<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/119063>119063</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [clang] Crash at -O2: Assertion `S1->getType() == S2->getType() && "Cannot create binary operator with two operands of differing type!"' failed.
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          cardigan1008
      </td>
    </tr>
</table>

<pre>
    This code crashes at O2/3:
```c
int a, b;
static int c;
static int *d = &c;
short e;
char g;
unsigned short h;
int *i;
int j(int k) {
  if (k & a)
    return 1;
  return 0;
}
int l(int k) {
  int f = j(k);
  return f;
}
void n() { int *m[] = {0, &d}; }
void o() {
  for (; g; g++) {
 int *p = &b;
    short *q = &e;
    int r = l(*d + 5);
    *p = 0;
    *q = *i || (unsigned short)(r + 22158 + 36566 + *d - 1641080165) + h;
 }
}
```

Compiler Explorer: https://godbolt.org/z/n7GPEKsxb

Bisected to https://github.com/llvm/llvm-project/commit/4eb98384099cbd1d901d8ef6a210af95d9c36adf, which was committed by @fhahn 

Crash: 
```
clang: /root/llvm-project/llvm/lib/IR/Instructions.cpp:2642: static llvm::BinaryOperator* llvm::BinaryOperator::Create(llvm::Instruction::BinaryOps, llvm::Value*, llvm::Value*, const llvm::Twine&, llvm::InsertPosition): Assertion `S1->getType() == S2->getType() && "Cannot create binary operator with two operands of differing type!"' failed.
```

Backtrace:
```
Stack dump:
0.      Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang -gdwarf-4 -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics -O2 -Wall -Wextra <source>
1.      <eof> parser at end of file
2.      Optimizer
3.      Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O2>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "<source>"
4.      Running pass "instcombine<max-iterations=1;no-verify-fixpoint>" on function "o"
 #0 0x0000000003c05148 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3c05148)
 #1 0x0000000003c02e54 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3c02e54)
 #2 0x0000000003b503b8 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007bfb65442520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007bfb654969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007bfb65442476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007bfb654287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007bfb6542871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x00007bfb65439e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x000000000351a1f3 (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x351a1f3)
#10 0x0000000003523d7c (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3523d7c)
