clang crashes on valid code at -O{s,2,3} on x86_64-linux-gnu: Assertion `I1 == PoisonMaskElem && "Expected unused subvectors mask"' failed

[zhendongsu]

It appears to be a recent regression as it doesn't reproduce with 19.1.0 and earlier.

Compiler Explorer: https://godbolt.org/z/vWPhsMfoz

[510] % clangtk -v
clang version 20.0.0git (https://github.com/llvm/llvm-project.git 24bd9bc0b59d51c82e9a4d84c21d86d58d0ef6ce)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/11
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/12
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/12
Candidate multilib: .;@m64
Selected multilib: .;@m64
Found CUDA installation: /usr/local/cuda, version 12.1
[511] % 
[511] % clangtk -O2 small.c
clang-20: /local/suz-local/software/clangbuild/llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp:10936: llvm::InstructionCost llvm::slpvectorizer::BoUpSLP::ShuffleCostEstimator::finalize(llvm::ArrayRef<int>, llvm::ArrayRef<std::pair<const llvm::slpvectorizer::BoUpSLP::TreeEntry*, unsigned int> >, llvm::ArrayRef<int>, unsigned int, llvm::function_ref<void(llvm::Value*&, llvm::SmallVectorImpl<int>&)>): Assertion `I1 == PoisonMaskElem && "Expected unused subvectors mask"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20 -cc1 -triple x86_64-unknown-linux-gnu -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name small.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/local/suz-local/software/emitesting/bugs/20250111-clangtk-m64-Os-build-025751/delta -fcoverage-compilation-dir=/local/suz-local/software/emitesting/bugs/20250111-clangtk-m64-Os-build-025751/delta -resource-dir /local/home/suz/suz-local/software/local/clang-trunk/lib/clang/20 -I /usr/local/include -I /local/suz-local/software/local/include -internal-isystem /local/home/suz/suz-local/software/local/clang-trunk/lib/clang/20/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -vectorize-loops -vectorize-slp -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/small-2771d7.o -x c small.c
1.	<eof> parser at end of file
2.	Optimizer
3.	Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O2>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "small.c"
4.	Running pass "slp-vectorizer" on function "main"
 #0 0x0000562bd646d500 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x4576500)
 #1 0x0000562bd646a91f llvm::sys::RunSignalHandlers() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x457391f)
 #2 0x0000562bd646aa75 SignalHandler(int) Signals.cpp:0:0
 #3 0x00007f13d1771520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007f13d17c5a7c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x96a7c)
 #5 0x00007f13d1771476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007f13d17577f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007f13d175771b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x00007f13d1768e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x0000562bd7f25a4f llvm::slpvectorizer::BoUpSLP::ShuffleCostEstimator::finalize(llvm::ArrayRef<int>, llvm::ArrayRef<std::pair<llvm::slpvectorizer::BoUpSLP::TreeEntry const*, unsigned int>>, llvm::ArrayRef<int>, unsigned int, llvm::function_ref<void (llvm::Value*&, llvm::SmallVectorImpl<int>&)>) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x602ea4f)
#10 0x0000562bd7f9164b llvm::InstructionCost llvm::slpvectorizer::BoUpSLP::processBuildVector<llvm::slpvectorizer::BoUpSLP::ShuffleCostEstimator, llvm::InstructionCost, llvm::TargetTransformInfo, llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP, llvm::SmallPtrSetImpl<llvm::Value*>>(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::Type*, llvm::TargetTransformInfo&, llvm::ArrayRef<llvm::Value*>&, llvm::slpvectorizer::BoUpSLP&, llvm::SmallPtrSetImpl<llvm::Value*>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x609a64b)
#11 0x0000562bd7f92881 llvm::slpvectorizer::BoUpSLP::getEntryCost(llvm::slpvectorizer::BoUpSLP::TreeEntry const*, llvm::ArrayRef<llvm::Value*>, llvm::SmallPtrSetImpl<llvm::Value*>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x609b881)
#12 0x0000562bd7faaa12 llvm::slpvectorizer::BoUpSLP::getTreeCost(llvm::ArrayRef<llvm::Value*>) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x60b3a12)
#13 0x0000562bd7fb43e8 llvm::SLPVectorizerPass::tryToVectorizeList(llvm::ArrayRef<llvm::Value*>, llvm::slpvectorizer::BoUpSLP&, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x60bd3e8)
#14 0x0000562bd7fb92b0 bool tryToVectorizeSequence<llvm::Value>(llvm::SmallVectorImpl<llvm::Value*>&, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::Value*, llvm::Value*)>, llvm::function_ref<bool (llvm::ArrayRef<llvm::Value*>, bool)>, bool, llvm::slpvectorizer::BoUpSLP&) (.constprop.0) SLPVectorizer.cpp:0:0
#15 0x0000562bd7fbabe9 llvm::SLPVectorizerPass::vectorizeChainsInBlock(llvm::BasicBlock*, llvm::slpvectorizer::BoUpSLP&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x60c3be9)
#16 0x0000562bd7fc268e llvm::SLPVectorizerPass::runImpl(llvm::Function&, llvm::ScalarEvolution*, llvm::TargetTransformInfo*, llvm::TargetLibraryInfo*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::DemandedBits*, llvm::OptimizationRemarkEmitter*) (.part.0) SLPVectorizer.cpp:0:0
#17 0x0000562bd7fc31d1 llvm::SLPVectorizerPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x60cc1d1)
#18 0x0000562bd79d6826 llvm::detail::PassModel<llvm::Function, llvm::SLPVectorizerPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x5adf826)
#19 0x0000562bd5de82ef llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x3ef12ef)
#20 0x0000562bd37a5226 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x18ae226)
#21 0x0000562bd5de664b llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x3eef64b)
#22 0x0000562bd37a3b36 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x18acb36)
#23 0x0000562bd5de724d llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x3ef024d)
#24 0x0000562bd67194c7 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#25 0x0000562bd671d213 clang::emitBackendOutput(clang::CompilerInstance&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x4826213)
#26 0x0000562bd6df1805 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x4efa805)
#27 0x0000562bd8a8c2cc clang::ParseAST(clang::Sema&, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x6b952cc)
#28 0x0000562bd70d6ca9 clang::FrontendAction::Execute() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x51dfca9)
#29 0x0000562bd7054ad5 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x515dad5)
#30 0x0000562bd71bbf73 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x52c4f73)
#31 0x0000562bd334425f cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x144d25f)
#32 0x0000562bd333ab2a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#33 0x0000562bd333efe7 clang_main(int, char**, llvm::ToolContext const&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x1447fe7)
#34 0x0000562bd322eb3b main (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x1337b3b)
#35 0x00007f13d1758d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#36 0x00007f13d1758e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#37 0x0000562bd333a255 _start (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-20+0x1443255)
clangtk: error: unable to execute command: Aborted
clangtk: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 20.0.0git (https://github.com/llvm/llvm-project.git 24bd9bc0b59d51c82e9a4d84c21d86d58d0ef6ce)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
clangtk: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clangtk: note: diagnostic msg: /tmp/small-929da7.c
clangtk: note: diagnostic msg: /tmp/small-929da7.sh
clangtk: note: diagnostic msg: 

