[BUG] ICE in clang::CodeGen::CodeGenFunction::EmitScalarInit(clang::Expr const*, clang::ValueDecl const*, clang::CodeGen::LValue, bool)

## Bug Report: ICE in clang::CodeGen::CodeGenFunction::EmitScalarInit(clang::Expr const*, clang::ValueDecl const*, clang::CodeGen::LValue, bool)

Clang crashes when compiling the following C code.

**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend

This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).

## Reduced Test Case

> Minimized from the original fuzzer-generated input using `creduce`.

```sh
clang -O0 test.c -o /dev/null
```

```c
struct c {
char a[]
};
b;
__attribute__((address_space(1))) struct c d;
e() { char *f = __builtin_memcpy(d.a, b, b); }

```

## Crash Output

```
/root/outputs/experiments-on-metamut/surfuzz,gcc,1/xmfHIiYgXtYI_surfuzz_11.c:3:17: warning: unknown attribute 'noipa' ignored [-Wunknown-attributes]
3 | __attribute__ ((noipa)) void
| ^\~\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,gcc,1/xmfHIiYgXtYI_surfuzz_11.c:9:17: warning: unknown attribute 'noipa' ignored [-Wunknown-attributes]
9 | __attribute__ ((noipa)) void
| ^\~\~\~\~
clang-22: /root/compilers/llvm-project-release/clang/lib/CodeGen/CGExprScalar.cpp:2565: llvm::Value* {anonymous}::ScalarExprEmitter::VisitCastExpr(clang::CastExpr*): Assertion \`(!SrcTy->isPtrOrPtrVectorTy() || !DstTy->isPtrOrPtrVectorTy() || SrcTy->getPointerAddressSpace() \== DstTy->getPointerAddressSpace()) && "Address-space cast must be used to convert address spaces"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name xmfHIiYgXtYI_surfuzz_11.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/xmfHIiYgXtYI_surfuzz_11-b46d30.o -x c /root/outputs/experiments-on-metamut/surfuzz,gcc,1/xmfHIiYgXtYI_surfuzz_11.c
1\. /root/outputs/experiments-on-metamut/surfuzz,gcc,1/xmfHIiYgXtYI_surfuzz_11.c:17:1: current parser token 'int'
2\. /root/outputs/experiments-on-metamut/surfuzz,gcc,1/xmfHIiYgXtYI_surfuzz_11.c:10:1: LLVM IR generation of declaration 'test_dynamic_type'
3\. /root/outputs/experiments-on-metamut/surfuzz,gcc,1/xmfHIiYgXtYI_surfuzz_11.c:10:1: Generating code for declaration 'test_dynamic_type'
#0 0x00005648c99ef2d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x00005648c99ebcaf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x00005648c99ebdfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f1c2f3f2520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007f1c2f446a7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007f1c2f446a7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007f1c2f446a7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007f1c2f3f2476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007f1c2f3d87f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007f1c2f3d871b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007f1c2f3e9e96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x00005648c9dcabae (anonymous namespace)::ScalarExprEmitter::VisitCastExpr(clang::CastExpr*) CGExprScalar.cpp:0:0
#12 0x00005648c9dc4232 clang::CodeGen::CodeGenFunction::EmitScalarExpr(clang::Expr const*, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48cb232)
#13 0x00005648ca2ad06e clang::CodeGen::CodeGenFunction::EmitScalarInit(clang::Expr const*, clang::ValueDecl const*, clang::CodeGen::LValue, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4db406e)
#14 0x00005648ca2aeb61 clang::CodeGen::CodeGenFunction::EmitExprAsInit(clang::Expr const*, clang::ValueDecl const*, clang::CodeGen::LValue, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4db5b61)
#15 0x00005648ca2b9df0 clang::CodeGen::CodeGenFunction::EmitAutoVarInit(clang::CodeGen::CodeGenFunction::AutoVarEmission const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4dc0df0)
#16 0x00005648ca2bdb50 clang::CodeGen::CodeGenFunction::EmitVarDecl(clang::VarDecl const&) (.part.0) CGDecl.cpp:0:0
#17 0x00005648ca2be3b0 clang::CodeGen::CodeGenFunction::EmitDecl(clang::Decl const&, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4dc53b0)
#18 0x00005648c9ee995c clang::CodeGen::CodeGenFunction::EmitDeclStmt(clang::DeclStmt const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x49f095c)
#19 0x00005648c9f00cc5 clang::CodeGen::CodeGenFunction::EmitSimpleStmt(clang::Stmt const*, llvm::ArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a07cc5)
#20 0x00005648c9ef7211 clang::CodeGen::CodeGenFunction::EmitStmt(clang::Stmt const*, llvm::ArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x49fe211)
#21 0x00005648c9f0078b clang::CodeGen::CodeGenFunction::EmitCompoundStmtWithoutScope(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a0778b)
#22 0x00005648c9f689e3 clang::CodeGen::CodeGenFunction::EmitFunctionBody(clang::Stmt const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a6f9e3)
#23 0x00005648c9f7de84 clang::CodeGen::CodeGenFunction::GenerateCode(clang::GlobalDecl, llvm::Function*, clang::CodeGen::CGFunctionInfo const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a84e84)
#24 0x00005648c9fe1f0d clang::CodeGen::CodeGenModule::EmitGlobalFunctionDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae8f0d)
#25 0x00005648c9fdcef5 clang::CodeGen::CodeGenModule::EmitGlobalDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae3ef5)
#26 0x00005648c9fddb83 clang::CodeGen::CodeGenModule::EmitGlobal(clang::GlobalDecl) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae4b83)
#27 0x00005648c9fe7807 clang::CodeGen::CodeGenModule::EmitTopLevelDecl(clang::Decl*) (.part.0) CodeGenModule.cpp:0:0
#28 0x00005648ca363d71 (anonymous namespace)::CodeGeneratorImpl::HandleTopLevelDecl(clang::DeclGroupRef) ModuleBuilder.cpp:0:0
#29 0x00005648ca354cc1 clang::BackendConsumer::HandleTopLevelDecl(clang::DeclGroupRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4e5bcc1)
#30 0x00005648cc200874 clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d07874)
#31 0x00005648ca678987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#32 0x00005648ca6000e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#33 0x00005648ca77595e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#34 0x00005648c6480657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#35 0x00005648c6475694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#36 0x00005648c647a907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#37 0x00005648c63380ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#38 0x00007f1c2f3d9d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#39 0x00007f1c2f3d9e40 call_init ./csu/../csu/libc-start.c:128:20
#40 0x00007f1c2f3d9e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#41 0x00005648c6474cb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/xmfHIiYgXtYI_surfuzz_11-54c711.c
clang: note: diagnostic msg: /tmp/xmfHIiYgXtYI_surfuzz_11-54c711.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```

## Preprocessed Source & Run Script

**Preprocessed source** (`/tmp/xmfHIiYgXtYI_surfuzz_11-54c711.c`):