#11 0x00000000037edc06 llvm::InstCombinerImpl::foldICmpBinOpEqualityWithConstant(llvm::ICmpInst&, llvm::BinaryOperator*, llvm::APInt const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x37edc06)
#12 0x0000000003810ac9 llvm::InstCombinerImpl::foldICmpInstWithConstant(llvm::ICmpInst&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3810ac9)
#13 0x0000000003819aad llvm::InstCombinerImpl::visitICmpInst(llvm::ICmpInst&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3819aad)
#14 0x0000000003775251 llvm::InstCombinerImpl::run() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3775251)
#15 0x0000000003776bc6 combineInstructionsOverFunction(llvm::Function&, llvm::InstructionWorklist&, llvm::AAResults*, llvm::AssumptionCache&, llvm::TargetLibraryInfo&, llvm::TargetTransformInfo&, llvm::DominatorTree&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::BranchProbabilityInfo*, llvm::ProfileSummaryInfo*, llvm::InstCombineOptions const&) (.isra.0) InstructionCombining.cpp:0:0
#16 0x000000000377805c llvm::InstCombinePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x377805c)
#17 0x0000000003ea39ae llvm::detail::PassModel<llvm::Function, llvm::InstCombinePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3ea39ae)
#18 0x00000000035b5920 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x35b5920)
#19 0x00000000010f19ce llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x10f19ce)
#20 0x00000000035b423b llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x35b423b)
#21 0x00000000010f105e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x10f105e)
#22 0x00000000035b3c40 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x35b3c40)
#23 0x0000000003eb5912 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#24 0x0000000003eb918d clang::EmitBackendOutput(clang::DiagnosticsEngine&, clang::HeaderSearchOptions const&, clang::CodeGenOptions const&, clang::TargetOptions const&, clang::LangOptions const&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3eb918d)
#25 0x00000000045875de clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x45875de)
#26 0x000000000654152c clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x654152c)
#27 0x00000000045879b8 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x45879b8)
#28 0x0000000004842b39 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4842b39)
#29 0x00000000047c27ce clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x47c27ce)
#30 0x000000000492db9e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x492db9e)
#31 0x0000000000cb21bf cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xcb21bf)
#32 0x0000000000ca9d5a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#33 0x00000000045cad09 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#34 0x0000000003b50864 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3b50864)
