opt crashed with "-licm": Assertion `MSSA->dominates(NewDef, FirstDef) && "Should have dominated the new access"' failed.

[llvmbot]

Bugzilla Link	48531
Version	trunk
OS	Linux
Attachments	bc file pased to opt
Reporter	LLVM Bugzilla Contributor

Extended Description

---

OS and Platform:
CentOS Linux release 7.8.2003 (Core), x86_64 GNU/Linux

---

Program:
int a, d;
short b;
long c;
void e() {
f : {
int g;
for (; 1; d++)
;
if (g) {
if (a)
goto h;
i:
if (b)
h:
goto f;
}
if (c)
goto i;
}
}
int main() {}

---

clang version:
$ clang -v
clang version 12.0.0 (/home/suocy/src/llvm-dev/llvm-project/llvm/tools/clang cee1e7d)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /home/suocy/bin/llvm-dev/bin
Found candidate GCC installation: /opt/rh/devtoolset-7/root/usr/lib/gcc/x86_64-redhat-linux/7
Found candidate GCC installation: /usr/lib/gcc/x86_64-redhat-linux/4.8.2
Found candidate GCC installation: /usr/lib/gcc/x86_64-redhat-linux/4.8.5
Selected GCC installation: /opt/rh/devtoolset-7/root/usr/lib/gcc/x86_64-redhat-linux/7
Candidate multilib: .;@m64
Candidate multilib: 32;@m32
Selected multilib: .;@m64

---

Command Lines:
$ clang -O3 -mllvm -disable-llvm-optzns -c -emit-llvm a.c -o a.bc
$ opt -licm a.bc -o a.opt.bc
opt: /home/suocy/src/llvm-dev/llvm-project/llvm/lib/Analysis/MemorySSAUpdater.cpp:508: void llvm::MemorySSAUpdater::fixupDefs(const llvm::SmallVectorImplllvm::WeakVH&): Assertion `MSSA->dominates(NewDef, FirstDef) && "Should have dominated the new access"' failed.
PLEASE submit a bug report to https://bugs.llvm.org/ and include the crash backtrace.
Stack dump:
0. Program arguments: /home/suocy/bin/llvm-dev/bin/opt -licm a.bc -o a.opt.bc

1.  Running pass 'Function Pass Manager' on module 'a.bc'.
   

2.  Running pass 'Loop Pass Manager' on function '@e'
   

3.  Running pass 'Loop Invariant Code Motion' on basic block '%for.cond'
   

#​0 0x0000000002aa662c llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/suocy/bin/llvm-dev/bin/opt+0x2aa662c)
#​1 0x0000000002aa44a4 llvm::sys::RunSignalHandlers() (/home/suocy/bin/llvm-dev/bin/opt+0x2aa44a4)
#​2 0x0000000002aa4603 SignalHandler(int) (/home/suocy/bin/llvm-dev/bin/opt+0x2aa4603)
#​3 0x00007faffc316630 __restore_rt (/lib64/libpthread.so.0+0xf630)
#​4 0x00007faffaf04387 raise (/lib64/libc.so.6+0x36387)
#​5 0x00007faffaf05a78 abort (/lib64/libc.so.6+0x37a78)
#​6 0x00007faffaefd1a6 __assert_fail_base (/lib64/libc.so.6+0x2f1a6)
#​7 0x00007faffaefd252 (/lib64/libc.so.6+0x2f252)
#​8 0x0000000001b866d8 llvm::MemorySSAUpdater::fixupDefs(llvm::SmallVectorImplllvm::WeakVH const&) (/home/suocy/bin/llvm-dev/bin/opt+0x1b866d8)
#​9 0x0000000001b869de llvm::MemorySSAUpdater::insertDef(llvm::MemoryDef*, bool) (/home/suocy/bin/llvm-dev/bin/opt+0x1b869de)
#​10 0x000000000281649a (anonymous namespace)::LoopPromoter::doExtraRewritesBeforeFinalDeletion() (/home/suocy/bin/llvm-dev/bin/opt+0x281649a)
#​11 0x0000000002be7d67 llvm::LoadAndStorePromoter::run(llvm::SmallVectorImplllvm::Instruction* const&) (/home/suocy/bin/llvm-dev/bin/opt+0x2be7d67)
#​12 0x0000000002814bbf llvm::promoteLoopAccessesToScalars(llvm::SmallSetVector<llvm::Value*, 8u> const&, llvm::SmallVectorImplllvm::BasicBlock*&, llvm::SmallVectorImplllvm::Instruction*&, llvm::SmallVectorImplllvm::MemoryAccess*&, llvm::PredIteratorCache&, llvm::LoopInfo*, llvm::DominatorTree*, llvm::TargetLibraryInfo const*, llvm::Loop*, llvm::AliasSetTracker*, llvm::MemorySSAUpdater*, llvm::ICFLoopSafetyInfo*, llvm::OptimizationRemarkEmitter*) (/home/suocy/bin/llvm-dev/bin/opt+0x2814bbf)
#​13 0x000000000281fe77 (anonymous namespace)::LoopInvariantCodeMotion::runOnLoop(llvm::Loop*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::BlockFrequencyInfo*, llvm::TargetLibraryInfo*, llvm::TargetTransformInfo*, llvm::ScalarEvolution*, llvm::MemorySSA*, llvm::OptimizationRemarkEmitter*) (.part.767) (/home/suocy/bin/llvm-dev/bin/opt+0x281fe77)
#​14 0x0000000002820bbd (anonymous namespace)::LegacyLICMPass::runOnLoop(llvm::Loop*, llvm::LPPassManager&) (/home/suocy/bin/llvm-dev/bin/opt+0x2820bbd)
#​15 0x0000000001b452b3 llvm::LPPassManager::runOnFunction(llvm::Function&) (/home/suocy/bin/llvm-dev/bin/opt+0x1b452b3)
#​16 0x00000000022cdb58 llvm::FPPassManager::runOnFunction(llvm::Function&) (/home/suocy/bin/llvm-dev/bin/opt+0x22cdb58)
#​17 0x00000000022ce5f9 llvm::FPPassManager::runOnModule(llvm::Module&) (/home/suocy/bin/llvm-dev/bin/opt+0x22ce5f9)
#​18 0x00000000022cd403 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/home/suocy/bin/llvm-dev/bin/opt+0x22cd403)
#​19 0x000000000071abdb main (/home/suocy/bin/llvm-dev/bin/opt+0x71abdb)
#​20 0x00007faffaef0555 __libc_start_main (/lib64/libc.so.6+0x22555)
#​21 0x00000000007cd705 _start (/home/suocy/bin/llvm-dev/bin/opt+0x7cd705)
Aborted

