[Clang] Asan: stack-use-after-return in PassInstrumentationCallbacks during InstCombine

## Description
The compiler crashes during the InstCombine pass when it encounters an indirect call to a function pointer that has been cast from malloc with a mismatched signature. And the crash also triggers a secondary `stack-use-after-return` in the crash reporting logic `(PassInstrumentationCallbacks)`.

## Reproduction
Create a file named `repro.cpp`:
```c
#include
#include

struct S1 {
char pad1;
char val;
short pad2;
};

typedef struct SCompState {
void *(*alloc_func)(void *, size_t, int);
} CompContext;

void init_alloc(CompContext *ctx) {
ctx->alloc_func = (void*(*)(void*, size_t, int))malloc;
}

int main() {
CompContext context;
init_alloc(&context);

struct S1 *state_obj = (struct S1 *)(context.alloc_func(NULL, sizeof(struct S1), 1));

if (!state_obj) return 0;

state_obj->pad1 = 'a';
state_obj->val = 0x42;
}
```
## Compilation Command
```bash
clang++ -x c++ repro.cpp
```

## The main stack trace
```
SUMMARY: AddressSanitizer: stack-use-after-return (/workspace/install/llvm/build_21.1.4/bin/clang-22+0x109ce723) (BuildId: 50dec8884838af90171108e9955bb32c8275f748) in bool llvm::DenseMapBase, std::allocator >, llvm::DenseMapInfo, llvm::detail::DenseMapPair, std::allocator > > >, llvm::StringRef, std::__cxx11::basic_string, std::allocator >, llvm::DenseMapInfo, llvm::detail::DenseMapPair, std::allocator > > >::LookupBucketFor(llvm::StringRef const&, llvm::detail::DenseMapPair, std::allocator > >*&)
Shadow bytes around the buggy address:
0x7c7a677f1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x7c7a677f2000: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7c7a677f2080: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7c7a677f2100: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7c7a677f2180: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
=>0x7c7a677f2200: f5 f5 f5 f5 f5 f5[f5]f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7c7a677f2280: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7c7a677f2300: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
0x7c7a677f2380: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 00 00 00 00
0x7c7a677f2400: f1 f1 f1 f1 f8 f2 f2 f2 f8 f8 f2 f2 00 00 f2 f2
0x7c7a677f2480: 00 00 f2 f2 00 00 f2 f2 00 00 f2 f2 f8 f8 f2 f2
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
```

## The clang version:
```
clang version 22.0.0git
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /workspace/install/llvm/build_21.1.4/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Candidate multilib: .;@m64
Selected multilib: .;@m64
```

## The report link:
[stack-use-after-return.zip](https://github.com/user-attachments/files/26780148/stack-use-after-return.zip)

Start by compiling the provided repro.cpp with clang++ and reproduce the InstCombine crash under AddressSanitizer. Inspect the InstCombine and PassInstrumentationCallbacks paths named in the report, then add or run a regression test covering this input. Done means the compiler no longer crashes and the secondary stack-use-after-return report is absent.

Written by the indexing model from the issue text.