Bug type: crash
Component: MemorySSAUpdater
Bug location: llvm/lib/Analysis/MemorySSAUpdater.cpp: MemorySSAUpdater::applyInsertUpdates
Issue title: [MemorySSA][LoopRotate] Assertion `!Paths.empty() && "Need a path to move"' failed.
Labels: crash-on-valid
llvm:analysis
generated by fuzzer
Reported by: dtcxzyw

This is a recent regression (llvm version 37fecfaa63eef7bd9dff9c16d74e61c99e3ce70a).
Reproducer: https://godbolt.org/z/9MGhvsKPb
```
> bin/opt -passes="loop-mssa(loop-instsimplify,loop-simplifycfg,licm<no-allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<nontrivial;trivial>)" test.ll -S
opt: /data/zyw/llvm-project/llvm/lib/Analysis/MemorySSA.cpp:783: {anonymous}::ClobberWalker::tryOptimizePhi(llvm::MemoryPhi*, llvm::MemoryAccess*, const llvm::MemoryLocation&)::<lambda(llvm::SmallVectorImpl<{anonymous}::ClobberWalker::TerminatedPath>&)>: Assertion `!Paths.empty() && "Need a path to move"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: ../llvm-build/bin/opt -passes=loop-mssa(loop-instsimplify,loop-simplifycfg,licm<no-allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<nontrivial;trivial>) test.ll -S
1.      Running pass "function(loop-mssa(loop-instsimplify,loop-simplifycfg,licm<no-allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<nontrivial;trivial>))" on module "test.ll"
2.      Running pass "loop-mssa(loop-instsimplify,loop-simplifycfg,licm<no-allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<nontrivial;trivial>)" on function "func_137"
 #0 0x00007ffff7dfebb2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/data/zyw/llvm-build/bin/../lib/libLLVMSupport.so.21.0git+0x1febb2)
 #1 0x00007ffff7dfbd1f llvm::sys::RunSignalHandlers() (/data/zyw/llvm-build/bin/../lib/libLLVMSupport.so.21.0git+0x1fbd1f)
 #2 0x00007ffff7dfbe64 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x00007ffff7842520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007ffff78969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007ffff7842476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007ffff78287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007ffff782871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x00007ffff7839e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x00007ffff3f85027 (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMAnalysis.so.21.0git+0x385027)
#10 0x00007ffff3f88c30 (anonymous namespace)::ClobberWalker::findClobber(llvm::BatchAAResults&, llvm::MemoryAccess*, (anonymous namespace)::UpwardsMemoryQuery&, unsigned int&) MemorySSA.cpp:0:0
#11 0x00007ffff3f898cc llvm::MemorySSA::ClobberWalkerBase::getClobberingMemoryAccessBase(llvm::MemoryAccess*, llvm::BatchAAResults&, unsigned int&, bool, bool) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMAnalysis.so.21.0git+0x3898cc)
#12 0x00007ffff3f8b01a llvm::MemorySSA::SkipSelfWalker::getClobberingMemoryAccess(llvm::MemoryAccess*, llvm::BatchAAResults&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMAnalysis.so.21.0git+0x38b01a)
#13 0x00007ffff4f91e6a getClobberingMemoryAccess(llvm::MemorySSA&, llvm::BatchAAResults&, llvm::SinkAndHoistLICMFlags&, llvm::MemoryUseOrDef*) LICM.cpp:0:0
#14 0x00007ffff4f99055 llvm::canSinkOrHoistInst(llvm::Instruction&, llvm::AAResults*, llvm::DominatorTree*, llvm::Loop*, llvm::MemorySSAUpdater&, bool, llvm::SinkAndHoistLICMFlags&, llvm::OptimizationRemarkEmitter*) (.part.0) LICM.cpp:0:0
#15 0x00007ffff4fa223a llvm::hoistRegion(llvm::DomTreeNodeBase<llvm::BasicBlock>*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::TargetLibraryInfo*, llvm::Loop*, llvm::MemorySSAUpdater&, llvm::ScalarEvolution*, llvm::ICFLoopSafetyInfo*, llvm::SinkAndHoistLICMFlags&, llvm::OptimizationRemarkEmitter*, bool, bool) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMScalarOpts.so.21.0git+0x1a223a)
#16 0x00007ffff4fa72e0 (anonymous namespace)::LoopInvariantCodeMotion::runOnLoop(llvm::Loop*, llvm::AAResults*, llvm::LoopInfo*, llvm::DominatorTree*, llvm::AssumptionCache*, llvm::TargetLibraryInfo*, llvm::TargetTransformInfo*, llvm::ScalarEvolution*, llvm::MemorySSA*, llvm::OptimizationRemarkEmitter*, bool) (.part.0) LICM.cpp:0:0
#17 0x00007ffff4faa26c llvm::LICMPass::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMScalarOpts.so.21.0git+0x1aa26c)
#18 0x00007ffff66887f5 llvm::detail::PassModel<llvm::Loop, llvm::LICMPass, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMPasses.so.21.0git+0x887f5)
#19 0x00007ffff5018914 std::optional<llvm::PreservedAnalyses> llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runSinglePass<llvm::Loop, std::unique_ptr<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>>>>(llvm::Loop&, std::unique_ptr<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete<llvm::detail::PassConcept<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>>>&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&, llvm::PassInstrumentation&) (.isra.0) LoopPassManager.cpp:0:0
#20 0x00007ffff5019c80 llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runWithoutLoopNestPasses(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMScalarOpts.so.21.0git+0x219c80)
#21 0x00007ffff5019e3b llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMScalarOpts.so.21.0git+0x219e3b)
#22 0x00007ffff66886d5 llvm::detail::PassModel<llvm::Loop, llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMPasses.so.21.0git+0x886d5)
#23 0x00007ffff501b958 llvm::FunctionToLoopPassAdaptor::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMScalarOpts.so.21.0git+0x21b958)
#24 0x00007ffff70ad865 llvm::detail::PassModel<llvm::Function, llvm::FunctionToLoopPassAdaptor, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0xad865)
#25 0x00007ffff3909a1d llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x309a1d)
#26 0x00007ffff70ad135 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0xad135)
#27 0x00007ffff39078d0 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x3078d0)
#28 0x00007ffff70adaf5 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0xadaf5)
#29 0x00007ffff390857d llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/data/zyw/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x30857d)
#30 0x00007ffff7f9ba9b llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/data/zyw/llvm-build/bin/../lib/libLLVMOptDriver.so.21.0git+0x23a9b)
#31 0x00007ffff7fa58ed optMain (/data/zyw/llvm-build/bin/../lib/libLLVMOptDriver.so.21.0git+0x2d8ed)
#32 0x00007ffff7829d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#33 0x00007ffff7829e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#34 0x0000555555555095 _start (../llvm-build/bin/opt+0x1095)
Aborted (core dumped)
```

