Bug type: crash
Component: InstCombine
Bug location: llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp: InstCombinerImpl::visitStoreInst
Issue title: clang crashes on valid code at -O1 and above on x86_64-linux-gnu: Assertion `hasUseList()' failed
Labels: regression
crash
llvm:instcombine
Reported by: zhendongsu

It appears to be a recent regression as it doesn't reproduce with the latest Compiler Explorer build. 

```
[515] % clangtk -v
clang version 22.0.0git (https://github.com/llvm/llvm-project.git 71c06d7a5f99ef7039b024d75cbdcddd71872602)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/11
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/12
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/12
Candidate multilib: .;@m64
Selected multilib: .;@m64
Found CUDA installation: /usr/local/cuda, version 12.1
[516] % 
[516] % clangtk -O1 small.c
clang-22: /local/suz-local/software/clangbuild/llvm-project/llvm/include/llvm/IR/Value.h:357: llvm::Value::use_iterator llvm::Value::materialized_use_begin(): Assertion `hasUseList()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O1 -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name small.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/local/suz-local/software/emitesting/bugs/20250723-clangtk-m64-O3-build-232105/delta -fcoverage-compilation-dir=/local/suz-local/software/emitesting/bugs/20250723-clangtk-m64-O3-build-232105/delta -resource-dir /local/home/suz/suz-local/software/local/clang-trunk/lib/clang/22 -I /usr/local/include -I /local/suz-local/software/local/include -internal-isystem /local/home/suz/suz-local/software/local/clang-trunk/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fmessage-length=100 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -fcolor-diagnostics -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/small-7ab6d0.o -x c small.c
1.	<eof> parser at end of file
2.	Optimizer
3.	Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<interleave-forced-only;vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O1>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "small.c"
4.	Running pass "instcombine<max-iterations=1;no-verify-fixpoint>" on function "e"
 #0 0x00005623f4e4ecd0 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x4215cd0)
 #1 0x00005623f4e4b97f llvm::sys::RunSignalHandlers() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x421297f)
 #2 0x00005623f4e4bad2 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x00007fc314aa6520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007fc314afa9fc __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x00007fc314afa9fc __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x00007fc314afa9fc pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x00007fc314aa6476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x00007fc314a8c7f3 abort ./stdlib/abort.c:81:7
 #9 0x00007fc314a8c71b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x00007fc314a9de96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x00005623f3d3b209 (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x3102209)
#12 0x00005623f4f40361 llvm::wouldInstructionBeTriviallyDead(llvm::Instruction const*, llvm::TargetLibraryInfo const*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x4307361)
#13 0x00005623f498607b llvm::InstCombinerImpl::run() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x3d4d07b)
#14 0x00005623f4987e0a combineInstructionsOverFunction(llvm::Function&, llvm::InstructionWorklist&, llvm::AAResults*, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::TargetTransformInfo&, llvm::DominatorTree&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::BranchProbabilityInfo*, llvm::ProfileSummaryInfo*, llvm::InstCombineOptions const&) InstructionCombining.cpp:0:0
#15 0x00005623f49891e0 llvm::InstCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x3d501e0)
#16 0x00005623f50eb566 llvm::detail::PassModel<llvm::Function, llvm::InstCombinePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x44b2566)
#17 0x00005623f47a67d7 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x3b6d7d7)
#18 0x00005623f1f212e6 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x12e82e6)
#19 0x00005623f47a6d49 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x3b6dd49)
#20 0x00005623f1f219d6 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x12e89d6)
#21 0x00005623f47a4af4 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x3b6baf4)
#22 0x00005623f50fa503 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#23 0x00005623f50feaf3 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x44c5af3)
#24 0x00005623f57f035f clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x4bb735f)
#25 0x00005623f72391fc clang::ParseAST(clang::Sema&, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x66001fc)
#26 0x00005623f5b0c1f9 clang::FrontendAction::Execute() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x4ed31f9)
#27 0x00005623f5a87ed5 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x4e4eed5)
#28 0x00005623f5bfc5b8 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0x4fc35b8)
#29 0x00005623f1aa5403 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0xe6c403)
#30 0x00005623f1a9b9ba ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#31 0x00005623f1aa0470 clang_main(int, char**, llvm::ToolContext const&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0xe67470)
#32 0x00005623f196d89b main (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0xd3489b)
#33 0x00007fc314a8dd90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#34 0x00007fc314a8de40 call_init ./csu/../csu/libc-start.c:128:20
#35 0x00007fc314a8de40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#36 0x00005623f1a9b0e5 _start (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-22+0xe620e5)
clangtk: error: unable to execute command: Aborted
clangtk: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.0.0git (https://github.com/llvm/llvm-project.git 71c06d7a5f99ef7039b024d75cbdcddd71872602)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
clangtk: note: diagnostic msg: 
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clangtk: note: diagnostic msg: /tmp/small-db824a.c
clangtk: note: diagnostic msg: /tmp/small-db824a.sh
clangtk: note: diagnostic msg: 

********************
[517] % 
[517] % cat small.c
int a, c, d;
static int *b;
int *e(int **f) {
  int g, *h = &g;
  d = *b;
  if (a)
    e(&h);
  return *f;
}
int main() {
  c = a - (a & 744049087);
  if (c > 1818615278) {
    int i, **j = &b;
    *j = &i;
  }
  return 0;
}
```

Comments: author: nikic
body: Reduced:
```llvm
define void @test(ptr %arg) {
  %a = alloca i32
  store ptr %a, ptr %arg
  store i1 true, ptr poison
  call void @llvm.lifetime.end.p0(i64 4, ptr %a)
  ret void
}
```
author: nikic
body: Fixed in https://github.com/llvm/llvm-project/commit/be6bed4dc6e346d316a910ee7cb742ece791d855. But if we encounter more variants of this, we'll need to allow poison in lifetime.start/end.

Fix patch:
commit be6bed4dc6e346d316a910ee7cb742ece791d855
Author: Nikita Popov <npopov@redhat.com>
Date:   Thu Jul 24 11:07:01 2025 +0200

    [InstCombine] Remove instructions before+after unreachable at same time
    
    There is no need to first remove the instructions before and then
    the ones after in two different worklist iterations. We don't need
    to worry about change reporting here, as the functions do that
    themselves.
    
    This avoids the issue in #150338, but not really in a principled
    way. It's possible that we will have to allow poison arguments
    to lifetime.start/lifetime.end again if this turns out to be a
    recurring problem.

diff --git a/llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp b/llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp
index 365a9b3aafc9..0be1034b046b 100644
--- a/llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstCombineLoadStoreAlloca.cpp
@@ -1502,8 +1502,7 @@ Instruction *InstCombinerImpl::visitStoreInst(StoreInst &SI) {
   // This is a non-terminator unreachable marker. Don't remove it.
   if (isa<UndefValue>(Ptr)) {
     // Remove guaranteed-to-transfer instructions before the marker.
-    if (removeInstructionsBeforeUnreachable(SI))
-      return &SI;
+    removeInstructionsBeforeUnreachable(SI);
 
     // Remove all instructions after the marker and handle dead blocks this
     // implies.


Regression tests:
file: llvm/test/Transforms/InstCombine/pr150338.ll
commands: opt -S -passes=instcombine < %s
tests: test_name: <module>
test_body: 
; Make sure this does not crash.
define void @test(ptr %arg) {
;
  %a = alloca i32
  store ptr %a, ptr %arg
  store i1 true, ptr poison
  call void @llvm.lifetime.end.p0(i64 4, ptr %a)
  ret void
}