[BUG] ICE in (anonymous namespace)::TwoAddressInstructionLegacyPass::runOnMachineFunction(llvm::MachineFunction&)

## Bug Report: ICE in (anonymous namespace)::TwoAddressInstructionLegacyPass::runOnMachineFunction(llvm::MachineFunction&)

Clang crashes when compiling the following C code.

**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: backend

This is a **backend** crash (does not reproduce with `-emit-llvm`).

## Reduced Test Case

> Minimized from the original fuzzer-generated input using `creduce`.

```sh
clang -O0 test.c -o /dev/null
```

```c
double a, b, c;
void d() { __asm__("" : "=t"(c) : "0"(a), "t"(b)); }

```

## Crash Output

```
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/MtoVDFtwkqrX_surfuzz_26.c:1:16: warning: unknown attribute 'noipa' ignored [-Wunknown-attributes]
1 | __attribute__((noipa)) static double
| ^\~\~\~\~
clang-22: /root/compilers/llvm-project-release/llvm/lib/CodeGen/TwoAddressInstructionPass.cpp:1592: void {anonymous}::TwoAddressInstructionImpl::processTiedPairs(llvm::MachineInstr*, TiedPairList&, unsigned int&): Assertion \`i \== DstIdx || !MI->getOperand(i).isReg() || MI->getOperand(i).getReg() != RegA' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name MtoVDFtwkqrX_surfuzz_26.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/MtoVDFtwkqrX_surfuzz_26-e3f174.o -x c /root/outputs/experiments-on-metamut/surfuzz,gcc,4/MtoVDFtwkqrX_surfuzz_26.c
1\. parser at end of file
2\. Code generation
3\. Running pass 'Function Pass Manager' on module '/root/outputs/experiments-on-metamut/surfuzz,gcc,4/MtoVDFtwkqrX_surfuzz_26.c'.
4\. Running pass 'Two-Address instruction pass' on function '@foo'
#0 0x0000557b100072d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x0000557b10003caf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x0000557b10003dfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f7fffa50520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007f7fffaa4a7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007f7fffaa4a7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007f7fffaa4a7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007f7fffa50476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007f7fffa367f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007f7fffa3671b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007f7fffa47e96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x0000557b0f581daa (anonymous namespace)::TwoAddressInstructionImpl::processTiedPairs(llvm::MachineInstr*, llvm::SmallVector, 4u>&, unsigned int&) TwoAddressInstructionPass.cpp:0:0
#12 0x0000557b0f583428 (anonymous namespace)::TwoAddressInstructionImpl::run() TwoAddressInstructionPass.cpp:0:0
#13 0x0000557b0f58530d (anonymous namespace)::TwoAddressInstructionLegacyPass::runOnMachineFunction(llvm::MachineFunction&) TwoAddressInstructionPass.cpp:0:0
#14 0x0000557b0f22cf65 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (.part.0) MachineFunctionPass.cpp:0:0
#15 0x0000557b0f8c0d51 llvm::FPPassManager::runOnFunction(llvm::Function&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x3dafd51)
#16 0x0000557b0f8c0f31 llvm::FPPassManager::runOnModule(llvm::Module&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x3daff31)
#17 0x0000557b0f8c18ae llvm::legacy::PassManagerImpl::run(llvm::Module&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x3db08ae)
#18 0x0000557b102c7610 (anonymous namespace)::EmitAssemblyHelper::emitAssembly(clang::BackendAction, std::unique_ptr >, clang::BackendConsumer*) BackendUtil.cpp:0:0
#19 0x0000557b102c7917 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr, std::unique_ptr >, clang::BackendConsumer*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x47b6917)
#20 0x0000557b109786c9 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4e676c9)
#21 0x0000557b12818afc clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d07afc)
#22 0x0000557b10c90987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#23 0x0000557b10c180e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#24 0x0000557b10d8d95e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#25 0x0000557b0ca98657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#26 0x0000557b0ca8d694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#27 0x0000557b0ca92907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#28 0x0000557b0c9500ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#29 0x00007f7fffa37d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#30 0x00007f7fffa37e40 call_init ./csu/../csu/libc-start.c:128:20
#31 0x00007f7fffa37e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#32 0x0000557b0ca8ccb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/MtoVDFtwkqrX_surfuzz_26-e4cf3c.c
clang: note: diagnostic msg: /tmp/MtoVDFtwkqrX_surfuzz_26-e4cf3c.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```

## Preprocessed Source & Run Script

**Preprocessed source** (`/tmp/MtoVDFtwkqrX_surfuzz_26-e4cf3c.c`):

```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/MtoVDFtwkqrX_surfuzz_26.c"
__attribute__((noipa)) static double
foo (double *y)
{
int ph = __builtin_ia32_rdpmc (0);
volatile double vf = 1.0;
double factor = vf;
double x = - (double) ph * factor;
if (x == 0)
*y = 1.0;
else
*y = 1.0 / x;
double w = 2.0 * x / factor;
double o;
__asm__ __volatile__ ("fld (%1)" : "=t" (o) : "r" (&w) : "memory");
double s;
__asm__ __volatile__ ("fsqrt" : "=t" (s), "=d" (o) : "0" (s), "1" (o) : "memory");
double omww;
__asm__ __volatile__ ("fdivrp" : "=t" (omww) : "0" (x), "t" (s));
return omww > 0.0 ? omww : 0.0;
}
int
main ()
{
double y = 42.0;
if (foo (&y) != 1.0)
__builtin_abort ();
}

```

**Run script** (`/tmp/MtoVDFtwkqrX_surfuzz_26-e4cf3c.sh`):

```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/MtoVDFtwkqrX_surfuzz_26.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "MtoVDFtwkqrX_surfuzz_26.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/MtoVDFtwkqrX_surfuzz_26-e3f174.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/MtoVDFtwkqrX_surfuzz_26.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "MtoVDFtwkqrX_surfuzz_26.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "MtoVDFtwkqrX_surfuzz_26-e4cf3c.c"

```

* found via a fuzzer

[MtoVDFtwkqrX_surfuzz_26-e4cf3c.c](https://github.com/user-attachments/files/29127963/MtoVDFtwkqrX_surfuzz_26-e4cf3c.c)
[MtoVDFtwkqrX_surfuzz_26-e4cf3c.sh](https://github.com/user-attachments/files/29127962/MtoVDFtwkqrX_surfuzz_26-e4cf3c.sh)

Run the attached reduced C source and run script with clang-22 to reproduce the assertion. Then inspect llvm/lib/CodeGen/TwoAddressInstructionPass.cpp, especially processTiedPairs, and trace the failing tied-register case. Done means the reproducer compiles without the TwoAddress instruction pass assertion and the regression is covered by the relevant compiler test.

Written by the indexing model from the issue text.