<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/131281>131281</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [clang] Crash at -O2: Assertion `all_of(I->users()... "during expansion"' failed.
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          cardigan1008
      </td>
    </tr>
</table>

<pre>
    This code crashes at `-O2`:

```c
int a, b, c, d;
void e() {
  int *f = 0;
 for (;;)
    for (; c - 100 + d <= b; d++) {
      f[d + a] = 1;
      a = 1 + c - 100;
    }
}
void main() {}
```

Compiler Explorer: https://godbolt.org/z/P3f6ef98P

Bisected to https://github.com/llvm/llvm-project/commit/ddffb74afd870d284ba07f1cf6c67117a8ab8b33, which was committed by @artagnon 

Crash:

```console
clang: /root/llvm-project/llvm/lib/Transforms/Utils/ScalarEvolutionExpander.cpp:2402: void llvm::SCEVExpanderCleaner::cleanup(): Assertion `all_of(I->users(), [&InsertedSet](Value *U) { return InsertedSet.contains(cast<Instruction>(U)); }) && "removed instruction should only be used by instructions inserted " "during expansion"' failed.
```

Backtrace:

```c
Stack dump:
0.      Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang -gdwarf-4 -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics -O2 -Wall -Wextra <source>
1.      <eof> parser at end of file
2.      Optimizer
3.      Running pass "function<eager-inv>(float2int,lower-constant-intrinsics,loop(loop-rotate<header-duplication;no-prepare-for-lto>,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>,infer-alignment,loop-load-elim,instcombine<max-iterations=1;no-verify-fixpoint>,simplifycfg<bonus-inst-threshold=1;forward-switch-cond;switch-range-to-icmp;switch-to-lookup;no-keep-loops;hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>,slp-vectorizer,vector-combine,instcombine<max-iterations=1;no-verify-fixpoint>,loop-unroll<O2>,transform-warning,sroa<preserve-cfg>,infer-alignment,instcombine<max-iterations=1;no-verify-fixpoint>,loop-mssa(licm<allowspeculation>),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;switch-range-to-icmp;no-switch-to-lookup;keep-loops;no-hoist-common-insts;hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;speculate-unpredictables>)" on module "<source>"
4.      Running pass "loop-vectorize<no-interleave-forced-only;no-vectorize-forced-only;>" on function "e"
 #0 0x0000000003e7dc08 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3e7dc08)
 #1 0x0000000003e7b8c4 llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3e7b8c4)
 #2 0x0000000003dc0618 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007507d4042520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007507d40969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007507d4042476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007507d40287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007507d402871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x00007507d4039e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x0000000003fea367 llvm::SCEVExpanderCleaner::cleanup() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3fea367)
#10 0x000000000597bc1f (anonymous namespace)::GeneratedRTChecks::~GeneratedRTChecks() LoopVectorize.cpp:0:0
#11 0x00000000059d28c8 llvm::LoopVectorizePass::processLoop(llvm::Loop*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x59d28c8)
#12 0x00000000059d4e29 llvm::LoopVectorizePass::runImpl(llvm::Function&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x59d4e29)