[llvmbot]

Looks like I am hitting same crash in a different workflow, while performing a debug build using emscripten.
I may not have a small reproducer atm,

1. Running pass 'Function Pass Manager' on module 'ld-temp.o'.
2. Running pass 'Global Value Numbering' on function '@_ZN16CommandProcessor11mainCmdLoopEbR15MainCmdLoopMode'

#​0 0x00007fbfe22c20d3 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x188b0d3)
#​1 0x00007fbfe22bfe1e llvm::sys::RunSignalHandlers() (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x1888e1e)
#​2 0x00007fbfe22c259f SignalHandler(int) Signals.cpp:0:0
#​3 0x00007fbfe47a6980 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x12980)
#​4 0x00007fbfe00cefb7 raise (/lib/x86_64-linux-gnu/libc.so.6+0x3efb7)
#​5 0x00007fbfe00d0921 abort (/lib/x86_64-linux-gnu/libc.so.6+0x40921)
#​6 0x00007fbfe00c048a (/lib/x86_64-linux-gnu/libc.so.6+0x3048a)
#​7 0x00007fbfe00c0502 (/lib/x86_64-linux-gnu/libc.so.6+0x30502)
#​8 0x00007fbfe38d4272 llvm::MemorySSAUpdater::fixupDefs(llvm::SmallVectorImplllvm::WeakVH const&) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x2e9d272)
#​9 0x00007fbfe38d2a88 llvm::MemorySSAUpdater::insertDef(llvm::MemoryDef*, bool) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x2e9ba88)
#​10 0x00007fbfe38dabda void llvm::MemorySSAUpdater::moveTollvm::MemorySSA::InsertionPlace(llvm::MemoryUseOrDef*, llvm::BasicBlock*, llvm::MemorySSA::InsertionPlace) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x2ea3bda)
#​11 0x00007fbfe2e74832 llvm::MergeBlockIntoPredecessor(llvm::BasicBlock*, llvm::DomTreeUpdater*, llvm::LoopInfo*, llvm::MemorySSAUpdater*, llvm::MemoryDependenceResults*, bool) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x243d832)
#​12 0x00007fbfe31f5ddb llvm::GVN::runImpl(llvm::Function&, llvm::AssumptionCache&, llvm::DominatorTree&, llvm::TargetLibraryInfo const&, llvm::AAResults&, llvm::MemoryDependenceResults*, llvm::LoopInfo*, llvm::OptimizationRemarkEmitter*, llvm::MemorySSA*) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x27beddb)
#​13 0x00007fbfe3202671 llvm::gvn::GVNLegacyPass::runOnFunction(llvm::Function&) GVN.cpp:0:0
#​14 0x00007fbfe2432ef8 llvm::FPPassManager::runOnFunction(llvm::Function&) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x19fbef8)
#​15 0x00007fbfe2439af1 llvm::FPPassManager::runOnModule(llvm::Module&) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x1a02af1)
#​16 0x00007fbfe243359c llvm::legacy::PassManagerImpl::run(llvm::Module&) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x19fc59c)
#​17 0x00007fbfe3a02813 llvm::lto::opt(llvm::lto::Config const&, llvm::TargetMachine*, unsigned int, llvm::Module&, bool, llvm::ModuleSummaryIndex*, llvm::ModuleSummaryIndex const*, std::vector<unsigned char, std::allocator > const&) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x2fcb813)
#​18 0x00007fbfe3a03152 llvm::lto::backend(llvm::lto::Config const&, std::function<std::unique_ptr<llvm::lto::NativeObjectStream, std::default_deletellvm::lto::NativeObjectStream > (unsigned int)>, unsigned int, llvm::Module&, llvm::ModuleSummaryIndex&) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x2fcc152)
#​19 0x00007fbfe39f798f llvm::lto::LTO::runRegularLTO(std::function<std::unique_ptr<llvm::lto::NativeObjectStream, std::default_deletellvm::lto::NativeObjectStream > (unsigned int)>) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x2fc098f)
#​20 0x00007fbfe39f6fe1 llvm::lto::LTO::run(std::function<std::unique_ptr<llvm::lto::NativeObjectStream, std::default_deletellvm::lto::NativeObjectStream > (unsigned int)>, std::function<std::function<std::unique_ptr<llvm::lto::NativeObjectStream, std::default_deletellvm::lto::NativeObjectStream > (unsigned int)> (unsigned int, llvm::StringRef)>) (web_emsdk_emsdk_linux.2.0.15-update9.zip/upstream/bin/../lib/libLLVM-13git.so+0x2fbffe1)
#​21 0x00000000006e7ad8 lld::wasm::BitcodeCompiler::compile() (/refs/emsdk/upstream/bin/wasm-ld+0x6e7ad8)
#​22 0x00000000006e94cb lld::wasm::SymbolTable::addCombinedLTOObject() (/refs/emsdk/upstream/bin/wasm-ld+0x6e94cb)
#​23 0x00000000006d4962 lld::wasm::(anonymous namespace)::LinkerDriver::linkerMain(llvm::ArrayRef<char const*>) Driver.cpp:0:0
#​24 0x00000000006ce656 lld::wasm::link(llvm::ArrayRef<char const*>, bool, llvm::raw_ostream&, llvm::raw_ostream&) (/refs/emsdk/upstream/bin/wasm-ld+0x6ce656)
#​25 0x00000000003a0e86 lldMain(int, char const**, llvm::raw_ostream&, llvm::raw_ostream&, bool) lld.cpp:0:0
#​26 0x00000000003a0a10 main (/refs/emsdk/upstream/bin/wasm-ld+0x3a0a10)
#​27 0x00007fbfe00b1bf7 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf7)
#​28 0x00000000003a06ea _start (/refs/emsdk/upstream/bin/wasm-ld+0x3a06ea)
em++: error: '/refs/emsdk/upstream/bin/wasm-ld -o