********************
[512] % 
[512] % cat small.c
int a, b, d, e, f, i, n;
long c, g, h;
unsigned o;
int main() {
  unsigned long j;
  long l, m;
  if (0) {
  k:
    h = ~g;
    l = g;
    m = j;
    i = d;
  p:
    b = g = i;
    if (d) {
    q:
      j = a;
      if (i || i >= a)
      r:
        if (f && h > a)
          goto q;
      goto s;
    }
    g = l;
    j = m;
  s:;
  }
  if (c) {
    n = j % -1;
    o = b;
    if (n) {
      g = d ^ j;
      j = ~(1 / o);
      if (!(n - 1))
        goto r;
      if (e)
        goto p;
    }
    goto k;
  }
}

[dtcxzyw]

Reduced reproducer: https://godbolt.org/z/MzcesqWz1

; bin/opt -passes=slp-vectorizer reduced.ll -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define i32 @main(i64 %l.549) {
entry:
  %conv3 = sext i32 0 to i64
  br label %if.then19

p:                                                ; preds = %if.end29, %if.end25
  %l.0 = phi i64 [ %xor, %if.end29 ], [ %l.5493, %if.end25 ]
  %m.0 = phi i64 [ %not21, %if.end29 ], [ %m.550, %if.end25 ]
  br i1 false, label %s, label %q

q:                                                ; preds = %land.lhs.true, %p
  %xor39 = phi i64 [ 0, %p ], [ 0, %land.lhs.true ]
  %l.1 = phi i64 [ 0, %p ], [ 0, %land.lhs.true ]
  %m.1 = phi i64 [ 0, %p ], [ 0, %land.lhs.true ]
  br i1 false, label %lor.lhs.false, label %r

lor.lhs.false:                                    ; preds = %q
  br i1 false, label %land.lhs.true, label %s

r:                                                ; preds = %if.then19, %q
  %xor38 = phi i64 [ %xor39, %q ], [ %xor, %if.then19 ]
  %j.0 = phi i64 [ %conv3, %q ], [ %not21, %if.then19 ]
  %l.2 = phi i64 [ %l.1, %q ], [ %l.549, %if.then19 ]
  %m.2 = phi i64 [ %m.1, %q ], [ %m.550, %if.then19 ]
  br i1 false, label %s, label %land.lhs.true

land.lhs.true:                                    ; preds = %r, %lor.lhs.false
  %xor37 = phi i64 [ %xor38, %r ], [ 0, %lor.lhs.false ]
  %j.1 = phi i64 [ %j.0, %r ], [ 0, %lor.lhs.false ]
  %l.3 = phi i64 [ %l.2, %r ], [ 0, %lor.lhs.false ]
  %m.3 = phi i64 [ %m.2, %r ], [ 0, %lor.lhs.false ]
  br i1 false, label %q, label %s

s:                                                ; preds = %land.lhs.true, %r, %lor.lhs.false, %p
  %xor36 = phi i64 [ %xor37, %land.lhs.true ], [ %xor38, %r ], [ %xor39, %lor.lhs.false ], [ %l.0, %p ]
  %j.2 = phi i64 [ %j.1, %land.lhs.true ], [ %j.0, %r ], [ %conv3, %lor.lhs.false ], [ %m.0, %p ]
  %l.4 = phi i64 [ %l.3, %land.lhs.true ], [ %l.2, %r ], [ %l.1, %lor.lhs.false ], [ %l.0, %p ]
  %m.4 = phi i64 [ %m.3, %land.lhs.true ], [ %m.2, %r ], [ %m.1, %lor.lhs.false ], [ %m.0, %p ]
  br label %if.then19

if.then19:                                        ; preds = %s, %entry
  %m.550 = phi i64 [ 0, %entry ], [ %m.4, %s ]
  %l.5493 = phi i64 [ 0, %entry ], [ %l.4, %s ]
  %xor = xor i64 0, 0
  %not21 = xor i64 0, 0
  br i1 false, label %r, label %if.end25

if.end25:                                         ; preds = %if.then19
  br i1 false, label %if.end29, label %p

if.end29:                                         ; preds = %if.end25
  br label %p
}