Comments: author: dtcxzyw
body: Reduced:
```
; bin/opt -passes="loop-mssa(licm,loop-rotate,licm,simple-loop-unswitch<nontrivial>)" -verify-memoryssa test.ll -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @func_137(i1 %0) {
entry:
  br label %for.cond9

for.cond9:                                        ; preds = %for.inc519, %entry
  br i1 false, label %for.end521, label %for.cond23

for.cond23:                                       ; preds = %if.else229, %for.cond9
  %l_1344.1 = phi i32 [ %conv50, %if.else229 ], [ 0, %for.cond9 ]
  br i1 true, label %for.end494, label %for.cond29

for.cond29:                                       ; preds = %for.cond23
  store i32 0, ptr null, align 4
  %1 = load i32, ptr null, align 4
  %conv50 = xor i32 %1, %l_1344.1
  br i1 %0, label %if.else229, label %if.then204

if.then204:                                       ; preds = %for.cond29
  ret void

if.else229:                                       ; preds = %for.cond29
  br label %for.cond23

for.end494:                                       ; preds = %for.cond23
  br i1 false, label %for.inc519, label %for.end521

for.inc519:                                       ; preds = %for.end494
  br label %for.cond9

for.end521:                                       ; preds = %for.end494, %for.cond9
  ret void
}
```
```
opt: /home/dtcxzyw/WorkSpace/Projects/compilers/llvm-project/llvm/lib/Analysis/MemorySSA.cpp:2067: void llvm::MemorySSA::verifyOrderingDominationAndDefUses(IterT, VerificationLevel) const [with IterT = llvm::iterator_range<llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::BasicBlock, false, false, void, false, void>, false, false> >]: Assertion `dominates(MD, U) && "Memory Def does not dominate it's uses"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: bin/opt -passes=loop-mssa(licm,loop-rotate,licm,simple-loop-unswitch<nontrivial>) -verify-memoryssa test.ll -S
1.      Running pass "function(loop-mssa(licm<allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<nontrivial;trivial>))" on module "test.ll"
2.      Running pass "loop-mssa(licm<allowspeculation>,loop-rotate<header-duplication;no-prepare-for-lto>,licm<allowspeculation>,simple-loop-unswitch<nontrivial;trivial>)" on function "func_137"
 #0 0x00007dd7dd025f52 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMSupport.so.21.0git+0x225f52)
 #1 0x00007dd7dd022e2f llvm::sys::RunSignalHandlers() (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMSupport.so.21.0git+0x222e2f)
 #2 0x00007dd7dd022f74 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #3 0x00007dd7dca45330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
 #4 0x00007dd7dca9eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #5 0x00007dd7dca9eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
 #6 0x00007dd7dca9eb2c pthread_kill ./nptl/pthread_kill.c:89:10
 #7 0x00007dd7dca4527e raise ./signal/../sysdeps/posix/raise.c:27:6
 #8 0x00007dd7dca288ff abort ./stdlib/abort.c:81:7
 #9 0x00007dd7dca2881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#10 0x00007dd7dca3b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#11 0x00007dd7d43b84ef void llvm::MemorySSA::verifyOrderingDominationAndDefUses<llvm::iterator_range<llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::BasicBlock, false, false, void, false, void>, false, false>>>(llvm::iterator_range<llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::BasicBlock, false, false, void, false, void>, false, false>>, llvm::MemorySSA::VerificationLevel) const (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMAnalysis.so.21.0git+0x3b84ef)
