[llvm] f3a1a8c - [SLP]Fix crash on deleted main op of copyable state in reductions

[via llvm-commits]

Author: Alexey Bataev
Date: 2026-10-03T21:50:54-04:00
New Revision: f3a1a8cc52c69fdcaea6733db8b45160c5189f11

URL: https://github.com/llvm/llvm-project/commit/f3a1a8cc52c69fdcaea6733db8b45160c5189f11
DIFF: https://github.com/llvm/llvm-project/commit/f3a1a8cc52c69fdcaea6733db8b45160c5189f11.diff

LOG: [SLP]Fix crash on deleted main op of copyable state in reductions

Vectorizing one group of reduced values can erase the main operation of
a later group's copyable state, leaving it with dropped operands.

Fixes #228768

Reviewers: 

Pull Request: https://github.com/llvm/llvm-project/pull/228806

Added: 
    llvm/test/Transforms/SLPVectorizer/X86/reduction-erased-copyable-cast-main-op.ll

Modified: 
    llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp

Removed: 
    


################################################################################
diff  --git a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
index 0981c124e3aec..a03dfe49a85f1 100644
--- a/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ b/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -32679,6 +32679,11 @@ class HorizontalReduction {
     for (unsigned I = 0, E = ReducedVals.size(); I < E; ++I) {
       ArrayRef<Value *> OrigReducedVals = ReducedVals[I];
       InstructionsState S = States[I];
+      // The main operation of a state with copyable elements may be deleted
+      // during previous vectorization attempts, the state is not usable then.
+      if (S && S.areInstructionsWithCopyableElements() &&
+          V.isDeleted(S.getMainOp()))
+        S = InstructionsState::invalid();
       SmallVector<Value *> Candidates;
       Candidates.reserve(2 * OrigReducedVals.size());
       SmallVector<Value *> TrackedToOrig;

diff  --git a/llvm/test/Transforms/SLPVectorizer/X86/reduction-erased-copyable-cast-main-op.ll b/llvm/test/Transforms/SLPVectorizer/X86/reduction-erased-copyable-cast-main-op.ll
new file mode 100644
index 0000000000000..ccc7f41977635
--- /dev/null
+++ b/llvm/test/Transforms/SLPVectorizer/X86/reduction-erased-copyable-cast-main-op.ll
@@ -0,0 +1,56 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 6
+; RUN: opt -S -passes=slp-vectorizer -mtriple=x86_64-unknown-linux-gnu < %s | FileCheck %s
+
+; The tree of the reduced ands erases the reduced zexts, including the main
+; operation of the zext group with a copyable constant.
+define i64 @test(ptr %p) {
+; CHECK-LABEL: define i64 @test(
+; CHECK-SAME: ptr [[P:%.*]]) {
+; CHECK-NEXT:  [[ENTRY:.*:]]
+; CHECK-NEXT:    [[V:%.*]] = load i8, ptr [[P]], align 1
+; CHECK-NEXT:    [[TMP0:%.*]] = insertelement <4 x i8> poison, i8 [[V]], i64 0
+; CHECK-NEXT:    [[TMP1:%.*]] = shufflevector <4 x i8> [[TMP0]], <4 x i8> poison, <4 x i32> zeroinitializer
+; CHECK-NEXT:    [[TMP2:%.*]] = and <4 x i8> [[TMP1]], <i8 1, i8 -1, i8 -1, i8 -1>
+; CHECK-NEXT:    [[TMP3:%.*]] = extractelement <4 x i8> [[TMP2]], i64 0
+; CHECK-NEXT:    [[TMP4:%.*]] = zext i8 [[TMP3]] to i64
+; CHECK-NEXT:    [[Z2:%.*]] = zext i8 [[V]] to i64
+; CHECK-NEXT:    [[TMP5:%.*]] = mul <4 x i8> [[TMP2]], <i8 7, i8 7, i8 7, i8 1>
+; CHECK-NEXT:    [[TMP6:%.*]] = and <4 x i8> [[TMP5]], <i8 5, i8 5, i8 5, i8 -1>
+; CHECK-NEXT:    [[TMP7:%.*]] = zext <4 x i8> [[TMP6]] to <4 x i64>
+; CHECK-NEXT:    [[TMP8:%.*]] = mul <4 x i64> [[TMP7]], <i64 3, i64 2, i64 2, i64 3>
+; CHECK-NEXT:    [[TMP9:%.*]] = call i64 @llvm.vector.reduce.add.v4i64(<4 x i64> [[TMP8]])
+; CHECK-NEXT:    [[TMP10:%.*]] = mul i64 [[TMP4]], 2
+; CHECK-NEXT:    [[TMP11:%.*]] = mul i64 [[Z2]], 2
+; CHECK-NEXT:    [[OP_RDX5:%.*]] = add i64 [[TMP10]], [[TMP11]]
+; CHECK-NEXT:    [[OP_RDX6:%.*]] = add i64 [[OP_RDX5]], 1
+; CHECK-NEXT:    [[OP_RDX7:%.*]] = add i64 [[OP_RDX6]], [[TMP9]]
+; CHECK-NEXT:    ret i64 [[OP_RDX7]]
+;
+entry:
+  %v = load i8, ptr %p, align 1
+  %m = and i8 %v, 1
+  %z0 = zext i8 %m to i64
+  %mul0 = mul i64 %z0, 7
+  %a0 = and i64 %mul0, 5
+  %s0 = add i64 %a0, 1
+  %z1 = zext i8 %v to i64
+  %s1 = add i64 %s0, %z1
+  %z2 = zext i8 %v to i64
+  %s2 = add i64 %s1, %z2
+  %mul2 = mul i64 %z2, 7
+  %a2 = and i64 %mul2, 5
+  %s3 = add i64 %s2, %a2
+  %s4 = add i64 %s3, %z0
+  %s5 = add i64 %s4, %a0
+  %s6 = add i64 %s5, %z1
+  %mul1 = mul i64 %z1, 7
+  %a1 = and i64 %mul1, 5
+  %s7 = add i64 %s6, %a1
+  %s8 = add i64 %s7, %z2
+  %s9 = add i64 %s8, %a2
+  %s10 = add i64 %s9, %z0
+  %s11 = add i64 %s10, %a0
+  %s12 = add i64 %s11, %z1
+  %s13 = add i64 %s12, %a1
+  ret i64 %s13
+}