[CHR] Crash at -O3 with profile data: CHR creates invalid IR

Compiler Explorer: https://godbolt.org/z/d74h44rW9

Reproduce:
```
$ opt -O3 small.ll -o /dev/null
```

Crash:
```
Instruction does not dominate all uses!
%e91.sroa.1.3 = phi i8 [ 1, %for.cond198 ], [ 0, %f2.exit ]
%9 = phi i8 [ %e91.sroa.1.3, %for.inc168 ], [ %.ph, %for.cond164.preheader ]
Instruction does not dominate all uses!
%conv187 = select i1 %cmp, i32 %cond.i, i32 0
%10 = phi i32 [ %conv187, %for.inc168 ], [ %.ph1, %for.cond164.preheader ]
opt: /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Transforms/Vectorize/LoopVectorize.cpp:9848: bool llvm::LoopVectorizePass::processLoop(llvm::Loop *): Assertion `!verifyFunction(*F, &dbgs())' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: opt -O3 small.ll -o /dev/null
1. Running pass "function(drop-unnecessary-assumes,float2int,lower-constant-intrinsics,chr,loop(loop-rotate,loop-deletion),loop-distribute,inject-tli-mappings,loop-vectorize,drop-unnecessary-assumes,infer-alignment,loop-load-elim,instcombine,simplifycfg,slp-vectorizer,vector-combine,instcombine,loop-unroll,transform-warning,sroa,infer-alignment,instcombine,loop-mssa(licm),alignment-from-assumptions,loop-sink,instsimplify,div-rem-pairs,tailcallelim,simplifycfg)" on module "small.ll"
2. Running pass "loop-vectorize" on function "f1"
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0 opt 0x000055d6e3441a07 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) + 39
1 opt 0x000055d6e343f6aa llvm::sys::RunSignalHandlers() + 154
2 opt 0x000055d6e34428a5
3 libc.so.6 0x00007fb4fc3db520
4 libc.so.6 0x00007fb4fc42f9fc pthread_kill + 300
5 libc.so.6 0x00007fb4fc3db476 raise + 22
6 libc.so.6 0x00007fb4fc3c17f3 abort + 211
7 libc.so.6 0x00007fb4fc3c171b
8 libc.so.6 0x00007fb4fc3d2e96
9 opt 0x000055d6e1757c9b llvm::LoopVectorizePass::processLoop(llvm::Loop*) + 13515
10 opt 0x000055d6e1760724 llvm::LoopVectorizePass::runImpl(llvm::Function&) + 452
11 opt 0x000055d6e1760fdf llvm::LoopVectorizePass::run(llvm::Function&, llvm::AnalysisManager&) + 1183
12 opt 0x000055d6e123cf7d
13 opt 0x000055d6e3224f17 llvm::PassManager>::run(llvm::Function&, llvm::AnalysisManager&) + 407
14 opt 0x000055d6df9f7a1d
15 opt 0x000055d6e3228a5e llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager&) + 478
16 opt 0x000055d6df5275ad
17 opt 0x000055d6e3223ff7 llvm::PassManager>::run(llvm::Module&, llvm::AnalysisManager&) + 407
18 opt 0x000055d6df51f16f llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef, llvm::ArrayRef>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) + 11455
19 opt 0x000055d6df514f7c optMain + 9068
20 libc.so.6 0x00007fb4fc3c2d90
21 libc.so.6 0x00007fb4fc3c2e40 __libc_start_main + 128
22 opt 0x000055d6df512535 _start + 37
[1] 654083 IOT instruction (core dumped) opt -O3 small.ll -o /dev/null
```