#12 0x00007dd7d43b8c11 llvm::MemorySSA::verifyMemorySSA(llvm::MemorySSA::VerificationLevel) const (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMAnalysis.so.21.0git+0x3b8c11)
#13 0x00007dd7d49c96ce (anonymous namespace)::LoopRotate::rotateLoop(llvm::Loop*, bool) LoopRotationUtils.cpp:0:0
#14 0x00007dd7d49c9fbf llvm::LoopRotation(llvm::Loop*, llvm::LoopInfo*, llvm::TargetTransformInfo const*, llvm::AssumptionCache*, llvm::DominatorTree*, llvm::ScalarEvolution*, llvm::MemorySSAUpdater*, llvm::SimplifyQuery const&, bool, unsigned int, bool, bool) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMTransformUtils.so.21.0git+0x1c9fbf)
#15 0x00007dd7d583ff34 llvm::LoopRotatePass::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMScalarOpts.so.21.0git+0x23ff34)
#16 0x00007dd7d73ac765 llvm::detail::PassModel<llvm::Loop, llvm::LoopRotatePass, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libPolly.so.21.0git+0x1ac765)
#17 0x00007dd7d5834aed llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runWithoutLoopNestPasses(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMScalarOpts.so.21.0git+0x234aed)
#18 0x00007dd7d583459c llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMScalarOpts.so.21.0git+0x23459c)
#19 0x00007dd7d73ac815 llvm::detail::PassModel<llvm::Loop, llvm::PassManager<llvm::Loop, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager<llvm::Loop, llvm::LoopStandardAnalysisResults&>&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libPolly.so.21.0git+0x1ac815)
#20 0x00007dd7d5836395 llvm::FunctionToLoopPassAdaptor::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMScalarOpts.so.21.0git+0x236395)
#21 0x00007dd7dbcdaa45 llvm::detail::PassModel<llvm::Function, llvm::FunctionToLoopPassAdaptor, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0xdaa45)
#22 0x00007dd7d3d2a494 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x32a494)
#23 0x00007dd7dbcda315 llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0xda315)
#24 0x00007dd7d3d28d70 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x328d70)
#25 0x00007dd7dbcdacd5 llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMX86CodeGen.so.21.0git+0xdacd5)
#26 0x00007dd7d3d29365 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/../lib/libLLVMCore.so.21.0git+0x329365)
#27 0x00007dd7dd2712e9 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMOptDriver.so.21.0git+0x2c2e9)
#28 0x00007dd7dd27c306 optMain (/home/dtcxzyw/WorkSpace/Projects/compilers/LLVM/llvm-build/bin/../lib/libLLVMOptDriver.so.21.0git+0x37306)
#29 0x00007dd7dca2a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#30 0x00007dd7dca2a28b call_init ./csu/../csu/libc-start.c:128:20
#31 0x00007dd7dca2a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#32 0x000063062f7cd095 _start (bin/opt+0x1095)

Aborted (core dumped)
```
author: dtcxzyw
body: Bisected to 4d60c6d9b2c863d773aac9b59af8780e5ba23fcd
cc @arsenm @nikic 
author: dtcxzyw
body: Another reproducer:
```
; bin/opt -passes="loop-mssa(licm,loop-rotate,licm,simple-loop-unswitch<nontrivial>)" -verify-memoryssa test.ll -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @test(ptr %p, i1 %cond) {
entry:
  br label %for.header

for.header:
  br i1 false, label %exit.loopexit1, label %for.header2.preheader

for.header2.preheader:
  br label %for.body

for.header2:
  br i1 false, label %for.latch, label %for.body

for.body:
  store i32 0, ptr %p, align 4
  store i8 0, ptr %p, align 1
  br i1 %cond, label %for.header2, label %exit.loopexit

for.latch:
  br i1 false, label %for.inc, label %exit.loopexit1

for.inc:
  br label %for.header

exit.loopexit:
  br label %exit

exit.loopexit1:
  br label %exit

exit:
  ret void
}
```
author: dtcxzyw
body: I will post a patch later.

