[BUG] ICE in void llvm::function_ref<void ()>::callback_fn<clang::CodeGen::CodeGenFunction::EmitLValue(clang::Expr const*, clang::CodeGen::KnownNonNull_t)::{lambda()#1}>(long)

## Bug Report: ICE in void llvm::function_ref::callback_fn(long)

Clang crashes when compiling the following C code.

**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend

This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).

## Reduced Test Case

> Minimized from the original fuzzer-generated input using `creduce`.

```sh
clang -O0 test.c -o /dev/null
```

```c
extern int a __attribute__((alias("q")));
__thread q;
b() { q; }

```

## Crash Output

```
/root/outputs/experiments-on-metamut/surfuzz,gcc,2/yLFrawLfiSMO_surfuzz_8.c:3:59: warning: unknown attribute 'noalias' ignored [-Wunknown-attributes]
3 | extern unsigned int x __attribute__((common, alias ("q"), noalias, noclone));
| ^\~\~\~\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,gcc,2/yLFrawLfiSMO_surfuzz_8.c:3:68: warning: unknown attribute 'noclone' ignored; did you mean 'noinline'? [-Wunknown-attributes]
3 | extern unsigned int x __attribute__((common, alias ("q"), noalias, noclone));
| ^\~\~\~\~\~\~
| noinline
/root/outputs/experiments-on-metamut/surfuzz,gcc,2/yLFrawLfiSMO_surfuzz_8.c:5:26: warning: unknown attribute 'noclone' ignored; did you mean 'noinline'? [-Wunknown-attributes]
5 | __attribute__((noinline, noclone)) void
| ^\~\~\~\~\~\~
| noinline
clang-22: /root/compilers/llvm-project-release/llvm/include/llvm/Support/Casting.h:656: decltype(auto) llvm::dyn_cast(From*) [with To \= GlobalVariable; From \= Value]: Assertion \`detail::isPresent(Val) && "dyn_cast on a non-existent value"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name yLFrawLfiSMO_surfuzz_8.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/yLFrawLfiSMO_surfuzz_8-c5ff16.o -x c /root/outputs/experiments-on-metamut/surfuzz,gcc,2/yLFrawLfiSMO_surfuzz_8.c
1\. /root/outputs/experiments-on-metamut/surfuzz,gcc,2/yLFrawLfiSMO_surfuzz_8.c:11:1: current parser token 'int'
2\. /root/outputs/experiments-on-metamut/surfuzz,gcc,2/yLFrawLfiSMO_surfuzz_8.c:6:1: LLVM IR generation of declaration 'bar'
3\. /root/outputs/experiments-on-metamut/surfuzz,gcc,2/yLFrawLfiSMO_surfuzz_8.c:6:1: Generating code for declaration 'bar'
#0 0x000055d8bd03e2d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x000055d8bd03acaf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x000055d8bd03adfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007fe1f15c4520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007fe1f1618a7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007fe1f1618a7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007fe1f1618a7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007fe1f15c4476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007fe1f15aa7f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007fe1f15aa71b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007fe1f15bbe96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x000055d8bc89a1f7 llvm::IRBuilderBase::CreateThreadLocalAddress(llvm::Value*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x3d521f7)
#12 0x000055d8bd3908ef clang::CodeGen::CodeGenFunction::EmitDeclRefLValue(clang::DeclRefExpr const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48488ef)
#13 0x000055d8bd3ab512 clang::CodeGen::CodeGenFunction::EmitLValueHelper(clang::Expr const*, clang::CodeGen::KnownNonNull_t) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4863512)
#14 0x000055d8bd3ababe void llvm::function_ref::callback_fn(long) CGExpr.cpp:0:0
#15 0x000055d8c13b1a73 clang::StackExhaustionHandler::runWithSufficientStackSpace(clang::SourceLocation, llvm::function_ref) (/root/objects/llvm-project-release.obj/bin/clang-22+0x8869a73)
#16 0x000055d8bd373e4b clang::CodeGen::CodeGenFunction::EmitLValue(clang::Expr const*, clang::CodeGen::KnownNonNull_t) (/root/objects/llvm-project-release.obj/bin/clang-22+0x482be4b)
#17 0x000055d8bd399bb0 clang::CodeGen::CodeGenFunction::EmitCheckedLValue(clang::Expr const*, clang::CodeGen::CodeGenFunction::TypeCheckKind) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4851bb0)
#18 0x000055d8bd416061 (anonymous namespace)::ScalarExprEmitter::EmitLoadOfLValue(clang::Expr const*) CGExprScalar.cpp:0:0
#19 0x000055d8bd40f5da (anonymous namespace)::ScalarExprEmitter::Visit(clang::Expr*) CGExprScalar.cpp:0:0
#20 0x000055d8bd41687c (anonymous namespace)::ScalarExprEmitter::VisitCastExpr(clang::CastExpr*) CGExprScalar.cpp:0:0
#21 0x000055d8bd413232 clang::CodeGen::CodeGenFunction::EmitScalarExpr(clang::Expr const*, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48cb232)
#22 0x000055d8bd37b13b EmitPointerWithAlignment(clang::Expr const*, clang::CodeGen::LValueBaseInfo*, clang::CodeGen::TBAAAccessInfo*, clang::CodeGen::KnownNonNull_t, clang::CodeGen::CodeGenFunction&) CGExpr.cpp:0:0
#23 0x000055d8bd3804a5 clang::CodeGen::CodeGenFunction::EmitUnaryOpLValue(clang::UnaryOperator const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48384a5)
#24 0x000055d8bd3ab4d9 clang::CodeGen::CodeGenFunction::EmitLValueHelper(clang::Expr const*, clang::CodeGen::KnownNonNull_t) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48634d9)
#25 0x000055d8bd3ababe void llvm::function_ref::callback_fn(long) CGExpr.cpp:0:0
#26 0x000055d8c13b1a73 clang::StackExhaustionHandler::runWithSufficientStackSpace(clang::SourceLocation, llvm::function_ref) (/root/objects/llvm-project-release.obj/bin/clang-22+0x8869a73)
