<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/138178>138178</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            SLP vectorizer crashes when built with hardening
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            llvm:SLPVectorizer
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
            alexey-bataev
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          alexfh
      </td>
    </tr>
</table>

<pre>
    Similarly to https://github.com/llvm/llvm-project/issues/137164, clang built with hardened libc++ (`-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG`) crashes on the input below due to an incorrect comparator.
```
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct.widget = type { %struct.baz }
%struct.baz = type { [3 x float] }

define i1 @snork({ <2 x float>, float } %arg, <2 x float> %arg1, i1 %arg2, ptr %arg3) personality ptr null {
bb:
  %alloca = alloca %struct.widget, align 4
  %alloca4 = alloca { <2 x float>, float }, align 8
  %extractvalue = extractvalue { <2 x float>, float } %arg, 0
  store <2 x float> %arg1, ptr %alloca, align 4
  store <2 x float> %arg1, ptr %alloca4, align 8
  %extractelement = extractelement <2 x float> %extractvalue, i64 0
  br i1 %arg2, label %bb8, label %bb5

bb5: ; preds = %bb
  %load = load volatile { <2 x float>, float }, ptr %alloca4, align 8
  %load6 = load volatile { <2 x float>, float }, ptr %alloca, align 8
  %load7 = load float, ptr %arg3, align 4
  br label %bb8

bb8: ; preds = %bb5, %bb
  %phi = phi float [ %load7, %bb5 ], [ %extractelement, %bb ]
  %fpext = fpext float %phi to double
  %call = call ptr @spam(ptr %alloca)
  %load9 = load float, ptr %call, align 4
  %fpext10 = fpext float %load9 to double
  %call11 = call i32 (ptr, ptr, ...) @fprintf(ptr null, ptr null, double %fpext, double %fpext10, double 0.000000e+00)
  %load12 = load float, ptr %alloca4, align 8
  %fpext13 = fpext float %load12 to double
  %call14 = call i32 (ptr, ptr, ...) @fprintf(ptr null, ptr null, double 0.000000e+00, double %fpext13, double 0.000000e+00)
  ret i1 false
}

declare i32 @fprintf(ptr, ptr, ...)

define ptr @spam(ptr %arg) {
bb:
  %call = call ptr @zot(ptr %arg, i64 1)
  ret ptr %call
}

define ptr @zot(ptr %arg, i64 %arg1) {
bb:
 %getelementptr = getelementptr [3 x float], ptr %arg, i64 0, i64 %arg1
  ret ptr %getelementptr
}

; uselistorder directives
uselistorder ptr null, { 1, 2, 3, 4, 5, 6, 0 }
uselistorder ptr @fprintf, { 1, 0 }
```

This reproduces with recent LLVM revisions (e.g. deae5eef7147c5ad3acff612ab0ed00e2186d9a5).