author: dtcxzyw
body: https://github.com/llvm/llvm-project/commit/4d60c6d9b2c863d773aac9b59af8780e5ba23fcd is correct. This is an iterator-invalidation bug in MemorySSA.


Fix patch:
commit 05f1e313948768fdd8527969cd79809cbd0654ff
Author: Yingwei Zheng <dtcxzyw2333@gmail.com>
Date:   Sat May 10 21:48:26 2025 +0800

    [MemorySSAUpdater] Fix iterator invalidation bug in `applyInsertUpdates` (#139370)
    
    This patch defers resetting optimized accesses until all uses are
    replaced, to avoid invalidating the iterator.
    
    Closes https://github.com/llvm/llvm-project/issues/139103.
    Closes https://github.com/llvm/llvm-project/issues/139289.
    Closes https://github.com/llvm/llvm-project/issues/139308.

diff --git a/llvm/lib/Analysis/MemorySSAUpdater.cpp b/llvm/lib/Analysis/MemorySSAUpdater.cpp
index aa9f0b6e100c..ecfecb03c375 100644
--- a/llvm/lib/Analysis/MemorySSAUpdater.cpp
+++ b/llvm/lib/Analysis/MemorySSAUpdater.cpp
@@ -1119,6 +1119,9 @@ void MemorySSAUpdater::applyInsertUpdates(ArrayRef<CFGUpdate> Updates,
     if (auto DefsList = MSSA->getWritableBlockDefs(BlockWithDefsToReplace)) {
       for (auto &DefToReplaceUses : *DefsList) {
         BasicBlock *DominatingBlock = DefToReplaceUses.getBlock();
+        // We defer resetting optimized accesses until all uses are replaced, to
+        // avoid invalidating the iterator.
+        SmallVector<MemoryUseOrDef *, 4> ResetOptimized;
         for (Use &U : llvm::make_early_inc_range(DefToReplaceUses.uses())) {
           MemoryAccess *Usr = cast<MemoryAccess>(U.getUser());
           if (MemoryPhi *UsrPhi = dyn_cast<MemoryPhi>(Usr)) {
@@ -1135,10 +1138,13 @@ void MemorySSAUpdater::applyInsertUpdates(ArrayRef<CFGUpdate> Updates,
                 assert(IDom && "Block must have a valid IDom.");
                 U.set(GetLastDef(IDom->getBlock()));
               }
-              cast<MemoryUseOrDef>(Usr)->resetOptimized();
+              ResetOptimized.push_back(cast<MemoryUseOrDef>(Usr));
             }
           }
         }
+
+        for (auto *Usr : ResetOptimized)
+          Usr->resetOptimized();
       }
     }
   }


Regression tests:
file: llvm/test/Analysis/MemorySSA/pr139103.ll
commands: opt -disable-output -passes="loop-mssa(licm,loop-rotate,licm,simple-loop-unswitch<nontrivial>),print<memoryssa>" -verify-memoryssa < %s 2>&1
tests: test_name: <module>
test_body: 
; Make sure that we update MSSA correctly in this case.


define void @test(ptr %p, i1 %cond) {
entry:
  br label %for.header

for.header:
  br i1 false, label %exit.loopexit1, label %for.header2.preheader

for.header2.preheader:
  br label %for.body

for.header2:
  br i1 false, label %for.latch, label %for.body

for.body:
  store i32 0, ptr %p, align 4
  store i8 0, ptr %p, align 1
  br i1 %cond, label %for.header2, label %exit.loopexit

for.latch:
  br i1 false, label %for.inc, label %exit.loopexit1

for.inc:
  br label %for.header

exit.loopexit:
  br label %exit

exit.loopexit1:
  br label %exit

exit:
  ret void
}