[tju-chenyaosuo]

Hi, this bug can also be reproduced on llvm-14.0.6.

$ cat a.c

int a, d;
short b;
long c;
void e() {
f : {
  int g;
  for (; 1; d++)
    ;
  if (g) {
    if (a)
      goto h;
  i:
    if (b)
    h:
      goto f;
  }
  if (c)
    goto i;
}
}
int main() {}

$ clang -v
clang version 14.0.6 (/data/src/llvm+clang-14.0.6/llvm-project/llvm/tools/clang f28c006)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /data/bin/llvm+clang-14.0.6/bin
Found candidate GCC installation: /opt/rh/devtoolset-7/root/usr/lib/gcc/x86_64-redhat-linux/7
Selected GCC installation: /opt/rh/devtoolset-7/root/usr/lib/gcc/x86_64-redhat-linux/7
Candidate multilib: .;@m64
Candidate multilib: 32;@m32
Selected multilib: .;@m64
Found CUDA installation: /usr/local/cuda, version 10.2

$ clang -O3 -mllvm -disable-llvm-optzns -c -emit-llvm a.c -o a.bc
$ opt -licm a.bc -o a.opt.bc
opt: /data/src/llvm+clang-14.0.6/llvm-project/llvm/lib/Analysis/MemorySSAUpdater.cpp:504: void llvm::MemorySSAUpdater::fixupDefs(const llvm::SmallVectorImplllvm::WeakVH&): Assertion `MSSA->dominates(NewDef, FirstDef) && "Should have dominated the new access"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0. Program arguments: /data/bin/llvm+clang-14.0.6/bin/opt -licm a.bc -o a.opt.bc
#0 0x0000000002f0d20f PrintStackTraceSignalHandler(void*) Signals.cpp:0:0
#1 0x0000000002f0acb9 SignalHandler(int) Signals.cpp:0:0
#2 0x00007f7567be8630 __restore_rt sigaction.c:0:0
#3 0x00007f75666d6387 raise /usr/src/debug/glibc-2.17-c758a686/signal/../nptl/sysdeps/unix/sysv/linux/raise.c:55:0
#4 0x00007f75666d7a78 abort /usr/src/debug/glibc-2.17-c758a686/stdlib/abort.c:92:0
#5 0x00007f75666cf1a6 __assert_fail_base /usr/src/debug/glibc-2.17-c758a686/assert/assert.c:92:0
#6 0x00007f75666cf252 (/lib64/libc.so.6+0x2f252)
#7 0x0000000001e3e44e llvm::MemorySSAUpdater::fixupDefs(llvm::SmallVectorImplllvm::WeakVH const&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x1e3e44e)
#8 0x0000000001e3e616 llvm::MemorySSAUpdater::insertDef(llvm::MemoryDef*, bool) (/data/bin/llvm+clang-14.0.6/bin/opt+0x1e3e616)
#9 0x0000000002c4a4a1 (anonymous namespace)::LoopPromoter::doExtraRewritesBeforeFinalDeletion() LICM.cpp:0:0
#10 0x0000000003080e86 llvm::LoadAndStorePromoter::run(llvm::SmallVectorImplllvm::Instruction* const&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x3080e86)
#11 0x0000000002c480d0 llvm::promoteLoopAccessesToScalars(llvm::SmallSetVector<llvm::Value*, 8u> const&, llvm::SmallVectorImplllvm::BasicBlock*&, llvm::SmallVectorImplllvm::Instruction*&, llvm::SmallVectorImplllvm::MemoryAccess*&, llvm::PredIteratorCache&, llvm::LoopInfo*, llvm::DominatorTree*, llvm::TargetLibraryInfo const*, llvm::Loop*, llvm::MemorySSAUpdater*, llvm::ICFLoopSafetyInfo*, llvm::OptimizationRemarkEmitter*, bool) (/data/bin/llvm+clang-14.0.6/bin/opt+0x2c480d0)
#12 0x0000000002c549a3 (anonymous namespace)::LoopInvariantCodeMotion::runOnLoop(llvm::Loop*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::BlockFrequencyInfo*, llvm::TargetLibraryInfo*, llvm::TargetTransformInfo*, llvm::ScalarEvolution*, llvm::MemorySSA*, llvm::OptimizationRemarkEmitter*, bool) (.part.811) LICM.cpp:0:0
#13 0x0000000002c55823 llvm::LICMPass::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x2c55823)
#14 0x00000000031e2c7d llvm::detail::PassModel<llvm::Loop, llvm::LICMPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x31e2c7d)
#15 0x0000000003741a32 llvm::Optionalllvm::PreservedAnalyses llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runSinglePass<llvm::Loop, std::unique_ptr<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&> > > >(llvm::Loop&, std::unique_ptr<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&> > >&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&, llvm::PassInstrumentation&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x3741a32)
#16 0x0000000003741c8e llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runWithoutLoopNestPasses(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x3741c8e)
#17 0x0000000003742f28 llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x3742f28)
#18 0x000000000374453d llvm::FunctionToLoopPassAdaptor::run(llvm::Function&, llvm::AnalysisManagerllvm::Function&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x374453d)
#19 0x00000000031e0eed llvm::detail::PassModel<llvm::Function, llvm::FunctionToLoopPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManagerllvm::Function >::run(llvm::Function&, llvm::AnalysisManagerllvm::Function&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x31e0eed)
#20 0x000000000266b64c llvm::PassManager<llvm::Function, llvm::AnalysisManagerllvm::Function >::run(llvm::Function&, llvm::AnalysisManagerllvm::Function&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x266b64c)
#21 0x0000000000bd8cbd llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManagerllvm::Function >, llvm::PreservedAnalyses, llvm::AnalysisManagerllvm::Function >::run(llvm::Function&, llvm::AnalysisManagerllvm::Function&) (/data/bin/llvm+clang-14.0.6/bin/opt+0xbd8cbd)
#22 0x000000000266b0c0 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManagerllvm::Module&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x266b0c0)
#23 0x000000000083487d llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManagerllvm::Module >::run(llvm::Module&, llvm::AnalysisManagerllvm::Module&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x83487d)
#24 0x0000000002669899 llvm::PassManager<llvm::Module, llvm::AnalysisManagerllvm::Module >::run(llvm::Module&, llvm::AnalysisManagerllvm::Module&) (/data/bin/llvm+clang-14.0.6/bin/opt+0x2669899)
#25 0x000000000083ec22 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRefllvm::StringRef, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool) (/data/bin/llvm+clang-14.0.6/bin/opt+0x83ec22)
#26 0x00000000007711e7 main (/data/bin/llvm+clang-14.0.6/bin/opt+0x7711e7)
#27 0x00007f75666c2555 __libc_start_main /usr/src/debug/glibc-2.17-c758a686/csu/../csu/libc-start.c:300:0
#28 0x0000000000832ec9 _start (/data/bin/llvm+clang-14.0.6/bin/opt+0x832ec9)
Aborted (core dumped)