#27 0x000055d8bd373e4b clang::CodeGen::CodeGenFunction::EmitLValue(clang::Expr const*, clang::CodeGen::KnownNonNull_t) (/root/objects/llvm-project-release.obj/bin/clang-22+0x482be4b)
#28 0x000055d8bd399bb0 clang::CodeGen::CodeGenFunction::EmitCheckedLValue(clang::Expr const*, clang::CodeGen::CodeGenFunction::TypeCheckKind) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4851bb0)
#29 0x000055d8bd416061 (anonymous namespace)::ScalarExprEmitter::EmitLoadOfLValue(clang::Expr const*) CGExprScalar.cpp:0:0
#30 0x000055d8bd40f5da (anonymous namespace)::ScalarExprEmitter::Visit(clang::Expr*) CGExprScalar.cpp:0:0
#31 0x000055d8bd41687c (anonymous namespace)::ScalarExprEmitter::VisitCastExpr(clang::CastExpr*) CGExprScalar.cpp:0:0
#32 0x000055d8bd40f5da (anonymous namespace)::ScalarExprEmitter::Visit(clang::Expr*) CGExprScalar.cpp:0:0
#33 0x000055d8bd41c32e clang::CodeGen::CodeGenFunction::EmitPromotedScalarExpr(clang::Expr const*, clang::QualType) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48d432e)
#34 0x000055d8bd41ccee (anonymous namespace)::ScalarExprEmitter::EmitBinOps(clang::BinaryOperator const*, clang::QualType) CGExprScalar.cpp:0:0
#35 0x000055d8bd40cbea clang::StmtVisitorBase::Visit(clang::Stmt*) CGExprScalar.cpp:0:0
#36 0x000055d8bd413232 clang::CodeGen::CodeGenFunction::EmitScalarExpr(clang::Expr const*, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48cb232)
#37 0x000055d8bd37c4ed clang::CodeGen::CodeGenFunction::EvaluateExprAsBool(clang::Expr const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48344ed)
#38 0x000055d8bd5bd897 clang::CodeGen::CodeGenFunction::EmitBranchOnBoolExpr(clang::Expr const*, llvm::BasicBlock*, llvm::BasicBlock*, unsigned long, clang::Stmt::Likelihood, clang::Expr const*, clang::VarDecl const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a75897)
#39 0x000055d8bd5bdc57 clang::CodeGen::CodeGenFunction::EmitBranchOnBoolExpr(clang::Expr const*, llvm::BasicBlock*, llvm::BasicBlock*, unsigned long, clang::Stmt::Likelihood, clang::Expr const*, clang::VarDecl const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a75c57)
#40 0x000055d8bd40c24d (anonymous namespace)::ScalarExprEmitter::VisitAbstractConditionalOperator(clang::AbstractConditionalOperator const*) CGExprScalar.cpp:0:0
#41 0x000055d8bd413232 clang::CodeGen::CodeGenFunction::EmitScalarExpr(clang::Expr const*, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48cb232)
#42 0x000055d8bd372e4f clang::CodeGen::CodeGenFunction::EmitAnyExpr(clang::Expr const*, clang::CodeGen::AggValueSlot, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x482ae4f)
#43 0x000055d8bd3730e8 clang::CodeGen::CodeGenFunction::EmitIgnoredExpr(clang::Expr const*) (.part.0) CGExpr.cpp:0:0
#44 0x000055d8bd54638b clang::CodeGen::CodeGenFunction::EmitStmt(clang::Stmt const*, llvm::ArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x49fe38b)
#45 0x000055d8bd54ef5b clang::CodeGen::CodeGenFunction::EmitIfStmt(clang::IfStmt const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a06f5b)
#46 0x000055d8bd54f78b clang::CodeGen::CodeGenFunction::EmitCompoundStmtWithoutScope(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a0778b)
#47 0x000055d8bd5b79e3 clang::CodeGen::CodeGenFunction::EmitFunctionBody(clang::Stmt const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a6f9e3)
#48 0x000055d8bd5cce84 clang::CodeGen::CodeGenFunction::GenerateCode(clang::GlobalDecl, llvm::Function*, clang::CodeGen::CGFunctionInfo const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a84e84)
#49 0x000055d8bd630f0d clang::CodeGen::CodeGenModule::EmitGlobalFunctionDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae8f0d)
#50 0x000055d8bd62bef5 clang::CodeGen::CodeGenModule::EmitGlobalDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae3ef5)
#51 0x000055d8bd62cb83 clang::CodeGen::CodeGenModule::EmitGlobal(clang::GlobalDecl) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae4b83)
#52 0x000055d8bd636807 clang::CodeGen::CodeGenModule::EmitTopLevelDecl(clang::Decl*) (.part.0) CodeGenModule.cpp:0:0
#53 0x000055d8bd9b2d71 (anonymous namespace)::CodeGeneratorImpl::HandleTopLevelDecl(clang::DeclGroupRef) ModuleBuilder.cpp:0:0
#54 0x000055d8bd9a3cc1 clang::BackendConsumer::HandleTopLevelDecl(clang::DeclGroupRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4e5bcc1)
#55 0x000055d8bf84f874 clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d07874)
#56 0x000055d8bdcc7987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#57 0x000055d8bdc4f0e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#58 0x000055d8bddc495e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#59 0x000055d8b9acf657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#60 0x000055d8b9ac4694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#61 0x000055d8b9ac9907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#62 0x000055d8b99870ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#63 0x00007fe1f15abd90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#64 0x00007fe1f15abe40 call_init ./csu/../csu/libc-start.c:128:20
#65 0x00007fe1f15abe40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#66 0x000055d8b9ac3cb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/yLFrawLfiSMO_surfuzz_8-022f82.c
clang: note: diagnostic msg: /tmp/yLFrawLfiSMO_surfuzz_8-022f82.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```

## Preprocessed Source & Run Script

**Preprocessed source** (`/tmp/yLFrawLfiSMO_surfuzz_8-022f82.c`):