#13 0x00000000059d54a3 llvm::LoopVectorizePass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x59d54a3)
#14 0x00000000055481fe llvm::detail::PassModel<llvm::Function, llvm::LoopVectorizePass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x55481fe)
#15 0x000000000381c880 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x381c880)
#16 0x00000000011a852e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x11a852e)
#17 0x000000000381b19b llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x381b19b)
#18 0x00000000011a764e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x11a764e)
#19 0x000000000381aba0 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x381aba0)
#20 0x000000000412e684 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>&, std::unique_ptr<llvm::ToolOutputFile, std::default_delete<llvm::ToolOutputFile>>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#21 0x0000000004132031 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>, std::unique_ptr<llvm::raw_pwrite_stream, std::default_delete<llvm::raw_pwrite_stream>>, clang::BackendConsumer*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4132031)
#22 0x0000000004837120 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4837120)
#23 0x000000000643be7c clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x643be7c)
#24 0x0000000004837528 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4837528)
#25 0x0000000004b00005 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4b00005)
#26 0x0000000004a8398e clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4a8398e)
#27 0x0000000004bedf9e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x4bedf9e)
#28 0x0000000000d5391f cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xd5391f)
#29 0x0000000000d4b2da ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#30 0x000000000487fa49 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#31 0x0000000003dc0ac4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x3dc0ac4)
#32 0x000000000488003f clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#33 0x00000000048426fd clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x48426fd)
#34 0x000000000484377e clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x484377e)
#35 0x000000000484b695 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0x484b695)
#36 0x0000000000d5076c clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xd5076c)
#37 0x0000000000c17ff4 main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xc17ff4)
#38 0x00007507d4029d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#39 0x00007507d4029e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#40 0x0000000000d4ad85 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+0xd4ad85)
```
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJzkWs1y4ziSfhr4goCCBCn-HHyQaXumOrqjHGVXz1EBgqCENQhwAVCW-7DPvgGQNEVZdtlT6o7dngqVbeEn88svE4kkCGIM30jGLsHyCiyvL0hnt0pfUqIrviEyDILsolTV8-XDlhtIVcUg1cRsmYHEQpAE6CsGSQCiFQj8Jwn6DwXBiksLCcAFLN0P6n5UILoCwWqneAUZwBnAOQSpa4LQDQd4VUMQXcOgHwhrpaEbF125D879SHjQDClEMAwCCPAVrCCICje9dD0VwFf-M-nwc8HyqvLDCVhee23hoM3_I32THzEIn7pBeu3M9D-9FQ3h8sCQvntkoSelUE3LBdPwZt8KpZkG0QpurW2N4w3fAny7UVWphF0ovQH49g-Ab--iOmF1nt31Mq64YdSyClp1PJXbbVcuqGoAvhViN_5CrVb_xagF-JaqpuHuj6qq6zKNSV1laVDhLC5JkNYhrROapGGYkoyUWRlFzlVPW0638Ik4t7vpTnn5DEEcEG3JRioJB_NcQJyIACWNEgwEKyqI3DibAb7VStnXAEfYvAT49kETaWqlGwPw7XfLhft9T4kg-manRGe5kjf7lsiK6QVtWxCtcBxgp8B7xAuLViBa3Rc3v48jC8GI9NSDaEXdl67t_eYmroxh2gl2MU2EWKsa4OwLAtFNZ5g2w0hcQLdQcPJFuvGsumcWLK8Bzn4nomMufL8PkQA1s52W8GDkgippCZdOGiXGgqj4Io3VHXWaQXQDcPbdq8ld-LpYcrJwAnACAcaaNWrHKsinSdBsVScqqKR4hiWDnem9dDDEuC8egpPh_led5nIDmWPGOM0YA5zCmnDBqsXr-L0i9NFqQtnpZX5vCX2EVde0fX-wAEF-p9VGkwYSvekaJq0Z_K_aISD9ikBsXBH41kcJIqMjDLK6k48A35ZugfXdEG2qJ6JrFEO0gUg5iaRtndzOtp1dGIga53-I0D5LEDENMs_Skj2Irrm0TEBUS4V2TJfKMNcP0T1EaEMpskoJunXLObp-F6kbbCRpzVZZiGqqhNKo4m5NGMup6XX4PDlv_ooh-hcRAqJ_sb3VLtEURnXaMXsDglXomANRwVQNohvYEm2YdomWyQqqGtbcryfshn1tLW_4H0yDYBW5hm-dlM6tLTHGebnu5BBXBSMbphGXuz7GaqGIxVxagAuhnphGbq1aIi3i0mouDafG9ym3RNwvpJUlloGo2DJSMY2qrhWckl7BlVSo1awlmqFaaSSs8pq8BFQxwfw4v4D6Jm6s5mVnGcAFly4LICs4akjbcrkZlaMdo1Zp_odTLJVDx7RgZOfVUFYhF_e9_pehR109EC5rphERfCNdNI7yhSIVYoI3foixVDUll05bQ_aIW6a9hQZE1-GoRvP6GdV83yrHoJdueNMKXj_TegOiolSyM8iJQ3armdkqUQ0CaqWfiK6QeeKWbh3tbkMcvmkiNwxZhTh1S2lstgoJpR67tgfwyJjDrdwOcLVV3Fjk8rOSXqPpB_XtzjqDjFWaGfTEba8Q1aQTlruMfGW4fDyeblpGO0EsQ6VQ9NE3Dfb180tNJN32iqbBnWw1qzi1pBTMDLyIAxdqgIv-Cxpp_inSvQM7qZUQICq-4r7VjpsHeiLarQcHQysCoqLVzDC9Y8i76XRU_CyexhjilgynDYgKIoR6GikaU7xbBC8qUa1V45Je17S9kkGQ88yAZ2Qf4KLiO6RZg1rC3Z5UWMIFJUIMIfzhOJQKfSoUnadfR-MsFF-i7iicPhqKTsVPReO7oZi7rU9J2KiqE26fxrPUizEIVvGpLHrWNOQhjHnZSWe9ZghwFMBgH4z_IpZWNMgOShnzbPo_7jSX1m-5D35Lxtk0SJOntTJWM9L4qqGAPsnnvlT-2b0X4KtgPwAbCnGAo_AIdpnR-BTsoq-4vsp7vpFEAJx10j96VFAoJ_y8IB2MCSSegaxokIQZ9GXrN0bVjunnHtU_iayE05UNvM3GFEpatrdDyRn4_738aJCfLoO0ioMYL3EwmNOXtPssWScxElx2e7SRXd9BF0YtEg_ZT5kAx3OBeZLXFLZuFZNq_ciF-Jx0P3-SvjyGG6cJ3BhPwWdhx2kyCU7mgnGW1hEkpdL2c2L9xEls-kpsWH5aYFhOArO5wChnefI5gX7KJDCfBVjNSJSkn34OOeMC6BH0-NwinSWXZZ6WNKydOiKVfG5UZ6AkDTOtTyh5j-0fTLqdj1XfHoot86nXNf_P6_Ye_a9Ktb-P2e9okTgM4RxDhTN6mOBm0--IGdS1WlFmzK9DKTobDvDqrLQNoCba8BHkmOH8x5B1J780rZjBvR2LcZeWzwvZgZogR0eQlzGJPgT5bbjFwfyVJOLZcPMbke6ZAkTFiUluqzu7mc6Qycx4ZuYyzsKaHcCsmKuMhg2TGPObqpg4DXZm3mt6_i3r3ef_Ba09cROty1key0KaZcEBTE_lexD_1mwNfExsJYdshSHJlvgcQfinsfy39s7A_-Sd9CiWyzAvD2D-5p8EHtQIybG-qkhrlT5tcD_hU-YOU_6UUHTmTMZmR6GYJvHnQnG0rvggRf8GB29F0v8lYgfqJmLzoygiJflIRjxF59-HpYGHF5bwrL6MQ8ySLP5RfXnTcLsyhjWleP4nE-1YE3_r5HC26c9M7njLhD8sysb3CCDyR9JMVquXhGhs1fd0kv93x9atnXPhHo3bJ80tW48PyAeTKuZPItb-qJL9YOKQTJOPqH1QSnz1R9O3vI-Hj-g8mnWo8DUHhZKma5wDfTU8tH63XLwuwnE4d1SEgyg8lMkabgcJPYA57eObrC_-uJiy16AKVbF_MO9Bf5p1FK73VnO5-cbqU5nGW3DKxNWJfe-LtLozfMe-sbqQ9u6I-F09lLaOwftnY1kzbIF_faR8wGtnW5qDT6elOXuGibMoDXHwHh7f2B-E-Bdx_cnld8mPQmF1_zAciJw7uwwgJxNmzzRJHJUspYcm3BFt2Or-YQ7wnjVkiL9SKTH9PiPUAcwENT5me4mzE8tjCOg-D-4Z7SwbY_y8JwEDhAngrMKPS__4dAjwVjunviy5Q4Rnx9Zrn7DN6umYZFGeMfhe9jnJ39vGnDtOe4QT_nTOLavqfIZ_QDqZsVPDG7QfJNkzp4ge2YR7VjwG1TLKwxpSGq6Huw0H1YbW5Nll76igW6Khf2_o8A1pbtaGC_8-_tzwe3wT-nyOPi5xReBIdRE--DV_YMN9Q4ToH_L9Mc0pU452LSdjSHbjOB9Klea7lzsIB9vs_DA_ztKaxPnx5YTxPcBaez5973ghYagBKRGiJPRxXUsHcwqRXvEQLkVYqKYhsjperSf99rKTKb9Fk_ljwLQ_v-xdLxPWa7rfh2H_pSSGU7fP-bc3nsLZYNewtppwa8buI3FECBf-7nHrpd8NWU2Z2gdOT7ifAnAqSFNWBOB0ogpn4xuEX1R5whnh8ek_mb2iOHXG_1KJ3pOaiecZl-_77axldo_1JdSjo708C4Kohv_JYeG4XrRE20Xwtv-jOWsxTurqTda8v8irvW-kcpaojya6AQfpoXhHx-HQ1axIOTDsXBWAN3gKoqMSJY7SlH2Wjl9Uad7m4hdV_sqNnXHxXv598X1LuHN7fzPlw_QdPh79eSQ6miYSl0cklkm-fAvw9cHfsxLgxN7_Fvl_IYlnrT49MRNtyVGlEaTJUMmPtcYI2yeO1bDsf7wTn7G6cJgmxLOaLqBhWtexv_N5PpW90Enl0dtJnFf5J98m-ymTwPxYIIsDuF67OWtjibbrA4M-rILFk4o4OCrCSJUtYS_8jL7xYgel4w3Ei-oyqvIoJxfsMkzjMI_COIovtpc5C1iS0ZQu8yTL6jgOlkvGyJJmUVlmZX3BL3GAl0EUup4gihdhlcQ0o0sW47BOlhmIA9YQLhYu_hZKby64MR27DKMQZ-GFICUTxt-cxnhAicHy-kJf-uutZbcxIA4EN9ZMIiy3wl-37mcsr_tLBpBYiL7ij99FXSwWP77LedFpcfnp68LeSgPw7WDo7hL_bwAAAP__mORp3A">