[regehr]

fresh test case triggering this crash, in case anyone wants to work on it

regehr@john-home:~/alive2-regehr/build$ cat reduced.ll

define i20 @f(ptr %0, ptr %1, ptr %2, i20 %3, i1 %4) {
  %6 = alloca [0 x [0 x [0 x [0 x [0 x [0 x [0 x [0 x [3 x i8]]]]]]]]], i32 0, align 4
  %7 = alloca [3 x i8], align 4
  %8 = alloca [3 x i8], align 4
  %9 = alloca [3 x i8], align 4
  %10 = alloca [3 x i8], align 4
  %11 = alloca [3 x i8], align 4
  %12 = alloca [3 x i8], align 4
  %13 = alloca [3 x i8], align 4
  %14 = alloca [3 x i8], align 4
  br label %31

15:                                               ; preds = %78, %69, %69, %28, %25
  %16 = load i20, ptr %0, align 4
  store i20 0, ptr %14, align 4
  switch i20 %16, label %37 [
    i20 1, label %69
    i20 0, label %47
  ]

17:                                               ; preds = %74, %72, %69, %69, %69, %57, %34, %25
  %18 = load i20, ptr %2, align 4
  store i20 %18, ptr %6, align 4
  %.0..0..0..0..0. = load i20, ptr %14, align 4
  %19 = icmp sgt i20 %.0..0..0..0..0., 0
  br i1 %19, label %34, label %47

20:                                               ; preds = %84, %74, %67, %57, %47, %34, %25
  %21 = load i20, ptr %1, align 4
  store i20 %21, ptr %12, align 4
  %22 = load i20, ptr %0, align 4
  switch i20 %22, label %23 [
    i20 0, label %80
    i20 17, label %62
    i20 7, label %74
  ]

23:                                               ; preds = %69, %72, %54, %31, %20
  %.0..0..0..0..0.7 = load i20, ptr %7, align 4
  %24 = or i20 %.0..0..0..0..0.7, 1
  store i20 %24, ptr %7, align 4
  br label %72

25:                                               ; preds = %74, %69, %69, %47, %34, %25, %25
  %26 = load i20, ptr %6, align 4
  %27 = or i20 %26, 1
  store i20 %27, ptr %6, align 4
  %.0..0..0..0..0.3 = load i20, ptr %11, align 4
  switch i20 %.0..0..0..0..0.3, label %52 [
    i20 0, label %20
    i20 71, label %74
    i20 2, label %15
    i20 3, label %54
    i20 1, label %37
    i20 5, label %73
    i20 6, label %60
    i20 7, label %45
    i20 8, label %62
    i20 11, label %25
    i20 12, label %80
    i20 48, label %34
    i20 14, label %17
    i20 15, label %39
    i20 16, label %67
    i20 19, label %71
    i20 53, label %32
    i20 46, label %41
    i20 58, label %83
    i20 45, label %66
    i20 27, label %55
    i20 30, label %25
    i20 44, label %43
  ]

28:                                               ; preds = %78, %34, %28
  %.0..0..0..0..0.5 = load i20, ptr %9, align 4
  %29 = or i20 %.0..0..0..0..0.5, 1
  store i20 %29, ptr %9, align 4
  %30 = load i20, ptr %1, align 4
  switch i20 %30, label %31 [
    i20 0, label %28
    i20 1, label %66
    i20 12, label %43
    i20 4, label %39
    i20 5, label %67
    i20 19, label %32
    i20 7, label %80
    i20 23, label %15
    i20 9, label %83
    i20 10, label %52
    i20 11, label %84
  ]

