Fixes#173180
The crash occurs when a vector constant refines its value during
iterative analysis.
In `SCCPInstVisitor::visitCastInst`, the logic for folding constants
through a `CastInst` uses `markConstant`. This function is strictly
designed for initial assignments and contains an assertion that prevents
a lattice element from being updated with a different constant pointer.
During the analysis of loops or complex data flows, a vector constant
may "refine." For example:
First Pass: SCCP identifies a value as `<4 x i64> {poison, poison,
poison, 0}`.
Second Pass: The value refines to `<4 x i64> zeroinitializer`.
Because these are distinct `Constant*` objects, `markConstant` triggers
a `"Marking constant with different value"` assertion failure.
The call to `markConstant` is replaced with `mergeInValue`. Unlike the
former, `mergeInValue` is lattice-aware, it allows for valid refinement
(moving from a less-defined to a more-defined state) and gracefully
handles transitions to Overdefined if a true conflict occurs. This
brings BitCast handling in line with how Trunc and Ext instructions are
already safely handled in the same pass.
Co-authored-by: Milos Poletanovic <mpoletanovic@syrmia.com>
991455e69e