<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/140442>140442</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [LoopUnroll] Assertion `New && "Value::replaceAllUsesWith(<null>) is invalid!"' failed.
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            loopoptim,
            crash-on-valid,
            generated by fuzzer
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          dtcxzyw
      </td>
    </tr>
</table>

<pre>
    Reproducer: https://godbolt.org/z/ahxqn68Mn
```
; bin/opt -passes="loop-unroll<O3>" reduced.ll -S
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define i32 @main() {
entry:
  br label %for.cond52.preheader.i.i

for.cond52.preheader.i.i: ; preds = %for.end213.i.i, %entry
  %p_158.addr.0380.i.i1 = phi i16 [ 0, %entry ], [ %inc215.i.i, %for.end213.i.i ]
  %0 = icmp eq i16 %p_158.addr.0380.i.i1, -1
  br label %for.body136.i.i

for.body136.i.i: ; preds = %for.end54.preheader.peel.i.i.i, %for.cond52.preheader.i.i
  %1 = add i32 0, 0
  br i1 %0, label %for.end54.preheader.peel.i.i.i, label %for.end54.preheader.peel.i.i.i

for.end54.preheader.peel.i.i.i: ; preds = %for.body136.i.i, %for.body136.i.i
  br i1 true, label %for.end213.i.i, label %for.body136.i.i

for.end213.i.i: ; preds = %for.end54.preheader.peel.i.i.i
  %inc215.i.i = add i16 %p_158.addr.0380.i.i1, 1
  %exitcond387.not.i.i = icmp eq i16 %inc215.i.i, 0
  br i1 %exitcond387.not.i.i, label %for.end141.peel.i.i, label %for.cond52.preheader.i.i

for.end141.peel.i.i: ; preds = %for.end213.i.i
  ret i32 %1
}
```
```
opt: /root/llvm-project/llvm/lib/IR/Value.cpp:516: void llvm::Value::doRAUW(llvm::Value*, llvm::Value::ReplaceMetadataUses): Assertion `New && "Value::replaceAllUsesWith(<null>) is invalid!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=loop-unroll<O3> <source>
1.      Running pass "function(loop-unroll<O3>)" on module "<source>"
2.      Running pass "loop-unroll<O3>" on function "main"
 #0 0x00000000055c5a48 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x55c5a48)
 #1 0x00000000055c33d4 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x000078c7a1842520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x000078c7a18969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x000078c7a1842476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x000078c7a18287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x000078c7a182871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #7 0x000078c7a1839e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #8 0x00000000053f248a (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x53f248a)
 #9 0x0000000004830404 llvm::peelLoop(llvm::Loop*, unsigned int, bool, llvm::LoopInfo*, llvm::ScalarEvolution*, llvm::DominatorTree&, llvm::AssumptionCache*, bool, llvm::ValueMap<llvm::Value const*, llvm::WeakTrackingVH, llvm::ValueMapConfig<llvm::Value const*, llvm::sys::SmartMutex<false>>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4830404)
#10 0x0000000004424eb9 tryToUnrollLoop(llvm::Loop*, llvm::DominatorTree&, llvm::LoopInfo*, llvm::ScalarEvolution&, llvm::TargetTransformInfo const&, llvm::AssumptionCache&, llvm::OptimizationRemarkEmitter&, llvm::BlockFrequencyInfo*, llvm::ProfileSummaryInfo*, bool, int, bool, bool, bool, std::optional<unsigned int>, std::optional<unsigned int>, std::optional<bool>, std::optional<bool>, std::optional<bool>, std::optional<bool>, std::optional<bool>, std::optional<unsigned int>, llvm::AAResults*) LoopUnrollPass.cpp:0:0
#11 0x0000000004427b27 llvm::LoopUnrollPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4427b27)
#12 0x0000000002d6a54e llvm::detail::PassModel<llvm::Function, llvm::LoopUnrollPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x2d6a54e)
#13 0x00000000053bcd00 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x53bcd00)