31:                                               ; preds = %74, %69, %57, %28, %5
  store i20 0, ptr %0, align 4
  br label %23

32:                                               ; preds = %25, %74, %69, %57, %47, %43, %34, %28
  %33 = load i20, ptr %0, align 4
  store i20 %33, ptr %9, align 4
  br label %55

34:                                               ; preds = %74, %69, %57, %34, %25, %17
  %.0..0..0..0..0.1 = load i20, ptr %13, align 4
  %35 = or i20 %.0..0..0..0..0.1, 1
  store i20 %35, ptr %13, align 4
  %36 = load i20, ptr %0, align 4
  switch i20 %36, label %34 [
    i20 0, label %45
    i20 1, label %69
    i20 24, label %28
    i20 3, label %64
    i20 4, label %57
    i20 5, label %32
    i20 6, label %17
    i20 31, label %67
    i20 8, label %43
    i20 27, label %25
    i20 10, label %55
    i20 11, label %20
    i20 15, label %83
    i20 25, label %37
  ]

37:                                               ; preds = %69, %67, %57, %34, %25, %15
  %38 = load i20, ptr %0, align 4
  store i20 %38, ptr %6, align 4
  br label %80

39:                                               ; preds = %74, %69, %67, %47, %28, %25
  %40 = load i20, ptr %0, align 4
  store i20 %40, ptr %10, align 4
  br label %78

41:                                               ; preds = %74, %84, %69, %67, %25
  %42 = load i20, ptr %0, align 4
  store i20 %42, ptr %6, align 4
  br label %64

43:                                               ; preds = %84, %69, %57, %47, %45, %34, %28, %25
  %44 = load i20, ptr %0, align 4
  store i20 %44, ptr %6, align 4
  br label %32

45:                                               ; preds = %84, %74, %74, %69, %57, %34, %25
  %46 = load i20, ptr %0, align 4
  store i20 %46, ptr %11, align 4
  br label %43

47:                                               ; preds = %78, %74, %69, %69, %69, %67, %57, %55, %47, %17, %15
  %.0..0..0..0..0.2 = load i20, ptr %12, align 4
  %48 = or i20 %.0..0..0..0..0.2, 1
  store i20 %48, ptr %12, align 4
  %49 = load i20, ptr %0, align 4
  switch i20 %49, label %47 [
    i20 0, label %83
    i20 1, label %66
    i20 25, label %54
    i20 3, label %67
    i20 4, label %62
    i20 20, label %25
    i20 6, label %62
    i20 7, label %71
    i20 8, label %43
    i20 9, label %57
    i20 10, label %71
    i20 11, label %32
    i20 12, label %55
    i20 23, label %52
    i20 15, label %39
    i20 17, label %20
    i20 18, label %84
    i20 24, label %74
  ]

50:                                               ; preds = %74, %84, %69, %57
  %51 = load i20, ptr %0, align 4
  store i20 %51, ptr %6, align 4
  br label %80

52:                                               ; preds = %74, %62, %57, %47, %28, %25
  %53 = load i20, ptr %0, align 4
  store i20 %53, ptr %14, align 4
  br label %60

54:                                               ; preds = %74, %71, %69, %57, %47, %25
  store i20 0, ptr %0, align 4
  br label %23

55:                                               ; preds = %57, %84, %80, %78, %74, %69, %69, %67, %47, %34, %32, %25
  %56 = load i20, ptr %0, align 4
  store i20 %56, ptr %14, align 4
  br label %47

57:                                               ; preds = %84, %69, %67, %57, %47, %34
  %.0..0..0..0..0.4 = load i20, ptr %10, align 4
  %58 = or i20 %.0..0..0..0..0.4, 1
  store i20 %58, ptr %10, align 4
  %59 = load i20, ptr %0, align 4
  switch i20 %59, label %31 [
    i20 0, label %71
    i20 43, label %34
    i20 2, label %45
    i20 3, label %78
    i20 4, label %52
    i20 5, label %62
    i20 6, label %74
    i20 1, label %64
    i20 10, label %43
    i20 61, label %55
    i20 12, label %37
    i20 13, label %60
    i20 14, label %73
    i20 45, label %84
    i20 56, label %20
    i20 18, label %67
    i20 34, label %32
    i20 20, label %80
    i20 33, label %47
    i20 23, label %57
    i20 24, label %54
    i20 25, label %83
    i20 29, label %17
    i20 30, label %50
    i20 46, label %69
  ]

60:                                               ; preds = %84, %74, %74, %73, %66, %57, %52, %25
  %61 = load i20, ptr %0, align 4
  store i20 %61, ptr %14, align 4
  br label %84

62:                                               ; preds = %74, %69, %57, %47, %47, %25, %20
  %63 = load i20, ptr %0, align 4
  store i20 %63, ptr %13, align 4
  br label %52

64:                                               ; preds = %69, %57, %41, %34
  %.0..0..0..0..0.6 = load i20, ptr %8, align 4
  %65 = or i20 %.0..0..0..0..0.6, 1
  store i20 %65, ptr %8, align 4
  br label %69

66:                                               ; preds = %69, %47, %28, %25
  br label %60

67:                                               ; preds = %84, %83, %74, %69, %67, %57, %47, %34, %28, %25
  %68 = load i20, ptr %0, align 4
  store i20 %68, ptr %6, align 4
  switch i20 %68, label %39 [
    i20 18, label %67
    i20 1, label %41
    i20 17, label %55
    i20 3, label %57
    i20 4, label %80
    i20 5, label %47
    i20 6, label %37
    i20 7, label %20
    i20 0, label %73
  ]