```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,gcc,2/yLFrawLfiSMO_surfuzz_8.c"
extern void abort (void);

extern unsigned int x __attribute__((common, alias ("q"), noalias, noclone));
extern __thread unsigned int *q __attribute__((alias ("x")));
__attribute__((noinline, noclone)) void
bar (unsigned int *p)
{
if (*p != 2 && *p != 3)
(!(!(*q & 263) || *p != 1)) ? abort () : 0;
}
int
main ()
{
unsigned int x, y;
asm volatile ("" : : : "memory");
x = 2;
bar (&x);
x = 3;
bar (&x);
y = 1;
x = 0;
q = &y;
bar (&x);
y = 0;
x = 1;
bar (&x);
return 0;
}

```

**Run script** (`/tmp/yLFrawLfiSMO_surfuzz_8-022f82.sh`):

```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,gcc,2/yLFrawLfiSMO_surfuzz_8.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "yLFrawLfiSMO_surfuzz_8.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/yLFrawLfiSMO_surfuzz_8-c5ff16.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,gcc,2/yLFrawLfiSMO_surfuzz_8.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "yLFrawLfiSMO_surfuzz_8.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "yLFrawLfiSMO_surfuzz_8-022f82.c"

```

* found via a fuzzer

[yLFrawLfiSMO_surfuzz_8-022f82.c](https://github.com/user-attachments/files/29127794/yLFrawLfiSMO_surfuzz_8-022f82.c)
[yLFrawLfiSMO_surfuzz_8-022f82.sh](https://github.com/user-attachments/files/29127793/yLFrawLfiSMO_surfuzz_8-022f82.sh)

Reproduce the crash with the reduced C test case and the shown clang command, then start at llvm::IRBuilderBase::CreateThreadLocalAddress and clang::CodeGen::CodeGenFunction::EmitDeclRefLValue in the stack trace. Trace the frontend handling of the thread-local reference and alias, and add a regression test covering the reduced case; done means clang no longer asserts or crashes.

Written by the indexing model from the issue text.