Stack trace:
```
 #4 0x00007f03dda9ddf7 abort
 #5 0x0000563a3b243da6 void std::__u::__check_strict_weak_ordering_sorted<llvm::Value**, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>>(llvm::Value**, llvm::Value**, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>&) SLPVectorizer.cpp:0:0
 #6 0x0000563a3b1d847f bool tryToVectorizeSequence<llvm::Value>(llvm::SmallVectorImpl<llvm::Value*>&, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::ArrayRef<llvm::Value*>, bool)>, bool, llvm::slpvectorizer::BoUpSLP&) SLPVectorizer.cpp:0:0
 #7 0x0000563a3b1cc810 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&)
 #8 0x0000563a3b1ca278 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*)
 #9 0x0000563a3b1c9998 llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&)
#10 0x0000563a3a154432 llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&)
#11 0x0000563a3bfda619 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&)
#12 0x0000563a36a14cb2 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&)
#13 0x0000563a3bfdd67d llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&)
#14 0x0000563a36a109b2 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&)
#15 0x0000563a3bfd98a0 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&)
#16 0x0000563a36a0dc68 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::__u::unique_ptr<llvm::raw_pwrite_stream, std::__u::default_delete<llvm::raw_pwrite_stream>>&, std::__u::unique_ptr<llvm::ToolOutputFile, std::__u::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#17 0x0000563a36a0527c clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::__u::unique_ptr<llvm::raw_pwrite_stream, std::__u::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*)
#18 0x0000563a366e49ca clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&)
#19 0x0000563a375c89e8 clang::ParseAST(clang::Sema&, bool, bool)
#20 0x0000563a3731848a clang::FrontendAction::Execute()
#21 0x0000563a3729242d clang::CompilerInstance::ExecuteAction(clang::FrontendAction&)
#22 0x0000563a366e37eb clang::ExecuteCompilerInvocation(clang::CompilerInstance*)
#23 0x0000563a366d7920 cc1_main(llvm::ArrayRef<char const*>, char const*, void*)
```