69:                                               ; preds = %74, %74, %74, %69, %64, %57, %34, %15
  %70 = load i20, ptr %0, align 4
  store i20 %70, ptr %6, align 4
  switch i20 %70, label %78 [
    i20 0, label %62
    i20 1, label %57
    i20 2, label %72
    i20 3, label %39
    i20 6, label %73
    i20 9, label %17
    i20 72, label %41
    i20 11, label %55
    i20 14, label %67
    i20 71, label %25
    i20 18, label %47
    i20 19, label %31
    i20 70, label %17
    i20 24, label %47
    i20 25, label %72
    i20 26, label %80
    i20 27, label %64
    i20 28, label %37
    i20 29, label %80
    i20 30, label %47
    i20 31, label %17
    i20 32, label %55
    i20 33, label %54
    i20 34, label %25
    i20 35, label %15
    i20 36, label %80
    i20 37, label %34
    i20 38, label %15
    i20 69, label %23
    i20 40, label %45
    i20 41, label %74
    i20 42, label %66
    i20 61, label %83
    i20 50, label %50
    i20 64, label %43
    i20 46, label %32
    i20 47, label %69
  ]

71:                                               ; preds = %84, %74, %57, %47, %47, %25
  store i20 0, ptr %0, align 4
  br label %54

72:                                               ; preds = %74, %69, %69, %23
  br i1 %4, label %23, label %17

73:                                               ; preds = %84, %74, %74, %69, %67, %57, %25
  store i20 0, ptr %6, align 4
  br label %60

74:                                               ; preds = %78, %74, %69, %57, %47, %25, %20
  %75 = load i20, ptr %6, align 4
  %76 = or i20 %75, 1
  store i20 %76, ptr %6, align 4
  %77 = load i20, ptr %0, align 4
  switch i20 %77, label %31 [
    i20 0, label %45
    i20 54, label %73
    i20 2, label %78
    i20 3, label %69
    i20 4, label %52
    i20 1, label %72
    i20 8, label %80
    i20 9, label %60
    i20 10, label %60
    i20 11, label %78
    i20 12, label %34
    i20 13, label %73
    i20 68, label %25
    i20 15, label %17
    i20 16, label %83
    i20 17, label %39
    i20 18, label %67
    i20 19, label %45
    i20 20, label %74
    i20 21, label %54
    i20 22, label %69
    i20 23, label %69
    i20 24, label %32
    i20 67, label %47
    i20 64, label %41
    i20 58, label %71
    i20 66, label %62
    i20 63, label %84
    i20 34, label %55
    i20 48, label %20
    i20 57, label %50
  ]

78:                                               ; preds = %74, %74, %69, %57, %39
  %79 = load i20, ptr %0, align 4
  switch i20 %79, label %47 [
    i20 0, label %55
    i20 1, label %28
    i20 5, label %15
    i20 38, label %74
  ]

80:                                               ; preds = %84, %80, %74, %69, %69, %69, %67, %57, %50, %37, %28, %25, %20
  store i20 0, ptr %6, align 4
  %81 = load i20, ptr %0, align 4
  %82 = icmp eq i20 %81, 0
  br i1 %82, label %80, label %55

83:                                               ; preds = %74, %69, %57, %47, %34, %28, %25
  store i20 0, ptr %11, align 4
  br label %67

84:                                               ; preds = %84, %74, %60, %57, %47, %28
  %85 = load i20, ptr %6, align 4
  %86 = or i20 %85, 1
  store i20 %86, ptr %6, align 4
  switch i20 %3, label %73 [
    i20 0, label %43
    i20 1, label %80
    i20 18, label %41
    i20 24, label %67
    i20 5, label %84
    i20 6, label %45
    i20 8, label %50
    i20 23, label %55
    i20 13, label %20
    i20 14, label %57
    i20 15, label %60
    i20 16, label %71
  ]

; uselistorder directives
  uselistorder label %23, { 1, 0, 2, 3, 4 }
  uselistorder label %32, { 1, 2, 3, 4, 5, 6, 7, 0 }
  uselistorder label %41, { 1, 0, 2, 3, 4 }
  uselistorder label %50, { 1, 0, 2, 3 }
  uselistorder label %55, { 1, 2, 3, 4, 5, 6, 7, 0, 8, 9, 10, 11 }
}

