Bug type: crash
Component: LoopPeel
Bug location: llvm/lib/Transforms/Utils/LoopPeel.cpp: llvm::peelLoop
Issue title: [LoopPeel] Assertion `V && "Dereferencing deleted ValueHandle"' failed.
Labels: regression
crash
llvm:transforms
Reported by: rivertale

Crash is reproducible on Godbolt:
[https://godbolt.org/z/4axfWq4dq](https://godbolt.org/z/4axfWq4dq)

Reproduce code (compile with `clang-21 -O3 foo.c`):
```c
char func(char a, int b) {
    return b < 32 ? b : 0;
}

int a;
int b;
int main() {
    char v[4][4] = {};
    for (int i = 0; i < 33; i++) {
        for (int j = 0; j < 4; j++) {
            for (int k = 0; k < 4; k++) {
                a ^= v[0][k] - func(b ^= v[0][j], i);
            }
        }
    }
    return 0;
}

```

Stack dump:
```
 #0 0x0000000003c94d38 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3c94d38)
 #1 0x0000000003c92e7c llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3c92e7c)
 #2 0x0000000003be36d8 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x000074a5bf042520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x0000000005876204 (anonymous namespace)::VectorCombine::foldSingleElementStore(llvm::Instruction&) VectorCombine.cpp:0:0
 #5 0x00000000058805d9 (anonymous namespace)::VectorCombine::run()::'lambda'(llvm::Instruction&)::operator()(llvm::Instruction&) const (.isra.0) VectorCombine.cpp:0:0
 #6 0x0000000005881057 llvm::VectorCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x5881057)
 #7 0x0000000004e48f3e llvm::detail::PassModel<llvm::Function, llvm::VectorCombinePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x4e48f3e)
 #8 0x0000000003656ddf llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3656ddf)
 #9 0x00000000011b1a9e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x11b1a9e)
#10 0x0000000002bec20e llvm::CGSCCToFunctionPassAdaptor::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x2bec20e)
#11 0x00000000011b1f0e llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::CGSCCToFunctionPassAdaptor, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x11b1f0e)
#12 0x0000000002be55c6 llvm::PassManager<llvm::LazyCallGraph::SCC, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x2be55c6)
#13 0x0000000004e489ee llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::PassManager<llvm::LazyCallGraph::SCC, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x4e489ee)
#14 0x0000000002bed3e9 llvm::DevirtSCCRepeatedPass::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x2bed3e9)
#15 0x0000000004e48a0e llvm::detail::PassModel<llvm::LazyCallGraph::SCC, llvm::DevirtSCCRepeatedPass, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager<llvm::LazyCallGraph::SCC, llvm::LazyCallGraph&>&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x4e48a0e)
#16 0x0000000002be8043 llvm::ModuleToPostOrderCGSCCPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x2be8043)
#17 0x0000000004e489ce llvm::detail::PassModel<llvm::Module, llvm::ModuleToPostOrderCGSCCPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x4e489ce)
#18 0x000000000365991f llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x365991f)
#19 0x00000000054e64b9 llvm::ModuleInlinerWrapperPass::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x54e64b9)
#20 0x0000000004d00f8e llvm::detail::PassModel<llvm::Module, llvm::ModuleInlinerWrapperPass, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x4d00f8e)
#21 0x000000000365991f llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x365991f)
#22 0x0000000003f4491a (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#23 0x0000000003f47412 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3f47412)
#24 0x00000000045e01e8 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x45e01e8)
#25 0x000000000624133c clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-trunk/bin/clang+0x624133c)
#26 0x00000000045e0dbd clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-trunk/bin/clang+0x45e0dbd)
#27 0x00000000048f107a clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-trunk/bin/clang+0x48f107a)
#28 0x000000000486ca6b clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x486ca6b)
#29 0x00000000049e5683 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-trunk/bin/clang+0x49e5683)
#30 0x0000000000dcab25 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-trunk/bin/clang+0xdcab25)
#31 0x0000000000dc296d ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#32 0x0000000004652b59 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#33 0x0000000003be3af3 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-trunk/bin/clang+0x3be3af3)
#34 0x0000000004652d79 clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#35 0x00000000046159ed clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-trunk/bin/clang+0x46159ed)
#36 0x00000000046169b1 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-trunk/bin/clang+0x46169b1)
#37 0x00000000046212dc clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-trunk/bin/clang+0x46212dc)
#38 0x0000000000dc72b1 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-trunk/bin/clang+0xdc72b1)
#39 0x0000000000c47e24 main (/opt/compiler-explorer/clang-trunk/bin/clang+0xc47e24)
#40 0x000074a5bf029d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#41 0x000074a5bf029e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#42 0x0000000000dc2405 _start (/opt/compiler-explorer/clang-trunk/bin/clang+0xdc2405)
```