#14 0x0000000000e8bbee llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe8bbee)
#15 0x00000000053bd213 llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x53bd213)
#16 0x0000000000e8aa3e llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xe8aa3e)
#17 0x00000000053bae30 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x53bae30)
#18 0x000000000094c2aa llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x94c2aa)
#19 0x000000000093fa7c optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x93fa7c)
#20 0x000078c7a1829d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#21 0x000078c7a1829e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#22 0x0000000000937695 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x937695)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```
llvm version: 3ccb15d6caf57f2a866d496ada2fb52d14b179d2
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJzcWV1T2zrz_zTiRpOMLfn1IhcmkHM6__IvQ2h7yciWnOhBllxZptBP_4xkB78QONBynum0kxLH0v5297erXVkmTcN3krEVCE9BeHZCWrNXekVNcf_j4ftJrujD6orVWtG2YBrgDO6NqRuAM4A2AG12iuZKmKXSO4A2PwDakP39NxklFxJ4GYi8_uNlAJ_CnEuANqo2cFGTpmENwGcAIaFUvWilVkIAvP6EAT4HCEHNrFK6FAIutsDLDNE7ZiAlhgjyoFoDAT6DACG2qADO2KJGsQdwhpH7Y3_605_2KgrcnwV_vPBRAnDmo2RRJl5_Jd2t6CAeBYutnYbQYIfRvBbsYMN9Et1EwaKVt1J9lwvBZXu_2Mm2EwFeRlnJJYMcIwgCryKWigSgFIL4FHgZk0Y_WFq9DMJcQ0FyJiBAYan0slCShmhZa7ZnhDK95EveoT47ijNoGa81o01vo4NikiIfuylobW92iq1WgML6xg-TJaFULz2ceHaa76TrPYfcjyAIT6E3loQgPHO_w1N7j8sC-eEIfqrTze51eQ6YF1UN2bcO_LgBFmnhHyXG5qePoykf45sv0BAGI8pqxoQVmNj9DO3O-o4WQqmLqKPEO5hoOUOhuzex9mWlr5366OcLc55ze0zN4OeUxYMLRrfsmF2j9PnnWIzm_0Qoeq6HpBpIfzld_IMou-fGhhEn8VIq84gxS7tp2s4CeQTjGC9-4D_a_mT85RU8l37F4rUWama6eoJC6zCIz-Y1d3StauNw0UYrZQDaCHFXLWqt_sOKw0_7xXOANh-uANp8IaJly6KuAc5CVwvhneIUupk4AzhzM7pLqq6yz18BSuajKHNkHJO5YrUgBbtghtii_tk2BJRaPVnTMG24khBE3v-z7xCgCCAbKjSS1518JoQV_crN3pZUvJatbSTntrjyBnJ5RwSnAPm2FqMYloQLRpfAyy4_nmfbc9i0ecUNJDBvd1CzWmkDjZp3Om72bb4sVDUia0ohb5rWurCBRFLIZSFayqDZM1ho0uxhTopbo0nBrO6tIcUtpG1Vd1XfWwIvvdRqp0kFid61FZOm6UNmg4c2hapqLphesPtaKM20vSeI3C3Iga9mYXQrbwHajHqtshCkru3v1tStWTZwsR314CMNGAK8blSrC2aZ9DLfmnfVSsnlDlpBG4uylYXVasN-rIento0rCStFW9sqEZqgutaIjgE_syNQEh5U2lldE7UgECDsQe_eO_wLwyIkQTLKu-ah6S4uNZfGsX9tYzFJWU2-36jGaEYql3FryKVxTdr26l8KA0Cn3n1vlmWmM9qfGY0xDeCW7yQRfxNJhQVPnA1r2PAdl6W6Mf2asovRXaa9RNMvVs_97xSgXkGcFDHxkwCFyOu96ZZ6v3EZbVjsQLFs1DJyNjuRwWI8BUyjtCxgbfaaEXpzy4V4G7qTH9CDublBHMFd49x7q9lBHA3A4RQYJXGJIcntUn8TrBMcYKMnsH7-ZkA_HwDjKSBOWRq9DdCJDIDJJMNwiYKEvFs6d3CDsnSsLEiwF3jBaA3aBvdRqXqy5robLqNb6Z5GKOwzPldKTLuHnfxBlupJW9kWRBB9fqdE21Wk2fiZqrgkRulrzVi_tofRrGnaqraCa1LsD03rqXrXfC5IDfB6dhMWSjbmidqvjLgyc8vl7svfx8HWSpZ892rIx0K2rYg2F61h9wCvSyIaV1S7j3Xw3apWH8guzLZoTUptEKCA5Sk0-uFafXY1-6UYvzYkr4_0TPDaPZ5dayKbUunKYhyY_Keoz8Y_1YZX_AexM65YRfTtecWNsdTNZp4KVdxuNPvWMlk8HDX7UquSC7Ztq4ro8ZRDls1yfv7dGNoBKWcxsY1xsl5s1H9pmtP0ew4f8WAUxuyKNa0wTd8MbeZ0eXhJmnlPtOnrz9I3zlE8y7xBvt8YtHKS0JvHnc88pyQRDw1vLogkO6Ynq_pR6N0XaOfDsEDR2ENEIxIGbGQkZYZw0eclaZoLRZk4buqTNTli5qcct5_fn9Ges4FRPG2jeUE9b7y6LYsvGfgHc9WzMXAVjLnyWJLn7D2y71_j-A-OTUf-EJpwlsYU-Xhk44V7ULtWB3ss5RkltVH6uLedwJt87UX-hSy0zgyuRrMsJAS_LQsPvq1fSdBPMPBcEv0-tHa8DazGswQiDL-mDh7j8k-hqGdh4GjyyOWlQYEIGZmoW5c2l7xmgsvpAcTWaC53V6w8lnbPbHUvSLF3ONmx0Y881_2G80NVi6ezlBKf3KnQhosjIL80_Iw7mdbkwd4dR8dxItodl09r8jD_cXf4ePaE1-5UckKjxTptuaD9Xj09VulVbW6M23e6zb7z4v-4pC_N-sI0LznTh3nP7dZf_n631Otya8i8dJp5uCRxAVVtLgiX76bToT7qRN7sCCSl6RtPmJzIAOjPAVngwZsbK3PTGKLNTTW482oVLBipQDOe4igNYQf-fjRZ0E7l4VjXMO0eeRmF37nZw-5cC-AMbj_8tT3_6wvwsnWvEmpmWi2ZTXfo43R2nG8TFN4x3bglkEFcFLkf0qggZRiXiCRRRIM0IpSgMg8R9YPcj1OKTugK0xSn5ISt_DiIwzCMgvRkv_JLUvgpIRHxc4KxH1KW-Gla-gxHQcq8E75CHgq90E-8xItRumQxDknp0xCnUVGwHAQeqwgXS2vbUundiTsQX_mBfcg6ce9DGveiuTvgtc93lTuTXwOE3BH5QslFf1rf394xybRjLH-AZfvjh40BAuHZiV654_e83TUg8ARvTDNoNtwI91J7eGQB4dn_5L3CSavF6uffHfRs3a3QfwMAAP__YjSXmQ">