```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,gcc,1/xmfHIiYgXtYI_surfuzz_11.c"
struct A { int i; char a[1]; void (*p)(); };
struct B { char a[sizeof (struct A) - __builtin_offsetof (struct A, a)]; };
__attribute__ ((noipa)) void
init (char *d, const char *s)
{
__builtin_strcpy (d, s);
}
struct B b;
__attribute__ ((noipa)) void
test_dynamic_type (__attribute__ ((address_space(1))) struct A *p)
{
char *q = (char*)__builtin_memcpy (p->a, &b, sizeof b);
init (q, "foobar");
if (6 != __builtin_strlen (q))
__builtin_abort();
}
int main (void)
{
struct A *p = (struct A*)__builtin_malloc (sizeof *p);
test_dynamic_type (p);
return 0;
}

```

**Run script** (`/tmp/xmfHIiYgXtYI_surfuzz_11-54c711.sh`):

```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,gcc,1/xmfHIiYgXtYI_surfuzz_11.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "xmfHIiYgXtYI_surfuzz_11.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/xmfHIiYgXtYI_surfuzz_11-b46d30.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,gcc,1/xmfHIiYgXtYI_surfuzz_11.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "xmfHIiYgXtYI_surfuzz_11.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "xmfHIiYgXtYI_surfuzz_11-54c711.c"

```

* found via a fuzzer

[xmfHIiYgXtYI_surfuzz_11-54c711.c](https://github.com/user-attachments/files/29128525/xmfHIiYgXtYI_surfuzz_11-54c711.c)
[xmfHIiYgXtYI_surfuzz_11-54c711.sh](https://github.com/user-attachments/files/29128526/xmfHIiYgXtYI_surfuzz_11-54c711.sh)

Reproduce the ICE with the reduced C source and `clang -O0 test.c -o /dev/null`, then inspect clang/lib/CodeGen/CGExprScalar.cpp around ScalarExprEmitter::VisitCastExpr and the EmitScalarInit stack path. Done means the reproducer no longer aborts during frontend code generation and regression coverage preserves that behavior.

Written by the indexing model from the issue text.