Comments: author: shafik
body: Looks like a regression on trunk: https://godbolt.org/z/d6P7cfxox
author: dtcxzyw
body: Reduced: https://godbolt.org/z/na9veEo6z
```
; bin/opt -passes="loop(loop-unroll-full)" test.ll -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define i32 @main(i32 %b.promoted) {
entry:
  br label %for.cond1.preheader

for.cond1.preheader:                              ; preds = %for.cond1.preheader, %entry
  %i.045 = phi i32 [ 0, %entry ], [ %inc21, %for.cond1.preheader ]
  %cmp.i.not = icmp eq i32 %i.045, 32
  %conv15 = select i1 %cmp.i.not, i32 0, i32 0
  %sub.3.3 = sub i32 0, 0
  %xor16.3.3 = xor i32 0, 0
  %inc21 = add i32 %i.045, 1
  %exitcond = icmp ne i32 %inc21, 33
  br i1 %exitcond, label %for.cond1.preheader, label %for.cond.cleanup

for.cond.cleanup:                                 ; preds = %for.cond1.preheader
  %xor.lcssa.lcssa.lcssa = phi i32 [ %b.promoted, %for.cond1.preheader ]
  ret i32 %xor.lcssa.lcssa.lcssa
}
```
```
opt: /root/llvm-project/llvm/include/llvm/IR/ValueHandle.h:95: llvm::Value& llvm::ValueHandleBase::operator*() const: Assertion `V && "Dereferencing deleted ValueHandle"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=loop(loop-unroll-full) <source>
1.	Running pass "function(loop(loop-unroll-full))" on module "<source>"
2.	Running pass "loop(loop-unroll-full)" on function "main"
 #0 0x0000000005628878 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5628878)
 #1 0x0000000005626204 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x0000784aa1a42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x0000784aa1a969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x0000784aa1a42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x0000784aa1a287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x0000784aa1a2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x0000784aa1a39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x0000000004875d88 llvm::peelLoop(llvm::Loop*, unsigned int, bool, llvm::LoopInfo*, llvm::ScalarEvolution*, llvm::DominatorTree&, llvm::AssumptionCache*, bool, llvm::ValueMap<llvm::Value const*, llvm::WeakTrackingVH, llvm::ValueMapConfig<llvm::Value const*, llvm::sys::SmartMutex<false>>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4875d88)
 #9 0x0000000004468359 tryToUnrollLoop(llvm::Loop*, llvm::DominatorTree&, llvm::LoopInfo*, llvm::ScalarEvolution&, llvm::TargetTransformInfo const&, llvm::AssumptionCache&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::ProfileSummaryInfo*, bool, int, bool, bool, bool, std::optional<unsigned int>, std::optional<unsigned int>, std::optional<bool>, std::optional<bool>, std::optional<bool>, std::optional<bool>, std::optional<bool>, std::optional<unsigned int>, llvm::AAResults*) LoopUnrollPass.cpp:0:0
#10 0x00000000044691af llvm::LoopFullUnrollPass::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x44691af)
#11 0x0000000002d9b20e llvm::detail::PassModel<llvm::Loop, llvm::LoopFullUnrollPass, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2d9b20e)
#12 0x000000000440d346 std::optional<llvm::PreservedAnalyses> llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runSinglePass<llvm::Loop, std::unique_ptr<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>>>>(llvm::Loop&, std::unique_ptr<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>>>&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&, llvm::PassInstrumentation&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x440d346)
#13 0x000000000440d4ee llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runWithoutLoopNestPasses(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x440d4ee)
#14 0x000000000440e854 llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x440e854)
#15 0x000000000440f35d llvm::FunctionToLoopPassAdaptor::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x440f35d)