#35 0x00000000045cb2ff clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#36 0x000000000459149d clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x459149d)
#37 0x000000000459258d clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x459258d)
#38 0x0000000004599945 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4599945)
#39 0x0000000000caf003 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xcaf003)
#40 0x0000000000b82f64 main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xb82f64)
#41 0x00007bfb65429d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#42 0x00007bfb65429e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#43 0x0000000000ca9805 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xca9805)
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzkW1tz5Ka2_jX4hZJLQpeWHvwgt-2dyUnKrrH3zqMLIdTNNgIFkC_59acAqdVSt2fspJPKyZny2C0ua33rY7FYgBprzTaC0guQXoL06gz3ZivVBcGqZhssojDMzypZv108bJmGRNYUEoX1lmqIDbxFAN3EIC5BWIIs9D8EhCUTBmKA1rAC8SUIS22wYQTaYnJQAlBZQxBfQYCysXYrlYHUP5AtVnDjP_fC4a2hb7H1pYMUNj39F6Dc_n0CqIBgZYshZA0EKH-yeiy6whVCqKjplYCR7717Dv0zWF0NMvlRmcLAxqG3Km3VQkyzL-ZZshoKgPJBxGh_6-n3LKwuQ0sdQFlte8WXcK-znDo7LY1U1ijbauN_oUv3s2syqOhGiqsRIBxIBKj8daykU6Xtp1w5dzrtIKFLmO6ZCCfB4axslFcyCFZrsLLW5POxs2JQrpxMhKI0d5_iLM0y98kpDGCUJVGYh1GWOpPQ5TjmAynD79H57OewXMu2Y5wqeP3acamoAnEJt8Z02voqugHoZiPrSnJzLtUGoJvfALoRq3_dXf-Pfq28jEumKTG0hkYuuzKz7atzIluAbjh_Hv8EnZL_pcQAdENk2zL7IaFVkcd5EhYFqeqoLsKozmmTYRSFuCnSuiBxhuvGDvjLlpEtfMF2ntnuVnn1BkESNlu8FXCwzU4_a8_CbMKx2LhydKOkNIegRqisAujmy1f7S2ijemKYFPqcdB2IS5QlyEoZ5qfrE5cgLi-ZwOrttqMKG6kAKt-vc2VrRbGhAOVTsz11837amj-1-w_mPQWofL-USKHNXt3DCxMUoGze44vQVJk7qZlTaf22hKW2hUwKCLLwPgpAfL2h5uGto-PMiq-s896jI1VWg3VPtMZCSAOJMxJWzg4oBwLgCzNbaF6kLxG1hrKBNWsaqpjYQOMkRgAhgFawwYzT-vzQiy8xeTIKE7oIsCAs7w0mT7Du287XhecgLO6U3CjcQqw2fUuF0YM3yG5wSTcnAjrOCXTjfCbAIyM6MKoXTwDdVEyM1TDY1C9YNUECgw0MpJWIu87K7U3Xm3MNg9ZyDoPgNc8CrNtAvwmDX0F8xYShHAaNkMEzVZXU1NbD4B4GwYaQwEjJyRYzYUn_FlLbWAvc6a00MGiI5FIFNcMbIbVhRHsdbmmaF98iGPyCOYfBL_TVKAxBvNayV5bVaxCWkWUOxGsqGxBfww4rTZVd26io7ag1jFMQlsg2u-0Ma9lvVIGwjG3B114IO6Ad1tp6RdOLwbvXFG-oCph4tmpQ3nCJDWLCALTm8oWqwLkwFiZgwigmNCPa1cnOzhkpu0BJY2dQvN5SXFMV1H3HGcFewaWQQadohxUNGqkCbqTT5CQENeV09PmxiGmjWNXbOblmwsaEwHAWtLjrmNiMyoNnSoxU7DerWEiLjipO8bNTQ2gdSMHfvP5d00WVB8JEQ1WAOdsI642jfC5xHVDOWtdEGyLbyk7eeN3i14AZO4WsL4L4KhrVKNa8BQ177aRl0EnXrO04a95IswHxupKi14EVF5itonoreT0IaKR6waoO9AszZGtpr0F8OTwpLDY0MDJgxE6lsdjIgEv51HcewBOlFre0a8DlVjJtAhuhpXAatW_ky611OtBGKqoDGwacwqDBPTfMxudLzcTTsrvuKOk5NjSouCRPrmiwz_evFBZk6xVNjXvRKVozYnDFqR544XtDqABa-4dgpPkPke4GsBdKcg7i9S3ypUZhoRup2uAFKzsfLAwlMYjXnaKaqmcauGE67hV