[llvm] [SROA] Allow canonicalizing homogeneous array allocas to vectors (PR #216456)

Sat Aug 15 00:19:41 PDT 2026

dtcxzyw wrote:

The following correctness issue was found by [llvm-hackme](https://github.com/dtcxzyw/llvm-hackme).

<!-- llvm-hackme-state: bug_found -->
<!-- llvm-hackme-baseline: 23e0cbe9a37fdd7addfd461ace6b480ad423e36b -->
<!-- llvm-hackme-head-sha: 00080983dde636ffbd7755c447d7d42f4d14b2eb -->
<!-- llvm-hackme-patch-sha256: 4ba71293f7196cc20dc60ad9feff9e91d5b4e08d61b009a333cc5eab44db72c3 -->
<!-- llvm-hackme-kind: crash -->

This comment is generated by an automated correctness checking service designed to help identify critical correctness bugs (opt crashes or Alive2 miscompilations) and improve PR review efficiency under limited reviewer bandwidth.

The reproducer was generated by LLM.

This bug is a regression introduced by this PR. It does not reproduce on the baseline commit.

## Reproducer

**Kind**: crash

**IR Reproducer**:
```llvm
; RUN: opt -passes=sroa<aggregate-to-vector> -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @huge_memset(ptr %dst) {
entry:
  %a = alloca [4294967295 x i8], align 1
  call void @llvm.memset.p0.i64(ptr align 1 %a, i8 5, i64 4294967295, i1 false)
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %dst, ptr align 1 %a, i64 4294967295, i1 false)
  ret void
}
```