; uselistorder directives
uselistorder i20 61, { 1, 0 }

regehr@john-home:~/alive2-regehr/build$ opt -O2 -o /dev/null reduced.ll
opt: /home/regehr/llvm-project/llvm/lib/Analysis/MemorySSAUpdater.cpp:504: void llvm::MemorySSAUpdater::fixupDefs(const llvm::SmallVectorImpl<llvm::WeakVH>&): Assertion `MSSA->dominates(NewDef, FirstDef) && "Should have dominated the new access"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: opt -O2 -o /dev/null reduced.ll
 #0 0x00007f9e8ce96246 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMSupport.so.17git+0x1da246)
 #1 0x00007f9e8ce93694 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007f9e8c874520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007f9e8c8c8a7c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #4 0x00007f9e8c8c8a7c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #5 0x00007f9e8c8c8a7c pthread_kill ./nptl/pthread_kill.c:89:10
 #6 0x00007f9e8c874476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #7 0x00007f9e8c85a7f3 abort ./stdlib/abort.c:81:7
 #8 0x00007f9e8c85a71b _nl_load_domain ./intl/loadmsgcat.c:1177:9
 #9 0x00007f9e8c86be96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#10 0x00007f9e8dae2e8a llvm::MemorySSAUpdater::fixupDefs(llvm::SmallVectorImpl<llvm::WeakVH> const&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMAnalysis.so.17git+0x39ae8a)
#11 0x00007f9e8dae312c llvm::MemorySSAUpdater::insertDef(llvm::MemoryDef*, bool) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMAnalysis.so.17git+0x39b12c)
#12 0x00007f9e8e5d5ce1 (anonymous namespace)::LoopPromoter::doExtraRewritesBeforeFinalDeletion() LICM.cpp:0:0
#13 0x00007f9e8e0b7093 llvm::LoadAndStorePromoter::run(llvm::SmallVectorImpl<llvm::Instruction*> const&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMTransformUtils.so.17git+0x252093)
#14 0x00007f9e8e5d8c1f llvm::promoteLoopAccessesToScalars(llvm::SmallSetVector<llvm::Value*, 8u> const&, llvm::SmallVectorImpl<llvm::BasicBlock*>&, llvm::SmallVectorImpl<llvm::Instruction*>&, llvm::SmallVectorImpl<llvm::MemoryAccess*>&, llvm::PredIteratorCache&, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::TargetLibraryInfo const*, llvm::TargetTransformInfo*, llvm::Loop*, llvm::MemorySSAUpdater&, llvm::ICFLoopSafetyInfo*, llvm::OptimizationRemarkEmitter*, bool, bool) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMScalarOpts.so.17git+0x1b1c1f)
#15 0x00007f9e8e5e42bb (anonymous namespace)::LoopInvariantCodeMotion::runOnLoop(llvm::Loop*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::TargetLibraryInfo*, llvm::TargetTransformInfo*, llvm::ScalarEvolution*, llvm::MemorySSA*, llvm::OptimizationRemarkEmitter*, bool) LICM.cpp:0:0
#16 0x00007f9e8e5e5a83 llvm::LICMPass::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMScalarOpts.so.17git+0x1bea83)
#17 0x00007f9e8fe21716 llvm::detail::PassModel<llvm::Loop, llvm::LICMPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMPasses.so.17git+0xae716)
#18 0x00007f9e8e656af5 llvm::FunctionToLoopPassAdaptor::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMScalarOpts.so.17git+0x22faf5)
#19 0x00007f9e8fe1e616 llvm::detail::PassModel<llvm::Function, llvm::FunctionToLoopPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMPasses.so.17git+0xab616)
#20 0x00007f9e940a22a4 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMAMDGPUCodeGen.so.17git+0x33b2a4)
#21 0x00007f9e8d29ce47 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMCore.so.17git+0x2f2e47)
#22 0x00007f9e94083c66 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMAMDGPUCodeGen.so.17git+0x31cc66)
#23 0x00007f9e8d29b12e llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMCore.so.17git+0x2f112e)
#24 0x00005631724f9761 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool) (/home/regehr/llvm-project/for-alive/bin/opt+0x35761)
#25 0x00005631724e440d main (/home/regehr/llvm-project/for-alive/bin/opt+0x2040d)
#26 0x00007f9e8c85bd90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#27 0x00007f9e8c85be40 call_init ./csu/../csu/libc-start.c:128:20
#28 0x00007f9e8c85be40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#29 0x00005631724e8895 _start (/home/regehr/llvm-project/for-alive/bin/opt+0x24895)
Aborted (core dumped)
regehr@john-home:~/alive2-regehr/build$ 

[regehr]

also, here's an llvm-reduced version of the originally reported test case

target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @e() {
entry:
  br label %for.cond

for.cond:                                         ; preds = %for.inc, %entry
  br i1 true, label %for.inc, label %for.end

for.inc:                                          ; preds = %for.cond
  %0 = load i32, ptr null, align 4
  store i32 %0, ptr null, align 4
  br label %for.cond

for.end:                                          ; preds = %for.cond
  br i1 false, label %if.then, label %if.end6

if.then:                                          ; preds = %for.end
  br i1 false, label %h, label %i

i:                                                ; preds = %if.end6, %if.then
  br i1 false, label %h, label %if.end6

h:                                                ; preds = %i, %if.then
  store i32 0, ptr null, align 4
  ret void

if.end6:                                          ; preds = %i, %for.end
  br i1 false, label %i, label %if.end9

if.end9:                                          ; preds = %if.end6
  store i32 0, ptr null, align 4
  ret void
}

regehr@john-home:~/alive2-regehr/build$ opt -passes=licm reduced.ll
WARNING: You're attempting to print out a bitcode file.
This is inadvisable as it may cause display problems. If
you REALLY want to taste LLVM bitcode first-hand, you
can force output with the `-f' option.

