Bug type: crash
Issue title: llc crash: An asserting value handle still pointed to this value!
Labels: loopoptim
crash-on-valid
Reported by: shao-hua-li

llc crashed on the test case.

Bisected to https://github.com/llvm/llvm-project/commit/07292b7203e31fb90d9180bfccde0d4e84be2245, which was committed by @nikic 

Compiler explorer: https://godbolt.org/z/noEEWf5MM

```llvm
% cat reduced.ll
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @f() {
entry:
  br label %for.body

for.body:                                         ; preds = %for.body, %entry
  %0 = phi i64 [ %dec, %for.body ], [ 0, %entry ]
  %h.18 = phi i32 [ 1, %for.body ], [ 0, %entry ]
  %dec = add i64 %0, 1
  %rem = urem i64 %0, 5
  %1 = trunc i64 %rem to i32
  %tobool3.not = icmp eq i32 %h.18, %1
  br label %for.body
}
%
% llc reduced.ll
While deleting: i64 %dec
An asserting value handle still pointed to this value!
UNREACHABLE executed at /tmp/tmpi78wpw36/tmp3ncswa62/llvm/lib/IR/Value.cpp:1246!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.	Program arguments: /zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/llc reduced.ll
1.	Running pass 'Function Pass Manager' on module 'reduced.ll'.
2.	Running pass 'Loop Pass Manager' on function '@f'
3.	Running pass 'Loop Strength Reduction' on basic block '%for.body'
 #0 0x00007fdb13f166cf llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0x9516cf)
 #1 0x00007fdb13f13bf4 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007fdb131da090 (/lib/x86_64-linux-gnu/libc.so.6+0x43090)
 #3 0x00007fdb131da00b raise /build/glibc-wuryBv/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:51:1
 #4 0x00007fdb131b9859 abort /build/glibc-wuryBv/glibc-2.31/stdlib/abort.c:81:7
 #5 0x00007fdb13e26cde (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0x861cde)
 #6 0x00007fdb1416ae87 llvm::ValueHandleBase::ValueIsDeleted(llvm::Value*) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0xba5e87)
 #7 0x00007fdb1416b82d llvm::Value::~Value() (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0xba682d)
 #8 0x00007fdb1416b9a2 llvm::Value::deleteValue() (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0xba69a2)
 #9 0x00007fdb14096174 llvm::Instruction::eraseFromParent() (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0xad1174)
#10 0x00007fdb150ce4e3 llvm::RecursivelyDeleteTriviallyDeadInstructions(llvm::SmallVectorImpl<llvm::WeakTrackingVH>&, llvm::TargetLibraryInfo const*, llvm::MemorySSAUpdater*, std::function<void (llvm::Value*)>) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0x1b094e3)
#11 0x00007fdb150ce929 llvm::RecursivelyDeleteTriviallyDeadInstructions(llvm::Value*, llvm::TargetLibraryInfo const*, llvm::MemorySSAUpdater*, std::function<void (llvm::Value*)>) (.part.0) Local.cpp:0:0
#12 0x00007fdb150cece1 llvm::RecursivelyDeleteDeadPHINode(llvm::PHINode*, llvm::TargetLibraryInfo const*, llvm::MemorySSAUpdater*) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0x1b09ce1)
#13 0x00007fdb15001692 llvm::DeleteDeadPHIs(llvm::BasicBlock*, llvm::TargetLibraryInfo const*, llvm::MemorySSAUpdater*) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0x1a3c692)
#14 0x00007fdb15627243 ReduceLoopStrength(llvm::Loop*, llvm::IVUsers&, llvm::ScalarEvolution&, llvm::DominatorTree&, llvm::LoopInfo&, llvm::TargetTransformInfo const&, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::MemorySSA*) LoopStrengthReduce.cpp:0:0
#15 0x00007fdb15628b92 (anonymous namespace)::LoopStrengthReduce::runOnLoop(llvm::Loop*, llvm::LPPassManager&) LoopStrengthReduce.cpp:0:0
#16 0x00007fdb15e40dbb llvm::LPPassManager::runOnFunction(llvm::Function&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0x287bdbb)
#17 0x00007fdb140e9921 llvm::FPPassManager::runOnFunction(llvm::Function&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0xb24921)
#18 0x00007fdb140e9b69 llvm::FPPassManager::runOnModule(llvm::Module&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0xb24b69)
#19 0x00007fdb140ea412 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/../lib/libLLVM.so.19.0git+0xb25412)
#20 0x0000562c805e44c9 compileModule(char**, llvm::LLVMContext&) llc.cpp:0:0
#21 0x0000562c805da126 main (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/llc+0x11126)
#22 0x00007fdb131bb083 __libc_start_main /build/glibc-wuryBv/glibc-2.31/csu/../csu/libc-start.c:342:3
#23 0x0000562c805dac6e _start (/zdata/shaoli/compilers/ccbuilder-compilers/clang-07292b7203e31fb90d9180bfccde0d4e84be2245/bin/llc+0x11c6e)
[1]    2969443 abort       reduced.ll
```

