Fix crashes when casting SOA pointers (#3591)

This fixes a crash that occurred when attempting to cast an SOA (slice)
pointer to a non-SOA pointer type. The crash happened with "Illegal BitCast"
LLVM assertion during code generation.

1. Update lDeconstifyType() helper with proper propagation of slice property.

2. **Error check in TypeCastExpr::TypeCheck**: Added validation to detect and
   reject casts from slice pointers to non-slice pointers. Without this check,
   even with preserved slice information, the invalid cast would proceed to code
   generation and crash in LLVM.

The fix prevents data corruption by disallowing casts that would discard the
slice offset information (which tracks which lane within the SOA structure is
being accessed).

Fixes #3591

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: aneshlya

src/expr.cpp

@@ -8025,10 +8025,21 @@ const Type *TypeCastExpr::GetLValueType() const {
     }
 }
 
+// Special helper to remove const from both pointer and pointee type recursively.
+// We can't directly use PointerType::GetAsNonConstType() here since
+// it does not recursively deconstify the base type - It only removes const from
+// the pointer itself, not from nested pointer types.
+// For example:
+//   Input: const int * const *
+//   GetAsNonConstType() gives: const int * * (only outer const removed)
+//   lDeconstifyType() should give: int * * (all const removed)
 static const Type *lDeconstifyType(const Type *t) {
     const PointerType *pt = CastType<PointerType>(t);
     if (pt != nullptr) {
-        return new PointerType(lDeconstifyType(pt->GetBaseType()), pt->GetVariability(), false);
+        // Preserve slice property when removing constness
+        unsigned int prop = pt->IsSlice() ? PointerType::SLICE : PointerType::NONE;
+        return new PointerType(lDeconstifyType(pt->GetBaseType()), pt->GetVariability(), false, prop,
+                               pt->GetAddressSpace());
     } else {
         return t->GetAsNonConstType();
     }
@@ -8072,6 +8083,14 @@ Expr *TypeCastExpr::TypeCheck() {
     const PointerType *fromPtr = CastType<PointerType>(fromType);
     const PointerType *toPtr = CastType<PointerType>(toType);
     if (fromPtr != nullptr && toPtr != nullptr) {
+        // Check for slice to non-slice pointer casts
+        if (fromPtr->IsSlice() && !toPtr->IsSlice()) {
+            Error(pos,
+                  "Can't cast from pointer to SOA type \"%s\" to "
+                  "pointer to non-SOA type \"%s\". This would discard slice offset information.",
+                  fromType->GetString().c_str(), toType->GetString().c_str());
+            return nullptr;
+        }
         // allow explicit typecasts between any two different pointer types
         return this;
     }

tests/lit-tests/3591.ispc

@@ -0,0 +1,19 @@
+// Test for issue #3591: Internal error casting soa<> pointer to opaque pointer
+// This test verifies that casting from an SOA pointer to a non-SOA pointer type
+// produces a proper error message instead of crashing with "Illegal BitCast".
+//
+// RUN: not %{ispc} %s --target=host --nowrap -o %t.o 2>&1 | FileCheck %s
+
+// CHECK: Error: Can't cast from pointer to SOA type
+// CHECK-NOT: FATAL ERROR
+struct point {
+    int x, y;
+};
+
+struct foo;
+
+__attribute__((external_only))
+export foo* uniform foo_init() {
+    soa<8> point* uniform points = uniform new soa<8> point[123];
+    return (foo* uniform)points;
+}