During type legalization, `ReplaceValueWith` handles morphed nodes by
computing `OldValId` and `NewValId`, calling `ReplaceAllUsesOfValueWith`
(RAUW), then adding `ReplacedValues[OldValId] = NewValId`.
However, the RAUW call can trigger `CSE`, which fires NoteDeletion
callbacks that add new entries to `ReplacedValues`. If NoteDeletion adds
`ReplacedValues[A] = B`, and the subsequent assignment adds
`ReplacedValues[B] = A`, a cycle is created. RemapId then recurses
infinitely following the cycle during path compression, causing a stack
overflow crash.
On AArch64, i16 is not a legal type and requires promotion to i32. When
IR uses i16 values as `extractelement` indices that feed into other
`extractelement` operations, the interplay between result promotion and
operand promotion creates the specific CSE pattern that produces the
cycle.
Fix by calling RemapId on both OldValId and NewValId after the RAUW call
to account for new ReplacedValues entries added during the RAUW cascade.
In the reproducer, this causes both ids to resolve to the same value,
skipping the assignment and preventing the cycle.
Fixes https://github.com/llvm/llvm-project/issues/57251
[Assisted-by](https://t.ly/Dkjjk): [Claude Opus
4.6](https://www.anthropic.com/news/claude-opus-4-6)
14d586a46d