This test case is reduced from the following C code:
```c
int a;
long b, c;
static long *d = &b, *e = &d;
void f() {
  long *g = &c;
  int h = {};
  int *i = &h;
  for (;;)
    for (; a;) {
      *i ^= --*d % (unsigned long)5;
      *i || (*g = 0);
      *i = 1;
      long *j = e;
      e == &j;
    }
}
int main() {}
```


Fix patch:
commit 6409c21857373bbb5563b37c3bacc066ad633658
Author: Nikita Popov <npopov@redhat.com>
Date:   Tue Mar 5 16:38:09 2024 +0100

    [SCEVExpander] Use PoisoningVH for OrigFlags
    
    It's common to delete some instructions after using SCEVExpander,
    while it is still live (but will not be used afterwards). In that
    case, the AssertingVH may trigger. Replace it with a PoisoningVH
    so that we only detect the case where the SCEVExpander actually is
    used in a problematic fashion after the instruction removal.
    
    The alternative would be to add clear() calls to more code paths.
    
    Fixes https://github.com/llvm/llvm-project/issues/83404.

diff --git a/llvm/include/llvm/Transforms/Utils/ScalarEvolutionExpander.h b/llvm/include/llvm/Transforms/Utils/ScalarEvolutionExpander.h
index 9de0996fb1e3..62c1e15a9a60 100644
--- a/llvm/include/llvm/Transforms/Utils/ScalarEvolutionExpander.h
+++ b/llvm/include/llvm/Transforms/Utils/ScalarEvolutionExpander.h
@@ -85,7 +85,7 @@ class SCEVExpander : public SCEVVisitor<SCEVExpander, Value *> {
 
   /// Original flags of instructions for which they were modified. Used
   /// by SCEVExpanderCleaner to undo changes.
-  DenseMap<AssertingVH<Instruction>, PoisonFlags> OrigFlags;
+  DenseMap<PoisoningVH<Instruction>, PoisonFlags> OrigFlags;
 
   // The induction variables generated.
   SmallVector<WeakVH, 2> InsertedIVs;


Regression tests:
file: llvm/test/Transforms/LoopStrengthReduce/X86/pr83404.ll
commands: opt -S -passes=loop-reduce -mtriple=x86_64-unknown-linux-gnu < %s
tests: test_name: <module>
test_body: 
; Make sure this does not assert.
define void @test() {
;
entry:
  br label %for.body

for.body:
  %0 = phi i64 [ %dec, %for.body ], [ 0, %entry ]
  %h.18 = phi i32 [ 1, %for.body ], [ 0, %entry ]
  %dec = add i64 %0, 1
  %rem = urem i64 %0, 5
  %1 = trunc i64 %rem to i32
  %tobool3.not = icmp eq i32 %h.18, %1
  br label %for.body
}