**Stacktrace**:
```
terminate called after throwing an instance of 'std::bad_alloc'
  what():  std::bad_alloc
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.	Program arguments: /llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/opt -S -o /dev/null /tmp/tmpbe6_ww07.ll -passes=sroa<aggregate-to-vector>
1.	Running pass "function(sroa<modify-cfg;aggregate-to-vector>)" on module "/tmp/tmpbe6_ww07.ll"
2.	Running pass "sroa<modify-cfg;aggregate-to-vector>" on function "huge_memset"
 #0 0x00007ffff7e1a882 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Unix/Signals.inc:931:22
 #1 0x00007ffff7e174bc llvm::sys::RunSignalHandlers() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Signals.cpp:108:20
 #2 0x00007ffff7e176c5 SignalHandler(int, siginfo_t*, void*) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/Unix/Signals.inc:474:14
 #3 0x00007ffff7a19520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007ffff7a6d9fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007ffff7a19476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007ffff79ff7f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007fffed876b9e (/lib/x86_64-linux-gnu/libstdc++.so.6+0xa2b9e)
 #8 0x00007fffed88220c (/lib/x86_64-linux-gnu/libstdc++.so.6+0xae20c)
 #9 0x00007fffed882277 (/lib/x86_64-linux-gnu/libstdc++.so.6+0xae277)
#10 0x00007fffed8824d8 (/lib/x86_64-linux-gnu/libstdc++.so.6+0xae4d8)
#11 0x00007ffff7c76a25 llvm::raw_pwrite_stream::~raw_pwrite_stream() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/Support/raw_ostream.h:437:16
#12 0x00007ffff7c76a25 llvm::raw_svector_ostream::~raw_svector_ostream() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/Support/raw_ostream.h:718:3
#13 0x00007ffff7c76a25 llvm::report_fatal_error(llvm::Twine const&, bool) (.cold) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/ErrorHandling.cpp:127:3
#14 0x00007ffff7d7f0fa llvm::safe_malloc(unsigned long) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/Support/MemAlloc.h:31:5
#15 0x00007ffff7d7f0fa replaceAllocation /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/SmallVector.cpp:123:43
#16 0x00007ffff7d7f0fa llvm::SmallVectorBase<unsigned int>::grow_pod(void*, unsigned long, unsigned long) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Support/SmallVector.cpp:161:34
#17 0x00007fffedb2d707 llvm::Value::getContext() const /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/Value.h:258:44
#18 0x00007fffedb2d707 llvm::ConstantFoldInsertElementInstruction(llvm::Constant*, llvm::Constant*, llvm::Constant*) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/IR/ConstantFold.cpp:464:30
#19 0x00007fffedb6f94c llvm::ConstantExpr::getInsertElement(llvm::Constant*, llvm::Constant*, llvm::Constant*, llvm::Type*) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/IR/Constants.cpp:2751:3
#20 0x00007fffedc51169 llvm::IRBuilderBase::CreateInsertElement(llvm::Value*, llvm::Value*, llvm::Value*, llvm::Twine const&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/IRBuilder.h:2674:5
#21 0x00007fffedc51169 llvm::IRBuilderBase::CreateVectorSplat(llvm::ElementCount, llvm::Value*, llvm::Twine const&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/IR/IRBuilder.cpp:1291:26
#22 0x00007fffef7599c6 getVectorSplat /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/Scalar/SROA.cpp:3633:5
#23 0x00007fffef7599c6 visitMemSetInst /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/Scalar/SROA.cpp:3755:27
#24 0x00007fffef7599c6 delegateCallInst /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/InstVisitor.h:294:9
#25 0x00007fffef7599c6 visitCall /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/Instruction.def:211:1
#26 0x00007fffef7599c6 visit /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/Instruction.def:211:1
#27 0x00007fffef7599c6 visit /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/InstVisitor.h:111:46
#28 0x00007fffef7599c6 (anonymous namespace)::AllocaSliceRewriter::visit((anonymous namespace)::Slice const*) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/Scalar/SROA.cpp:2807:21
#29 0x00007fffef75b39f (anonymous namespace)::SROA::rewritePartition(llvm::AllocaInst&, (anonymous namespace)::AllocaSlices&, (anonymous namespace)::Partition&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/Scalar/SROA.cpp:5604:7
#30 0x00007fffef75de11 splitAlloca /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/Scalar/SROA.cpp:5915:5
#31 0x00007fffef75de11 (anonymous namespace)::SROA::runOnAlloca(llvm::AllocaInst&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/Scalar/SROA.cpp:6207:25
#32 0x00007fffef75f757 (anonymous namespace)::SROA::runSROA(llvm::Function&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/Scalar/SROA.cpp:6314:22
#33 0x00007fffef760605 llvm::SROAPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/Transforms/Scalar/SROA.cpp:6354:56
#34 0x00007ffff145f316 llvm::detail::PassModel<llvm::Function, llvm::SROAPass, llvm::AnalysisManager<llvm::Function> >::runImpl(llvm::detail::PassConcept<llvm::Function, llvm::AnalysisManager<llvm::Function> >&, llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:129:3
#35 0x00007fffedd0475e llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function> >::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerImpl.h:80:18
#36 0x00007ffff145c4c6 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function> >, llvm::AnalysisManager<llvm::Function> >::runImpl(llvm::detail::PassConcept<llvm::Function, llvm::AnalysisManager<llvm::Function> >&, llvm::Function&, llvm::AnalysisManager<llvm::Function>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:129:3
#37 0x00007fffedd03617 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/lib/IR/PassManager.cpp:132:41
#38 0x00007ffff145fe56 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module> >::runImpl(llvm::detail::PassConcept<llvm::Module, llvm::AnalysisManager<llvm::Module> >&, llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerInternal.h:129:3
#39 0x00007fffedd02f0f llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module> >::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/PassManagerImpl.h:80:18
#40 0x00007ffff7f94874 llvm::SmallPtrSetImplBase::~SmallPtrSetImplBase() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:89:5
#41 0x00007ffff7f94874 llvm::SmallPtrSetImpl<llvm::AnalysisKey*>::~SmallPtrSetImpl() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:365:35
#42 0x00007ffff7f94874 llvm::SmallPtrSet<llvm::AnalysisKey*, 2u>::~SmallPtrSet() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/ADT/SmallPtrSet.h:532:7
#43 0x00007ffff7f94874 llvm::PreservedAnalyses::~PreservedAnalyses() /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/include/llvm/IR/Analysis.h:112:7
#44 0x00007ffff7f94874 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)> >, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/tools/opt/NewPMDriver.cpp:580:10
#45 0x00007ffff7fa18c4 optMain /llvm-hackme/work/llvm-hackme/llvm-build-pr/../llvm-project-pr/llvm/tools/opt/optdriver.cpp:805:25
#46 0x00007ffff7a00d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#47 0x00007ffff7a00e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#48 0x0000555555555095 _start (/llvm-hackme/work/llvm-hackme/llvm-build-pr/bin/opt+0x1095)
```

**Baseline Revision**: `23e0cbe9a37fdd7addfd461ace6b480ad423e36b`
**PR Head SHA**: `00080983dde636ffbd7755c447d7d42f4d14b2eb`
**Patch SHA256**: `4ba71293f7196cc20dc60ad9feff9e91d5b4e08d61b009a333cc5eab44db72c3`

https://github.com/llvm/llvm-project/pull/216456