<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/150479>150479</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [SLPVectorizer] Assertion `valid() && "InstructionsState is invalid."' failed.
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            llvm:SLPVectorizer,
            crash-on-valid,
            generated by fuzzer
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          dtcxzyw
      </td>
    </tr>
</table>

<pre>
    Reproducer: https://godbolt.org/z/Pj96ao9TK
```
; bin/opt -passes=slp-vectorizer test.ll -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

@g = global [128 x i8] zeroinitializer, align 16

define i64 @main() {
entry:
  %0 = load i64, ptr @g, align 8
  br label %func_154.exit.func_146.exit_crit_edge.i

func_154.exit.func_146.exit_crit_edge.i: ; preds = %entry
  %1 = load i64, ptr getelementptr inbounds nuw (i8, ptr @g, i64 80), align 16
  %2 = load i64, ptr getelementptr inbounds nuw (i8, ptr @g, i64 88), align 8
  %3 = load i64, ptr getelementptr inbounds nuw (i8, ptr @g, i64 32), align 16
  %4 = load i64, ptr @g, align 16
  %5 = load i64, ptr getelementptr inbounds nuw (i8, ptr @g, i64 8), align 8
  %6 = load i64, ptr @g, align 16
  %7 = load i64, ptr getelementptr inbounds nuw (i8, ptr @g, i64 24), align 8
  %8 = xor i64 %1, %2
  %9 = xor i64 %8, %3
  %10 = xor i64 %9, %4
  %11 = xor i64 %10, %5
 %12 = xor i64 %11, %6
  %13 = xor i64 %12, %7
  %14 = xor i64 %13, %0
 ret i64 %14
}
```
```
opt: /root/llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:1204: llvm::Instruction* {anonymous}::InstructionsState::getMainOp() const: Assertion `valid() && "InstructionsState is invalid."' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=slp-vectorizer <source>
1.      Running pass "function(slp-vectorizer)" on module "<source>"
2.      Running pass "slp-vectorizer" on function "main"
 #0 0x0000000005664458 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5664458)
 #1 0x0000000005661304 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x000075a3c1242520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x000075a3c12969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x000075a3c1242476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x000075a3c12287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x000075a3c122871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x000075a3c1239e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x00000000034a0043 (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x34a0043)
 #9 0x0000000003513355 llvm::slpvectorizer::BoUpSLP::getLastInstructionInBundle(llvm::slpvectorizer::BoUpSLP::TreeEntry const*) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3513355)
#10 0x000000000355424e llvm::slpvectorizer::BoUpSLP::isGatherShuffledSingleRegisterEntry(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::ArrayRef<llvm::Value*>, llvm::MutableArrayRef<int>, llvm::SmallVectorImpl<llvm::slpvectorizer::BoUpSLP::TreeEntry const*>&, unsigned int, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x355424e)
#11 0x0000000003558408 llvm::slpvectorizer::BoUpSLP::isGatherShuffledEntry(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::ArrayRef<llvm::Value*>, llvm::SmallVectorImpl<int>&, llvm::SmallVectorImpl<llvm::SmallVector<llvm::slpvectorizer::BoUpSLP::TreeEntry const*, 6u>>&, unsigned int, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x3558408)
#12 0x000000000355a2de llvm::InstructionCost llvm::slpvectorizer::BoUpSLP::processBuildVector<llvm::slpvectorizer::BoUpSLP::ShuffleCostEstimator, llvm::InstructionCost, llvm::TargetTransformInfo, llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP, llvm::SmallPtrSetImpl<llvm::Value*>>(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::Type*, llvm::TargetTransformInfo&, llvm::ArrayRef<llvm::Value*>&, llvm::slpvectorizer::BoUpSLP&, llvm::SmallPtrSetImpl<llvm::Value*>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x355a2de)
#13 0x000000000355c98f llvm::slpvectorizer::BoUpSLP::getEntryCost(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::ArrayRef<llvm::Value*>, llvm::SmallPtrSetImpl<llvm::Value*>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x355c98f)
#14 0x000000000359597f llvm::slpvectorizer::BoUpSLP::getTreeCost(llvm::ArrayRef<llvm::Value*>, llvm::InstructionCost) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x359597f)
#15 0x000000000359ba1b (anonymous namespace)::HorizontalReduction::tryToReduce(llvm::slpvectorizer::BoUpSLP&, llvm::DataLayout const&, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo const&, llvm::AssumptionCache*) SLPVectorizer.cpp:0:0
#16 0x000000000359ef90 llvm::SLPVectorizerPass::vectorizeHorReduction(llvm::PHINode*, llvm::Instruction*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&, llvm::SmallVectorImpl<llvm::WeakTrackingVH>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x359ef90)
#17 0x00000000035a430b llvm::SLPVectorizerPass::vectorizeRootInstruction(llvm::PHINode*, llvm::Instruction*, llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (.constprop.0) SLPVectorizer.cpp:0:0
#18 0x00000000035a8c0f llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35a8c0f)
#19 0x00000000035aef06 llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#20 0x00000000035af9eb llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x35af9eb)
#21 0x0000000002dab8ce llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2dab8ce)
#22 0x0000000005456241 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5456241)
#23 0x0000000000eb675e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xeb675e)
#24 0x0000000005456714 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5456714)
#25 0x0000000000eb6a2e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xeb6a2e)
#26 0x00000000054542e1 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x54542e1)
#27 0x0000000000964bfa llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x964bfa)
#28 0x0000000000958c79 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x958c79)
#29 0x000075a3c1229d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#30 0x000075a3c1229e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#31 0x000000000094fd45 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x94fd45)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

I found this crash when fuzzing the code in https://github.com/llvm/llvm-project/pull/137297.