small.ll

```llvm
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define fastcc void @f1(ptr %d, i1 %cmp) !prof !29 {
entry:
br i1 %cmp, label %aa2, label %for.cond52

aa2: ; preds = %for.inc171, %entry
%e91.sroa.1.0 = phi i8 [ 0, %entry ], [ %e91.sroa.1.3, %for.inc171 ]
%b.0 = phi i32 [ 0, %entry ], [ %conv187, %for.inc171 ]
br i1 %cmp, label %for.cond52, label %for.cond9thread-pre-split

for.cond3.loopexit: ; preds = %for.body11, %for.cond9thread-pre-split
%b.2.lcssa = phi i32 [ %b.0, %for.cond9thread-pre-split ], [ %xor, %for.body11 ]
%cond = icmp eq i32 %b.2.lcssa, 0
br i1 %cond, label %for.cond6.preheader, label %for.cond9thread-pre-split

for.cond6.preheader: ; preds = %for.cond3.loopexit
ret void

for.cond9thread-pre-split: ; preds = %for.cond3.loopexit, %aa2
%tobool10.not291 = phi i1 [ true, %for.cond3.loopexit ], [ false, %aa2 ]
br i1 %tobool10.not291, label %for.cond3.loopexit, label %for.body11

for.body11: ; preds = %for.body11, %for.cond9thread-pre-split
%b.2292 = phi i32 [ %xor, %for.body11 ], [ 0, %for.cond9thread-pre-split ]
%0 = phi i16 [ %inc, %for.body11 ], [ 0, %for.cond9thread-pre-split ]
%xor = xor i32 %b.2292, 1
%inc = add i16 %0, 1
%tobool10.not = icmp eq i16 %inc, 0
br i1 %tobool10.not, label %for.cond3.loopexit, label %for.body11

for.cond52: ; preds = %aa2, %entry
%e91.sroa.1.1 = phi i8 [ 0, %entry ], [ %e91.sroa.1.0, %aa2 ]
%1 = load i16, ptr %d, align 2
%cmp.i = icmp slt i16 %1, 0
br i1 %cmp.i, label %f2.exit, label %lor.lhs.false5.i, !prof !30

for.cond164: ; preds = %if.end210, %for.inc168
%aa97.27 = phi i32 [ %aa97.3, %for.inc168 ], [ 0, %if.end210 ]
%aa163.2 = phi i32 [ %inc169, %for.inc168 ], [ 0, %if.end210 ]
%cmp165 = icmp slt i32 %aa163.2, 0
br i1 %cmp165, label %for.inc168, label %for.inc171

for.inc168: ; preds = %for.inc171, %for.cond164
%aa97.3 = phi i32 [ 1, %for.cond164 ], [ 0, %for.inc171 ]
%inc169 = add i32 %aa163.2, 1
br label %for.cond164

for.inc171: ; preds = %for.cond164
%tobool99.not = icmp eq i32 %aa97.27, 0
br i1 %tobool99.not, label %for.inc168, label %aa2

lor.lhs.false5.i: ; preds = %for.cond52
%tobool.not.i = icmp eq i16 %1, 0
br i1 %tobool.not.i, label %cond.false.i, label %f2.exit, !prof !31

cond.false.i: ; preds = %lor.lhs.false5.i
br label %f2.exit

f2.exit: ; preds = %cond.false.i, %lor.lhs.false5.i, %for.cond52
%cond.i = phi i32 [ 1, %cond.false.i ], [ 0, %lor.lhs.false5.i ], [ 0, %for.cond52 ]
%conv187 = select i1 %cmp, i32 %cond.i, i32 0
%tobool196.not = icmp eq i8 %e91.sroa.1.1, 0
br i1 %tobool196.not, label %if.end210, label %for.cond198

for.cond198: ; preds = %if.end210, %f2.exit
br label %if.end210

if.end210: ; preds = %for.cond198, %f2.exit
%e91.sroa.1.3 = phi i8 [ 1, %for.cond198 ], [ 0, %f2.exit ]
br i1 %cmp, label %for.cond164, label %for.cond198

; uselistorder directives
uselistorder i32 %xor, { 1, 0 }
}

!llvm.module.flags = !{!0}

!0 = !{i32 1, !"ProfileSummary", !1}
!1 = !{!2, !3, !4, !5, !6, !7, !8, !9, !10, !11}
!2 = !{!"ProfileFormat", !"InstrProf"}
!3 = !{!"TotalCount", i64 16777280}
!4 = !{!"MaxCount", i64 16777216}
!5 = !{!"MaxInternalCount", i64 0}
!6 = !{!"MaxFunctionCount", i64 16777216}
!7 = !{!"NumCounts", i64 2}
!8 = !{!"NumFunctions", i64 2}
!9 = !{!"IsPartialProfile", i64 0}
!10 = !{!"PartialProfileRatio", double 0.000000e+00}
!11 = !{!"DetailedSummary", !12}
!12 = !{!13, !14, !15, !16, !17, !18, !19, !20, !21, !22, !23, !24, !25, !26, !27, !28}
!13 = !{i32 10000, i64 16777216, i32 1}
!14 = !{i32 100000, i64 16777216, i32 1}
!15 = !{i32 200000, i64 16777216, i32 1}
!16 = !{i32 300000, i64 16777216, i32 1}
!17 = !{i32 400000, i64 16777216, i32 1}
!18 = !{i32 500000, i64 16777216, i32 1}
!19 = !{i32 600000, i64 16777216, i32 1}
!20 = !{i32 700000, i64 16777216, i32 1}
!21 = !{i32 800000, i64 16777216, i32 1}
!22 = !{i32 900000, i64 16777216, i32 1}
!23 = !{i32 950000, i64 16777216, i32 1}
!24 = !{i32 990000, i64 16777216, i32 1}
!25 = !{i32 999000, i64 16777216, i32 1}
!26 = !{i32 999900, i64 16777216, i32 1}
!27 = !{i32 999990, i64 16777216, i32 1}
!28 = !{i32 999999, i64 64, i32 2}
!29 = !{!"function_entry_count", i64 16777216}
!30 = !{!"branch_weights", i32 131, i32 1}
!31 = !{!"branch_weights", i32 1, i32 -1}
```

The crash is originally triggered by [small.c](https://github.com/user-attachments/files/26426981/small.c) compiling with [profile.txt](https://github.com/user-attachments/files/26426992/profile.txt) at -O3 with PGO:

```
$ llvm-profdata merge test.profdata -o profile.txt
$ clang-trunk -O3 -fprofile-instr-use=test.profdata small.c
```