_FE-rNbZThpEWxGvMuXwZKXIz5dpPgp3KoFGytUGvbzuvZBBkR2bAM7IP0Lpmz4GibdBhpmxTgxknmPPBhT_sh0IGn3JFO9KH3jhzxZ3XLdzpo65oVfwhb_ymKxYAISgFbGXdc2rD4yz0IgTCMjkWRX-_Qzh9YxC2oqRXAwGKQxi-huO_mIRplOR7uYJ-0_7DnWLCuPX1wa29-wmMwi-PUhtFcTskGy6iFy4D_6MLLUCX4esAbNicABRHC9iIpskx2GtOsei7W3HPNgLz_XSbSyv8tCAtjAkkmoGs0jCucugS1a-UyGeq3jyqH7CoudWVD7zN2qylMPTVDIlo6P57-fEgf1U1VZYmCUpROJjjs9nXPHvMkoAz0b8GG9H7CnKu5XnmILsuE-BkLrDIiobAzk5ZXD8-Mc4_J931n6SnS7jJKoMb7Sj4LOxklU2Cs7lglK-aGOLKb-I-IdZ1nMSuDsRG1acFRtUkMJ8LjAtaZJ8T6LpMAouZg6URjpr4hP7sBXp1ds7NY0WK4npFTqnOCZzUzef4itYkzObbGLP28VB9aTvuSxvJ6y_rtrtk4ra7_rXHnJm3X5jZrofEcr71WredlXOwRzrY1s2ry7svwvjtlut6yijiDZ1omEeRPAoxKT5Mg639mPWnNMGDnEyIFyYUGNffNeGZaWYmiH8Nbotswp3MPXCVojT6Lm7V706yTucTTvUELF0AyyqSwSE52D-9uH2m6mbcfe1TOBUeHg6MvX-R6omzI5OjLL9S3XOjD-fFLn1cY7I9PHp4wGpDzU-sUli9fRGNfKfFw5g7H21zJVsm7Lx8UPRQx7AddYnRV9pi9XTtTo3U4SS3edyNor_2VJABzsKgS5fT3SlZ4YrZUHK01Z2SdkN837ftzq7ykNfBV259fr0MH-dMK3xuV2O4Nwi-DxObxfpvvSBbeEEepuS4yjus9b53fsARSoH5m2b6Zyzsnh3E6yOdbHZ56vDnzJhcfTUzkuK4wHQPZk3tzmMYBqz1z7Km_DjY98bDkfO7bLc__ydI9bRNpObzlbxKCxTu-7Ml8lsQ_9lseT4mtmZpVhQ2UUFO4YJ_Gsv_6NEZ-N-NDlpkpVWC4moP5s9un_0gR0iW9bLG3e5Efmmw7_Apc4cuf4orWnMmY6OlK4bp51xxtG79QYp-BwfvedLfidiBuolYtPCimCQfiYjH6PznsDTwMLE0T-RplRYRsuqwkOKtlb2GArdUd9hPUIfOZl-l1rSt-NsPlHd0mHdfe7Gfqt2xjnJ3FJuPd3Y2_8LkiYq63AVEbWpf0wv2a08fOzPnQuGXx-5FMUMfxxOpvU41ded8j-4igH6n4xBMs4-ofZCS37qLnxvm_eEjOhe99hUecmC3cH1L_Wa0gEPpvw3jh6khShYDVUR5vS_TDsogwQOY03413RVdi810ibjX5Ad3-3JPsSLbw4x21nQta_ovKr7Tymf-32n0ExabY00mTu-NYmLzlTbHYtx4T_oNB9tPEY3qNXumX2mzFuZuMeTPzZBS27G7f9OGtsPi-9f76Af85YTJpPOmKSjMNqNJmq_Smn4Lj3cfd-bp9nn-RuLfgi2csLx_GM4-Tx3XBpCTCbOdVJYmUYrIvgl3WGla3j_MAd7TFg_-V0nJp78nhDqAmaCulmwXVX5kspV77xNcv1LSGzr6-GnPJgYIE8DZ3iLJE1TFxT7AG2UHdTfl9hGeHJvXPmGbZfLJiqAVoXPyvLYv7rTMv2JwyN_7xpzaTz3CHf75bU1SoLoqZvgHpJMZz3K4GZ-hPjDzxCFiQDbhnqWtIalQVDWQkOixxWye_pRK4TcbveO1e8FtCPLlGOZmZWgNnyWrTw3f45vQozl6XNQphiPV6-jBzfk9G-5bzPl_3AWzPxY8Ysry2EtKPgS72blQrdgzVYcLfBzPwwDBdVg4MvaEjld-j8rx6Wr9FNtlnwRzXmHy9NgIC3NyEa94cJd1tJZti0W9nK1Hx223kkm3UOP5BmRan3dr167D4yN5fY0i_1BhzYhd59ytrKNw1tgWPBqFmdFj9UIc5ty6v93o7eptk3KK1M5xPOGuC0ArjtuqxgCtJqpQPl4W_iirI4ORLC_68mz_NvLYdd4uB77HDeVvMy6_PW4nXcs91snVF2s5qVDTwP_PbuFOZjusjD-ZPT7-2Zy1IkqK-l3W3Hjhg7VvpHIWqBcdbYP3MuNvNC1nScqeYafKAJzBkxMtUpQCpfmn6fhRVvp9Ln6U1U9Mm_e2AAfxdzf2HWZ22P0bZx-mb39j9ueRaGmaSMwXJBZFkr4H-Grv8ywFOLL2v0f-X0jiSbNPR8xEW7FYq5swjD3EMdcYYbvAUR5c1Ly3Ep8uu3CYdoiTWU4XVjlqsgRarKdT6YVOKqPFmw1FXXzyxRHXZRKIlgJpEsLHR9vnURuszOOeQR9WQfeOnpJ4mYTlYQq98FOOjRU7KB1fLD6rL-K6iAt8Ri-iVRynWYTi6Gx7URGEojjLM1RHSUMLVJMsXKVxlMdFmMT1GbtAIUoiFK7CPFlF0Xke5WFCsrBJmySLoxgkIW0x4-fW_86l2pwxrXt6EUVFmMVnHFeUa_clFIQGlAikV2fqwr3EXvUbDZKQM230JMIww903V3yP9Mq_TwSxgcEt-ju_7H3WK37x6W8VOMo0QDcDa88X6H8DAAD__6csHig">