiyCtbYimRR2BgEUPSgSfuNGXzL9n1RJG-I2snzQ-vbog3aEAi07RSjU3ggopIG17EQFEAJoBWvMOK0u3wbXNSZPRmFCT8zgI_8PBpMnWHVN63uFlyAs7pXcKdxArHZdQ4XRvYNk28eMC9qADkGLbp0bAzzYrgOjOvEE0G3JxNAMg131glUdJDDYwUBaibhtrdzOtJ251DBoLPcwCF7zLMC6CfRBGPwK4hsmDOUwqIUMnqkqpaa2HQYPMAh2hARGSk72mAkQ33yI1HbWArd6Lw0MaiK5VEHF8E5IbRjRXodLhPPHdwgGf8Ocw-Bv9NUobNOPd42Ni3AdWeZAvKGyBvE32GKlqbKZlIoKyhrWzBGObLe71rCG_UIVCNexffCjE4KJHWyx1tbrdSdcfFt5eEdVwMSzC7-85hIb5GOQyxeqAutMg4UJmDCKCc2Idm2ytbEsZRsoabChIN7sKa6oCqqu5Yxgr-BayKBVtMWKBrVUATfSB7obWlFOXT9UHB8xbRQrO0MB2jBhp2lgOAsa3LZM7AblgZ9T7BerWEiLjipO8bNTQ2gVSMEPXv-x66LJA2GipirAnO2EjcZBPpe4CihnjeuiDZFNyYTV1uDXgBmqnIUaxDfRoEax-hDU7LWVx_msWdNyVh9IvQPxppSi04EVF5i9onovedULqKV6waoK9AszZG9pr0B83X9TWOxoYGTAiJ1Kw2MjAy7lU9d6AE-UWtzSJunrvWTaBDaFSuE0at_JP7fW6UAbqagOXpjxCoMad9wwmzKvNRNPy-G6paTj2NCg5JI8uUe9fX58qbAge69o7NyJVtGKEYNLTnXPC5-4UAG08V-CgebfRbpzYCeU5BzEmzvknxqFha6laoIXrOx8sDCUxCDetIpqqp5p4Nx0Oip-L55Ga2ynDCMNiDeYc_kyUORmyjc_CY4qg1rJxia9rmm9kl6Q9UyPZ2AfoE3FngNFm6DFTNmuBjNOMOd9CH86DoUMvhSK1tNvo3EWiseoW4TTZ0PRqvhd0fhhKBYAISgFbGTVcWrT4yz1IgTCdXIqiy4j1kkZUqvtsPODIUBxCMPXcPgvpnmS5vmkhNAH7T_cKyaMWzUf3do6LRcUftlKbRTFzbQ0KFxh-3uXT4Cuw9ceWF_kAhRHC9gIJckp2BtOsejaO_HAdgJzgPJOuO1BBbm0ws8L0sIYQaIZyIrQLMmhqwt_UCKfqTp4VH_BouJWV97zNuuzkcLQV9NXfKH738uPe_mrPEQloQlKUdib48vG1zzbZknAmeheg53ofAO51PIyc5DdkBFwMhdYZEVNYGsnIq62T4zzr0l340fp6RJussrgTjsKvgo7WWWj4GwuGOWrOoa4lMp8TawbOIpdvREblV8WGJWjwHwuMC5okX1NoBsyCixmAbYq0pDU_4D6_4xTyNvgLbTTfJaeUB4X0QpNLPyPPHt8_P69abn_vqOmN3ojtZnZ9IjVjprHYan9Lmo5Y-lfmXC793GE5-3x0FKA1vOmkwR9QpdvsNgGdT2rX9U66Y95R6Erhu2AJZTJpnHsdE6X9U4ZXTZLzagOa4Krz3DzT9991nfu8xk96H00enC2bqVlWKXRyqrDQopDIzsNBW6obl0dUExN3wxlqH1US17dU9V0ht7V10zYmmvq1Yl5fR6ZCVkseBZYPAcW0SgsfwMw1Ql_3uC_ArTiuCkrDNDqY4D-sWxtdS1VL-Njk46-umRa4cvwM2YmSzNrkr6Jsn74PdZ6atXY7XbYS_tsPQlFgflBM_0zFnaPPYvI4yAbi-fN7b0hY5ilMzPTOMwTOoFZUbtT6KtPrPXPsqL8NNgTk3BKz2-y3v78n6DVEzfSms2KghzldRFOYDoqP4L4p2ar52NkazVlK4pwRItzBOEfxvKf2js9_6N38kUsr3JcTmD-7HbGj3KAZFlfV7i1yfmkwX7Al8zth_whoWjNGY0tlqGI0NdCcbBu80mKfgMH70XS_yZie-qOxKJwGUWo_ExGPEXnn4elnoeRpVndnkRJhPPk14qrbw0za61pU_LDXyhvaT_vfnSiP-t3Z4j3rKXcHUXlw8UXiN1FDRXV-pgQtal8SyfYf3d025o5Fwq_bNsXxQzdDqdNk0EVdSdzW3d0T39lYJ9Ms8-ofZSS37mrmlvm4-EzOhejpgrfcrCRQneNdaAr8PunfzWMvy0PEVo4Kk1jOpVJG2Z6CR7AnPbh8vW7uz4h9C2ojazov1DnQXe6uwjXB6OY2Nm9zIlM0298PnLztFw2qtPsmf6g9UaY-wXxz3Vf2loGHw7a0KZfAv_-kfIJr51tavY-HafmbN-T5BFBSfgRHvfQnyq6jaw_yf-rYItQWD889qeL584uPcjRhNmeJktSWhMyNeEeK03XD49zgA-0wX38lVLy8fcZofZgRqjpku0syU9Mjz6gfR58paQzdIjx_OxcZkk-ApxV-AmmcZykU4C3yjr1OOWmCM-OzWsfsa3m2LKMJBR-lH1O8ve-MeeOU49wxD-rOJOyisp5cu2RjmY8y_5G-VeS7JlThEc24p4Vj2GV0FVeQ0KibYOZeO9wl-yxWh4_zZ-hDXyWrDo3fI_viH5-CxVWSYZCDAeqN9Gjm_MTGx4azHl_ru0Of0-Ysli1rIw-2Q39XChVij1T9XaZnV8xJXmGCCocGROhw6XaVjk-XetwtNTXgARzXmLytK2FhTmGiFfch8sm2simwaJaztaTfjuuZNIt0Xi-DRjX5-PadRyw3ZLXV_fOEIjXJdaM2HXO3WY6Cmed7YOtUZgZPTQvxGHObfjb7dax3XZZj5l6PLE8edrWU4Xy4TruJ1mecMabqzRcT-_7Tl2YHSvRB1xTfphx-bHfzlpme6xjqC_W8ixGUQ3_P4eFOxxtsTL-cPS0_5M5ayiLi-pd1py_8Ju1b6BylqgXA22HSXrYfKBj2nU9K1LOfkLfGzwG0aJEQaskol-l4ydZ6ve5-EmW_8a0mXHxUf49-r7FTPVXK1-gb7o9-uNItDSNJGYLEuu4St8DfDP5PCsBTqz975H_dyTxrNWnI2akbbVYq8s0jz3EodYYYLvEsX5zFfbeSnzG6sJiGhHParqQREmME2ixnk-lFzqqLBbvDhRV8cVXM9yQo8AkXAqkSQi3Wztmqw1WZjsx6NMq6GSLlkQLx6akTKEXfk7fWLG90uG93IvqKq6KuMAX9CpaxUUapfmquNhf1eWqrGlF6gInIcZ5mmcFLco6q6K0QmVywa5QiNIQRUmYpVFUXMYhpqswTsOChvEqq0ES0gYzfmnj71Kq3QXTuqNXEVpFq_iC45Jy7f5UAKEeJQLpzYW6cu9jl91OgyTkTBs9ijDMcPf3BX5EeuPf2IHYwOAO_SNfh77oFL_68uvwjhIN0G3PyvMV-p8AAAD__0HyYPQ">