#16 0x0000000000ea0b8e llvm::detail::PassModel<llvm::Function, llvm::FunctionToLoopPassAdaptor, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xea0b8e)
#17 0x000000000541eae0 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x541eae0)
#18 0x0000000000ea19fe llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xea19fe)
#19 0x000000000541eff3 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x541eff3)
#20 0x0000000000ea084e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xea084e)
#21 0x000000000541cc10 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x541cc10)
#22 0x0000000000956bba llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x956bba)
#23 0x000000000094a38c optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x94a38c)
#24 0x0000784aa1a29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#25 0x0000784aa1a29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#26 0x0000000000941fc5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x941fc5)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

Fix patch:
commit 4eac8daa38990871e50b804c0cc19a3ad9c98db2
Author: Yingwei Zheng <dtcxzyw2333@gmail.com>
Date:   Fri Jun 6 12:56:28 2025 +0800

    [LoopPeel] Handle non-local instructions/arguments when updating exiting values (#142993)
    
    Similar to
    https://github.com/llvm/llvm-project/commit/7e14161f49b32387988cf9d937bbfaa27d0fbdd5,
    the exiting value may be a non-local instruction or an argument.
    
    Closes https://github.com/llvm/llvm-project/issues/142895.

diff --git a/llvm/lib/Transforms/Utils/LoopPeel.cpp b/llvm/lib/Transforms/Utils/LoopPeel.cpp
index bd025fddd0cf..9149f71941db 100644
--- a/llvm/lib/Transforms/Utils/LoopPeel.cpp
+++ b/llvm/lib/Transforms/Utils/LoopPeel.cpp
@@ -1257,7 +1257,11 @@ bool llvm::peelLoop(Loop *L, unsigned PeelCount, bool PeelLast, LoopInfo *LI,
     // Now adjust users of the original exit values by replacing them with the
     // exit value from the peeled iteration and remove them.
     for (const auto &[P, E] : ExitValues) {
-      P->replaceAllUsesWith(isa<Constant>(E) ? E : &*VMap.lookup(E));
+      Instruction *ExitInst = dyn_cast<Instruction>(E);
+      if (ExitInst && L->contains(ExitInst))
+        P->replaceAllUsesWith(&*VMap[ExitInst]);
+      else
+        P->replaceAllUsesWith(E);
       P->eraseFromParent();
     }
     formLCSSA(*L, DT, LI, SE);


Regression tests:
file: llvm/test/Transforms/LoopUnroll/unroll-and-peel-last-iteration.ll
commands: opt -p loop-unroll -S %s
tests: test_name: pr142895_exit_value_is_inst
test_body: define i32 @pr142895_exit_value_is_inst(i32 %arg) {
entry:
  %mul = mul i32 %arg, 7
  br label %loop

loop:                                             ; preds = %loop, %entry
  %indvar = phi i32 [ 0, %entry ], [ %inc, %loop ]
  %cmp1 = icmp eq i32 %indvar, 32
  %sel = select i1 %cmp1, i32 0, i32 0
  %sub = sub i32 0, 0
  %xor = xor i32 0, 0
  %inc = add i32 %indvar, 1
  %exitcond = icmp ne i32 %inc, 33
  br i1 %exitcond, label %loop, label %exit

exit:                                             ; preds = %loop
  %exit.lcssa = phi i32 [ %mul, %loop ]
  ret i32 %exit.lcssa
}

test_name: pr142895_exit_value_is_arg
test_body: define i32 @pr142895_exit_value_is_arg(i32 %arg) {
entry:
  br label %loop

loop:                                             ; preds = %loop, %entry
  %indvar = phi i32 [ 0, %entry ], [ %inc, %loop ]
  %cmp1 = icmp eq i32 %indvar, 32
  %sel = select i1 %cmp1, i32 0, i32 0
  %sub = sub i32 0, 0
  %xor = xor i32 0, 0
  %inc = add i32 %indvar, 1
  %exitcond = icmp ne i32 %inc, 33
  br i1 %exitcond, label %loop, label %exit

exit:                                             ; preds = %loop
  %exit.lcssa = phi i32 [ %arg, %loop ]
  ret i32 %exit.lcssa
}