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJzMWV9zm7gW_zTkRRMPiP8PeSBOs5uZdDdTp331CDjYuhESKwkn7qe_IwE2YLtN97Zz23FjIen89Dt_dHRkiFJ0wwFunPDWwZgweIP9dU40gZ2DsRPeXZFWb4W8MUPV9ioX5f5mRWvKiGR7pAXaat0ox88cfO_g-w3V2zZfFKJ28D1ju-HrupHiP1BoB99TpVpQDr73_NiLAgcvUcEI36C8pUyjV6q3aEtkCRxKxGheOPjWwbfIwYkTudd368eH2-XT0_rP7NPdh78e_vpj_fHvuw-Of2Fgfffh9vMfTuQ6OEWFJGoLCgmO9BYQ5U2rUQ5MvKKyBaMO4YjyQkgJhUaFqBsiiRZy4biZweg-bqaJ3IBGJdGEkb1oNXL8O-RgDNe142dw3eDYdfzMx_aPefSmj6YVBfbPNT00PJw4fubh5LpK3L7FbVc0iEfB9cpMw_jIQ0vaMBg4vCXROgquW_7CxSu_ZpS3b9cb3nYi5oNDpWVb6MUrLY28EdT7BpATG0MPozn5ipz4biJh-ybTw1sfvaGKCaKd8G4QcLMSKsoBUQ85gau4kC_GhUbCX-KDhP_BRIBtG1GzOpEb0zeb1o94Zshg2idsnhot-0ffOLkBqQQnjOq9HeItY4ap42Z5biLVzZCdz5goiFVmaM7sYsAJoxuOgqlQMJH6jkpHlGRAgTctSaF3hLWd16Yd77eRaxGVFhK-Za_BQpbwXKsfkw4uqwMMauB6rNCx6wR9rLL1aRT06uRy5mBGcmCmI8-T2XPYxZpp-Bly_FvUSChVvxXCPB84MkFK22sbO8GIpuz7tn6X_gYy-hngF7DjI3aHMw_6qUNzObVYb6HkgoVCu9nGtmq21A6b755seHsgc5geIie0OvSjU58fptlZPXLVwFsXIF2rR--W1AKVos0ZDLMLYnauf4dsw2ocuKohtYOTmd3Ssb3Sy_YySGe2tWXjueeYdYBnuXnekR31Mepo9auZr8ViYTKSE7hVIynXVU_cpKSB1NDu4A9kznR57qjTXbj2Hzj41nVnBvDwNyLmYhh3i_iXjODhC1YIfr4V5tqd2sL_ri0kaJNHKsKU4Ts6lwpGJHRcZ5xOWE-OsvMRaDJxeu6AORu-X4WeyXapzxvTHgfrhPmYxiWkQ-Y-IeXgcAPD_rSC_h2a9UxP82mmOabp2VIz3hPIsQIm-7QKGDVnTgkSldQUWnQHynGzycg4KEwetSeRPQ2s52382swV2XOwLztOIMYOHgEN88c1neNmz1uqkIRGirItQHXFqITCHGGPj18-Igk7qqjgykQ5LDYLVAKBEKCKvSAuQlL6pKiqyMMkd6F0XcBeEpUpCR2cLrpFVpoUL8ikSuj8MiaBHOwHyH0z4RxXrl-WJC3LKkYkF1L3E8J-Qhj5xM9x4JckQjtBS6R0aTD9bL1uh0axheJlrbSkhV6_AnlZW_NQvlkrITWUjr-0pbqd_6U7jzP7WaLjQNXyQlPB1xIqx1_mQpgDJjknORY79qbm-DMn4FmZi2K_hAaOzPZYPT59gUILSb-CXBRN4_iZa_93do4mdvbKJIgrZFfUcv8sDrIr-KcFbtx5YsiZvquaMNbJPdQNO2_5nt8v0Pr_DZlJSfaf7OAFvZfWvkfw7mm8iGLN7uC0rutWfG5Wj0_v9Go89WpRJJ47wp-IPxGluu7DmsstoVw98FsmipeJdrdE0aLvzn6MdE8tmVEjOE6-T0223AbTmMt974qTSFoVhBH5YSdY243PmD7bG-WzJFxVQtYPvBIX5jzSXBK5Pzsjyz6BaplWJyOPQjRnRe5ETbm5az9LOA27TKm2bgzjJSm2p-N3UBNeQnlLz6z5d6NpTb8SI_4JaiJfPtRUa5B9HHfGT2fGT9P0fcZ_n-EzTtheUfWRcLIxQbA8IzSkJnvl9j13TIl4YRD4eARZgiaUdW3D6KMogZ0HnsbAiSr_iqn5_HITeBOvVCWJvHQEadX-FtzvqxkeaxYRLyjyn-HcX2aR39eS_ixGyiguR5AfRdkyeBaDuLFQVpJGC3meXCfwQ9R6kRmxYOZiN_1BFw9Mlu9U51_wveShn2aEcOadNCHuO-L1nOq_iUbR1K1uWUSJKXQIF3xfi1YhTmpQjanwTSVjkMyJkykFdc72fwJrhjLgU8vHx9MTbYBRDg5O7K_iQ2VRvAAvs8MGPq3zW07_aWFtLlxjBSR5XTevkmowNwAwF9dz0iVUpGV6XQIDDd9B6NNB9ENEnoVgf7e6afU97dz6Qyxm4mMKp3ZaCq7aejjeUd_7WVM2KweNM-OZM0McF2NMqKnuEToCU9csRd1QBvKBK03MHeCE1FKU8AdYLwuuTgsyba5ipig-s8v7UuZboXAUeeBatoru4BNUS66fZh7YVX3JYiy42isNdZ_Wf4do-r4fe39NauQogiAtyLdkbeefhJcMbFXL7D77zOnMkdnqeSm4tj-9jfb6pCqMwyJJIRkv90Skgmz1PAVbQU16Tw83mOFeY2HxpLKLfS8JkokW99JwOfi5SyFvULTapIYjzqQ8inGKA1yib4XnGGkIouTywiNTYDyzvB9DPl6rRz0uuRMFOV3hdMccvYv96RplnGIXFYW3rgnll-6SxZZIVAiu9PEaOe3DS_v7yHGp4SeXq_LGL1M_JVdw48VB5OHQS-Or7Q0p8rDKi9jzoXLztIyhBIzzIPJxCgHEV_QGuzh0Q9fzkiDy40VUFGmBg8J34yBKw8oJXKgJZQvDeSHk5sq--rzx_MSLkyv7E73q37z2ak0K8_4FrLyxL1DzdqOcwGVUaXVE1FQzuFk9PqHj9fLwlvN1C_z0rSrlm6tWspv_5cWtVWB3g_8bAAD__wjNGVw">