</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJzcWllT47ja_jXiRpWULe8XXJhApqmhv6EIX5_LlGwrjgZZckkyTfj1pyQ7ceyEmaTJnJ7qLhq8vOvzLlosrBQtOSHXILgBwe0VbvRayOtC52_vm-9XmSg210-klqJociKBl8K11rUCXgrQHKB5KYpMMD0VsgRo_g7Q_PHPJMQief4dOCkIne7HSYF3AzPKAZqLWsNJjZUiCni3itWTV5JrIek7kVATpaeMwckCOKnGsiQaFlhjhjei0RB4txAgRCYV8FIyqVHkAC_1kP1lbt3hrbkKfftrQncXLoqBl7oonqxip7vi9lG4ZQ_9ycKQIdTboSWtGdna8BaHy9CfNPyFi-98wihv3iYlb1oW8-M7pSUumcgwgyC4cVEM3yCNQXAL34kUlFNNMTOeAzSDmNGSQzds-QuyopxAGvoQ-E6FDXgxQAkE0Q1wUsK13JhAOCmEAAWO1cUELgyLEVdraTjLXnRsiTMJGc4IM1yrhudLN_Cn5I3qaXvnh_ZumUuql6QoyZS2Fp1K7KXQhLuWpFAdXEFrbmere9TWkmjCSEW4NneUZ6LhhYK8-Q4Bimk89skgEzsAJSPsrAp0ORXxQEW81eBdTIOHPnDCPyGmPXVwOZePexyeZU50MXOQf9ye2Gp4E7ItEhS4hsgEf0uRjCnijsLbpaIzJkk6En9H4h7ocTqawNCYB-iAZGvLDg_XO6BBHU20o_EPaLyOxjRRKInevTD2geh23Gf3rkWtbS2iuRRCAzRn7LWa1FL8SfLtrflDM4DmzxJztRKyUgDNv207MkDzxcPj7lZO87q2HdMxzRRaCV4KvPSeKy2bXFPBAUpNj8Jc8E0lGmWMHNOohcaatI9Lor9iyv-ou_6WC66s4alSRBpqCELnFTNabDsgCgEKTRc-EAmpgpRb4qlpxSiCK0wZKabASR8f7tLFHVRNVlENMcyaEkpSC6mhFuOhjep1k01zUe0hNcSPKtUQAxfEvICU56wpCNRrAnOJ1RpmOH_REufE6F5onL_Aoqnqtmk7U-Akj1KUElcQy7IxNaG6eJnIoXkuqpoyIifkrWZCmkFinjPMywneIqMmWjb8BaD53uAqjAhc1-a-0XWjpwpOFh8PusCbKdHInADvDjipayx7ajinvISGxwBtun0b3HjIbUsTQcFhJYrGjI8IDQTa8RAdkzkWZKVsFRmCdtBDbZF5DnTenO2_IAx9P4j3MlBtVHvxKCnXFu5nAz5AcU8k8felUFoSXNkkmkHKdZtS8SdxB-jGeevMMqC0Rrsjo13P8eGClhyzL5gXzAiPrQ0zqGhJ-UosNUCpuX8VJuNTY17Lobryc-z_VgHqFEQB9nIX-ShATudNW9jdRGVvgmJe5FMlpqG12bL0FntDgUmYrHJY67UkuFi-UMbOk275e-n-2Fw_CmGprHvnmu1HYS84GApGcbTyIM5MbZ8l1jL2YsMDsW52tkA36wVGQ4FeQpLwPIGWpRcY72eY52PH8b1LpXMnrleWDJQFrucFwX4NsnqvoO2jG_H_9eLhcdfqH7DSe137nt80pgwGVfp3Yp4lIXdmQtmNFW2NXMrn1qvWZ1PBztDnwEc-OcNnqn7Dek3kYt2sVowUC8pLRp5ISZUm0rrxaedne_akUuLNE1kBb9Y__IZZQwypacj71F8bjTNG9phMMxpTLSrMWDsLuK9qNhD9A_Ya8bb5NtyuPwvYdcBMCHbRUNpg9aF0R6GMfSf-RCh_dvAOw7INXnh6_PbefTauaAbDxuj_HwbYhLAPMBoFGKOCHJ-lzoTSZ4S-liInSt00lBU_AFaXMUbpndK0wkbAIEQj04Yvn-0OxG6Kfs9X4jN58xfWHqbNo5YLog_SZl-4kX_BInje1OTw4TEIwnNRCE8H4lgJnYCF4btkfpsM7vPbG-V3nsSr88ZfC3ybYT-3b_0ELA1aPZb-EMskSKIzsTSoHEB5HhQHZX9Bf61Hvb_ByN8Mt1PZ3UIdclwRVds1U9Ka98W4L7jG7IkU3fLevtBy8yzss5OnbuOKusUaP7T7ul1ShSeU_NG28EAzieXGUHwgK1WqqWoLM87XZLusOrK3sV1cGcjCEWRklTj7ebzP_ohVtwDdAfBFyB62fZQev9z_nygOm9xwF2X47gYrmt8wkb8cvDq3jX0wE_gPwXbJ_EJ5-e3LP1CAFr8-IaMhutj3nOwMdJ-E0APAfhrAFqKpTbxainrqnJJb8cj7OHdWZ3g_W2PK1T3vDI4v5sdlQm3d6UM9WjdisnLCv3dWNtwm6b53891G1Dizc8ywvHsVrDka3h_qJocDXfpEVMO0OnjzIER9lOVWVJSbCZ8ZLg4FHmlMA25SYV6Q4oYe0flHrWlF37FhfyIVli93FdXahGq7JJ7WWOqTMhKNFrp4lZAT6lE2_LQApRyzjaLqK-a4JMP5847p8k3HurHLRDRYAqICZ3G-v0IoiMaUdU0EK_VVFIQdN3WYfQfg_JDv5uffD2oHWw_qYNkV-EGIfHfPSAvkXxn4C2PVodFjNZjCOyQLo-ASCfiPYfwLx6YFvw-NP07jyPX398rsB45nsbXHQJ4WuLabAce8bRnO8rVj-SeyMHL93tVgnIUYnZeFW99mJwL0Awh8lET_Hlhb3HpUw1EC-Yic0gePYfmrQNSh0GM0mPU7SehnK7xnomxs2jzSmjDKh4vLhZaUl2ZtfSTtPlg-fsX52sr5u6leO9McUwnB_rDfUOeUHRHyqdcfuHN0A8FiwpqS8sOe3NMrXbTPdp9rvdmroAUcLo5wt5Fp4mi_JB3p9KLWSy1E1wNaL36nvPgrqm9E0hUlckvX7vae-_diqdfmVp958TDzgjiPEihqe_rgYjqt1F5nMvp-mBTJmZ9nLctO4O4r-E4g8R24XBqepdJY6mXVu3OyCuLvqXCHOPmrwg9gK_xiMFmhrcrtIQhNpF0okQJ-p3oN24_CwEvh4v63xd1v34CTzjqVUBLdSE5MukPXS8anYJz0Hq5Ewwuo11R15zG-rwmHq-b9nfKyPaYhCgIpP__kR90wBtDc9SKURFPgpFfFtVckXoKvyLUbBZ4XxT4Kr9bXfhFkfoEz11sFOAtJkeSxH2QuxonvJaS4otfIQYETId-NPM8PpziK3DCIotArYpwnCfAdUmHKpsaGqZDllT13cu0Gjh8lV_Yon7IHOBHqCnOwGLGnYGYAIQvCRPBJd5Sme1wSTqRFPdtYdFqW4PZKXlu3s6ZUwHcYVVr1RmiqmT03OlQW3F742M5VI9n1jx_N6VB6vUb_DQAA__-v2CR4">