Bug in SLP Vectorizer

[Nirhar]

The following code snippet can be a source of crashes:

llvm-project/llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp

Lines 5016 to 5019 in 4a890c2

	std::optional<int> Diff =
	getPointersDiff(ScalarTy, Ptr0, ScalarTy, PtrN, *DL, *SE);
	// Check that the sorted loads are consecutive.
	if (static_cast<unsigned>(*Diff) == Sz - 1)

when getPointersDiff returns std::nullopt. I see this problem recurring in a few other places in the file as well.

[alexey-bataev]

sortPtrAccesses checks that the pointers are sorted and checks that getPointersDiff does not return nullopt.

[Nirhar]

Wouldn't getPointersDiff return std::nullopt when the difference between the pointers is not constant? Are we sure that the difference would be a constant at this point @alexey-bataev ?

[alexey-bataev]

It is checked already, that it does not return nullopt

[Nirhar]

Hi @alexey-bataev, I'm not very familiar with SLP-Vectorizer code. It would be helpful to familiarize myself if you point out where we ensure that getPointersDiff will not return std::nullopt. If this is something inferred semantically, can you tell how this is inferred? Thanks!

[alexey-bataev]

At first, canVectorizeLoads calls bool IsSorted = sortPtrAccesses(...). sortPtrAccesses checks all the pointers from PointerOps if they can be sorted by calling getPointersDiff and checking that it doesn't return nullopt. Second getPointersDiff is called only if IsSorted is true, i.e. we're sure that getPointersDiff returns valid result for the given pointers.
The problem is that getSCEV for some reason returns different results for the same pointer in 2 consecutive calls. It leads to a crash