opt: /home/regehr/llvm-project/llvm/lib/Analysis/MemorySSAUpdater.cpp:504: void llvm::MemorySSAUpdater::fixupDefs(const llvm::SmallVectorImpl<llvm::WeakVH>&): Assertion `MSSA->dominates(NewDef, FirstDef) && "Should have dominated the new access"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: opt -passes=licm reduced.ll
 #0 0x00007f943b470246 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMSupport.so.17git+0x1da246)
 #1 0x00007f943b46d694 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007f943ae4e520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007f943aea2a7c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #4 0x00007f943aea2a7c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #5 0x00007f943aea2a7c pthread_kill ./nptl/pthread_kill.c:89:10
 #6 0x00007f943ae4e476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #7 0x00007f943ae347f3 abort ./stdlib/abort.c:81:7
 #8 0x00007f943ae3471b _nl_load_domain ./intl/loadmsgcat.c:1177:9
 #9 0x00007f943ae45e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#10 0x00007f943c0bce8a llvm::MemorySSAUpdater::fixupDefs(llvm::SmallVectorImpl<llvm::WeakVH> const&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMAnalysis.so.17git+0x39ae8a)
#11 0x00007f943c0bd12c llvm::MemorySSAUpdater::insertDef(llvm::MemoryDef*, bool) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMAnalysis.so.17git+0x39b12c)
#12 0x00007f943cbafce1 (anonymous namespace)::LoopPromoter::doExtraRewritesBeforeFinalDeletion() LICM.cpp:0:0
#13 0x00007f943c691093 llvm::LoadAndStorePromoter::run(llvm::SmallVectorImpl<llvm::Instruction*> const&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMTransformUtils.so.17git+0x252093)
#14 0x00007f943cbb2c1f llvm::promoteLoopAccessesToScalars(llvm::SmallSetVector<llvm::Value*, 8u> const&, llvm::SmallVectorImpl<llvm::BasicBlock*>&, llvm::SmallVectorImpl<llvm::Instruction*>&, llvm::SmallVectorImpl<llvm::MemoryAccess*>&, llvm::PredIteratorCache&, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::TargetLibraryInfo const*, llvm::TargetTransformInfo*, llvm::Loop*, llvm::MemorySSAUpdater&, llvm::ICFLoopSafetyInfo*, llvm::OptimizationRemarkEmitter*, bool, bool) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMScalarOpts.so.17git+0x1b1c1f)
#15 0x00007f943cbbe2bb (anonymous namespace)::LoopInvariantCodeMotion::runOnLoop(llvm::Loop*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::TargetLibraryInfo*, llvm::TargetTransformInfo*, llvm::ScalarEvolution*, llvm::MemorySSA*, llvm::OptimizationRemarkEmitter*, bool) LICM.cpp:0:0
#16 0x00007f943cbbfa83 llvm::LICMPass::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMScalarOpts.so.17git+0x1bea83)
#17 0x00007f943e3fb716 llvm::detail::PassModel<llvm::Loop, llvm::LICMPass, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMPasses.so.17git+0xae716)
#18 0x00007f943cc2dd2f std::optional<llvm::PreservedAnalyses> llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runSinglePass<llvm::Loop, std::unique_ptr<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>>>>(llvm::Loop&, std::unique_ptr<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>>>&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&, llvm::PassInstrumentation&) (.isra.0) LoopPassManager.cpp:0:0
#19 0x00007f943cc2df82 llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runWithoutLoopNestPasses(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMScalarOpts.so.17git+0x22cf82)
#20 0x00007f943cc2d72e llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMScalarOpts.so.17git+0x22c72e)
#21 0x00007f943e3fb6b6 llvm::detail::PassModel<llvm::Loop, llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMPasses.so.17git+0xae6b6)
#22 0x00007f943cc30af5 llvm::FunctionToLoopPassAdaptor::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMScalarOpts.so.17git+0x22faf5)
#23 0x00007f943e3f8616 llvm::detail::PassModel<llvm::Function, llvm::FunctionToLoopPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMPasses.so.17git+0xab616)
#24 0x00007f944267c2a4 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMAMDGPUCodeGen.so.17git+0x33b2a4)
#25 0x00007f943b876e47 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMCore.so.17git+0x2f2e47)
#26 0x00007f944265dc66 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::PreservedAnalyses, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMAMDGPUCodeGen.so.17git+0x31cc66)
#27 0x00007f943b87512e llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/regehr/llvm-project/for-alive/bin/../lib/libLLVMCore.so.17git+0x2f112e)
#28 0x000055d8ef505761 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool) (/home/regehr/llvm-project/for-alive/bin/opt+0x35761)
#29 0x000055d8ef4f040d main (/home/regehr/llvm-project/for-alive/bin/opt+0x2040d)
#30 0x00007f943ae35d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#31 0x00007f943ae35e40 call_init ./csu/../csu/libc-start.c:128:20
#32 0x00007f943ae35e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#33 0x000055d8ef4f4895 _start (/home/regehr/llvm-project/for-alive/bin/opt+0x24895)
Aborted (core dumped)
regehr@john-home:~/alive2-regehr/build$ 

[dtcxzyw]

Another reproducer: https://godbolt.org/z/3eG61zer6

define void @func(ptr %p) {
entry:
  br label %for.cond127

for.cond127:                                      ; preds = %for.cond127, %entry
  %0 = phi i8 [ 1, %entry ], [ 0, %for.cond127 ]
  store i8 %0, ptr %p, align 1
  br i1 false, label %for.end134, label %for.cond127

for.end134:                                       ; preds = %for.cond127
  br i1 false, label %lbl_173.i, label %safe_mod_func_uint16_t_u_u.exit.us.i

safe_mod_func_uint16_t_u_u.exit.us.i:             ; preds = %for.end134
  br i1 false, label %common.ret.loopexit.i, label %if.else76.i

lbl_173.i:                                        ; preds = %for.end134
  br i1 false, label %safe_mod_func_uint16_t_u_u.exit.i, label %cond.false.i.i

cond.false.i.i:                                   ; preds = %if.then.i, %lbl_173.i
  br label %safe_mod_func_uint16_t_u_u.exit.i

safe_mod_func_uint16_t_u_u.exit.i:                ; preds = %cond.false.i.i, %lbl_173.i
  br i1 false, label %if.then.i, label %if.else76.i

if.then.i:                                        ; preds = %safe_mod_func_uint16_t_u_u.exit.i
  br i1 false, label %common.ret.loopexit.i, label %cond.false.i.i

common.ret.loopexit.i:                            ; preds = %if.then.i, %safe_mod_func_uint16_t_u_u.exit.us.i
  store i16 0, ptr %p, align 2
  ret void

if.else76.i:                                      ; preds = %safe_mod_func_uint16_t_u_u.exit.i, %safe_mod_func_uint16_t_u_u.exit.us.i
  store i16 0, ptr %p, align 2
  ret void
}

cc @fhahn @topperc