Attributor crashes on scalable vector array types via implicit TypeSize-to-uint64 conversion

## Vulnerable code location(s)

- [llvm/lib/Transforms/IPO/AttributorAttributes.cpp:7624](https://github.com/llvm/llvm-project/blob/9f7af289728002487b032a8278bc2c540a02ff59/llvm/lib/Transforms/IPO/AttributorAttributes.cpp#L7624)
https://github.com/llvm/llvm-project/blob/9f7af289728002487b032a8278bc2c540a02ff59/llvm/lib/Transforms/IPO/AttributorAttributes.cpp#L7624: `uint64_t PointeeTySize = DL.getTypeStoreSize(PointeeTy);` in `createInitialization`
- [llvm/lib/Transforms/IPO/AttributorAttributes.cpp:7659](https://github.com/llvm/llvm-project/blob/9f7af289728002487b032a8278bc2c540a02ff59/llvm/lib/Transforms/IPO/AttributorAttributes.cpp#L7659)
https://github.com/llvm/llvm-project/blob/9f7af289728002487b032a8278bc2c540a02ff59/llvm/lib/Transforms/IPO/AttributorAttributes.cpp#L7659: `uint64_t PointeeTySize = DL.getTypeStoreSize(PointeeTy);` in `createReplacementValues`

## Vulnerable code analysis

`AAPrivatizablePtrArgument::createInitialization` and `createReplacementValues` handle `ArrayType` privatizable types by calling `DL.getTypeStoreSize(PointeeTy)` and implicitly converting the returned `TypeSize` to `uint64_t`. When the array element type is a scalable vector (e.g., ``), the `TypeSize` is scalable and this implicit conversion triggers a fatal error in `TypeSize::operator ScalarTy()`.

The `isDenselyPacked` check (line 7420) that guards entry to `manifest` does not reject scalable types — it recurses into the array element type and evaluates the scalar base type without performing any size-to-uint64 conversion, so scalable vector array types pass through unchecked.

A `byval` attribute typed as `[2 x ]` on an internal function argument is sufficient to reach the crash site.

## Proof of concept

[https://godbolt.org/z/s5876o8nK](https://godbolt.org/z/s5876o8nK)

```llvm
target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"

define internal void @callee(ptr byval([2 x ]) %arg) {
entry:
%val = load [2 x ], ptr %arg
ret void
}

define void @caller() {
entry:
%a = alloca [2 x ]
call void @callee(ptr byval([2 x ]) %a)
ret void
}
```

Stack trace:
```
LLVM ERROR: Cannot implicitly convert a scalable size to a fixed-width size in `TypeSize::operator ScalarTy()`
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-trunk/bin/opt -o /app/output.s -S -passes=attributor
1. Running pass "attributor" on module ""
#0 0x00000000053b18e8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-trunk/bin/opt+0x53b18e8)
#1 0x00000000053aea24 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#2 0x00007dc34b242520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#3 0x00007dc34b2969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
#4 0x00007dc34b242476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
#5 0x00007dc34b2287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
#6 0x0000000000833087 llvm::json::operator==(llvm::json::Value const&, llvm::json::Value const&) (.cold) JSON.cpp:0:0
#7 0x00000000052e3109 (/opt/compiler-explorer/clang-trunk/bin/opt+0x52e3109)
#8 0x0000000002ec3d40 (anonymous namespace)::AADereferenceableImpl::initialize(llvm::Attributor&) AttributorAttributes.cpp:0:0
#9 0x0000000002ec412d (anonymous namespace)::AADereferenceableImpl::initialize(llvm::Attributor&) AttributorAttributes.cpp:0:0
#10 0x0000000002e419c8 llvm::AADereferenceable const* llvm::Attributor::getOrCreateAAFor(llvm::IRPosition, llvm::AbstractAttribute const*, llvm::DepClassTy, bool, bool) (/opt/compiler-explorer/clang-trunk/bin/opt+0x2e419c8)
#11 0x0000000002e43096 llvm::Attributor::identifyDefaultAbstractAttributes(llvm::Function&) (.part.0) Attributor.cpp:0:0
#12 0x0000000002e9248b (anonymous namespace)::AAIsDeadFunction::initialize(llvm::Attributor&) AttributorAttributes.cpp:0:0
#13 0x0000000002e33c98 llvm::AAIsDead const* llvm::Attributor::getOrCreateAAFor(llvm::IRPosition, llvm::AbstractAttribute const*, llvm::DepClassTy, bool, bool) (/opt/compiler-explorer/clang-trunk/bin/opt+0x2e33c98)
#14 0x0000000002e42bfe llvm::Attributor::identifyDefaultAbstractAttributes(llvm::Function&) (.part.0) Attributor.cpp:0:0
#15 0x0000000002e4f93b runAttributorOnFunctions(llvm::InformationCache&, llvm::SetVector, llvm::DenseSet>, 0u>&, llvm::AnalysisGetter&, llvm::CallGraphUpdater&, bool, bool) (.part.0) Attributor.cpp:0:0
#16 0x0000000002e50235 llvm::AttributorPass::run(llvm::Module&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-trunk/bin/opt+0x2e50235)
#17 0x0000000002cee87e llvm::detail::PassModel>::run(llvm::Module&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-trunk/bin/opt+0x2cee87e)
#18 0x00000000051249f7 llvm::PassManager>::run(llvm::Module&, llvm::AnalysisManager&) (/opt/compiler-explorer/clang-trunk/bin/opt+0x51249f7)
#19 0x00000000009825ba llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef, llvm::ArrayRef>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-trunk/bin/opt+0x9825ba)
#20 0x0000000000975b4f optMain (/opt/compiler-explorer/clang-trunk/bin/opt+0x975b4f)
#21 0x00007dc34b229d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#22 0x00007dc34b229e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#23 0x000000000096e335 _start (/opt/compiler-explorer/clang-trunk/bin/opt+0x96e335)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```