Don't push a poison aggregate onto the sret rooting worklist

`needsReRooting` walks every value stored into an sret argument to check each
tracked pointer is also parked in the returnRoots array. Walking back through an
insertvalue chain, the branch for an insert of an untracked field pushed the
aggregate operand unconditionally:

    CountTrackedPointers tracked(IVI->getInsertedValueOperand()->getType());
    if (tracked.count == 0) { storedValues.push_back(IVI->getAggregateOperand()); continue; }

When that operand is the poison the chain was built from, the bare poison lands
on the worklist. The struct handling below then looks for an extractvalue
covering poison's tracked fields, finds none, and reports

     failed to find extracted pointer for %tape poison at index 1

before falling through to the pointer-shaped handling, whose assert(0) fires on
any non-pointer value. Julia hits this whenever a nested sub-tape survives SROA
as a whole-aggregate store and its first field is untracked -- reverse mode over
PEPSKit's CTMRG aborts the process this way, since the shipped Enzyme_jll
RelWithDebInfo build leaves assertions live.

A poison, undef, or zeroinitializer aggregate has no live pointer in any field,
so it needs no root regardless of which field the insertvalue overwrites. Hoist
the trivial-base test above both branches and drop such a base, which is the
reasoning the tracked branch three lines down already relies on. In the Julia
case the tracked pointers are separately stored into the returnRoots, so the
walk then completes and the pass correctly concludes it has no work to do.

Also un-shadow `legal` in the struct handling. The inner declaration meant the
coverage failure set a variable nobody read and fell into that same assert;
report it through CustomErrorHandler like the pointer path does and reroot
conservatively. This is not a behaviour change for NDEBUG builds, which already
fell through to exactly that handler.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: kshyatt

enzyme/Enzyme/FixupJuliaCallingConvention.cpp

@@ -223,15 +223,22 @@ bool needsReRooting(llvm::Argument *arg, bool &anyJLStore,
       }
       if (!foundUse) {
         if (auto IVI = dyn_cast<InsertValueInst>(sv)) {
+          // An undef/poison/zeroinitializer base has no live pointer in any of
+          // its fields, so it needs no root regardless of which field the
+          // insertvalue overwrites.
+          bool trivialAggregate =
+              isa<UndefValue>(IVI->getAggregateOperand()) ||
+              isa<PoisonValue>(IVI->getAggregateOperand()) ||
+              isa<ConstantAggregateZero>(IVI->getAggregateOperand());
           CountTrackedPointers tracked(
               IVI->getInsertedValueOperand()->getType());
           if (tracked.count == 0) {
+            if (trivialAggregate)
+              continue;
             storedValues.push_back(IVI->getAggregateOperand());
             continue;
           }
-          if (isa<UndefValue>(IVI->getAggregateOperand()) ||
-              isa<PoisonValue>(IVI->getAggregateOperand()) ||
-              isa<ConstantAggregateZero>(IVI->getAggregateOperand())) {
+          if (trivialAggregate) {
             storedValues.push_back(IVI->getInsertedValueOperand());
             continue;
           }
@@ -240,7 +247,7 @@ bool needsReRooting(llvm::Argument *arg, bool &anyJLStore,
           continue;
         }
         if (auto ST = dyn_cast<StructType>(sv->getType())) {
-          bool legal = true;
+          bool covered = true;
           for (size_t i = 0; i < ST->getNumElements(); i++) {
 
             CountTrackedPointers tracked(ST->getElementType(i));
@@ -336,13 +343,27 @@ bool needsReRooting(llvm::Argument *arg, bool &anyJLStore,
             if (!fullyCovered) {
               llvm::errs() << " failed to find extracted pointer for " << *sv
                            << " at index " << i << "\n";
-              legal = false;
+              covered = false;
               break;
             }
           }
-          if (legal) {
+          if (covered) {
             continue;
           }
+          // Not every tracked pointer in this aggregate could be shown to be
+          // rooted separately. Report it and reroot conservatively rather than
+          // falling into the pointer-shaped handling below, which asserts on
+          // any non-pointer value.
+          if (hasReturnRootingAfterArg) {
+            std::string s;
+            llvm::raw_string_ostream ss(s);
+            ss << "Could not find use of stored value\n";
+            ss << " sv: " << *sv << "\n";
+            CustomErrorHandler(ss.str().c_str(), wrap(sv), ErrorType::GCRewrite,
+                               nullptr, wrap(arg), nullptr);
+          }
+          legal = false;
+          break;
         }
         if (!isa<PointerType>(sv->getType()) ||
             !isSpecialPtr(cast<PointerType>(sv->getType()))) {

enzyme/test/Enzyme/JuliaCallingConvention/poison_insertvalue_base.ll

@@ -0,0 +1,29 @@
+; RUN: %opt %newLoadEnzyme -S -passes=enzyme-fixup-julia < %s | FileCheck %s
+
+; A sub-aggregate rebuilt by an insertvalue chain based on poison, whose last
+; insert writes an untracked field. Walking back from the sret store reaches that
+; insertvalue, and pushing its aggregate operand puts the bare poison on the
+; worklist; the struct handling then looks for an extractvalue covering poison's
+; tracked field, finds none, and used to fall through to an assert. A poison
+; aggregate holds no live pointer, so there is nothing to root and the pass has
+; no work to do here -- the tracked pointer is already in the returnRoots.
+
+; CHECK-LABEL: define void @test_poison_insertvalue_base({{.*}} sret({{.*}}) %sret, {{.*}}"enzymejl_returnRoots"="1" %rroots
+; CHECK: store {{.*}} %o, {{.*}} %sret
+; CHECK: ret void
+
+%tape = type { i8*, {} addrspace(10)*, i64 }
+%outer = type { %tape }
+
+define void @test_poison_insertvalue_base(%outer* sret(%outer) %sret, [1 x {} addrspace(10)*]* "enzymejl_returnRoots"="1" %rroots, i8* %raw, {} addrspace(10)* %tracked, i64 %n) {
+entry:
+  %t0 = insertvalue %tape poison, i8* %raw, 0
+  %t1 = insertvalue %tape %t0, {} addrspace(10)* %tracked, 1
+  %t2 = insertvalue %tape %t1, i64 %n, 2
+  %o = insertvalue %outer poison, %tape %t2, 0
+  store %outer %o, %outer* %sret, align 8
+
+  %g = getelementptr inbounds [1 x {} addrspace(10)*], [1 x {} addrspace(10)*]* %rroots, i64 0, i64 0
+  store {} addrspace(10)* %tracked, {} addrspace(10)** %g, align 8
+  ret void
+}