[CHR] ControlHeightReductionPass creates broken phi/select, crashes with "Instruction does not dominate all uses!" with profile data

Compiler Explorer: https://godbolt.org/z/7jdarr1W6

Reproduce:
```
$ opt -passes='require,function(chr)' small.ll -disable-output
```

Crash:
```
Instruction does not dominate all uses!
%spec.select7 = select i1 false, i8 0, i8 0
%2 = phi i8 [ %spec.select7, %for.cond23.1 ], [ %spec.select7, %cond.false.1 ], [ %spec.select7, %cond.end ], [ %spec.select7.nonchr, %cond.false.1.nonchr ], [ %spec.select7.nonchr, %cond.end.nonchr ]
LLVM ERROR: Broken module found, compilation aborted!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0. Program arguments: opt -passes=require,function(chr) small.ll -disable-output
1. Running pass "verify" on module "small.ll"
#0 0x0000aaaab1136c88 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:885:3
#1 0x0000aaaab11342cc llvm::sys::RunSignalHandlers() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Signals.cpp:109:18
#2 0x0000aaaab1134990 SignalHandler(int, siginfo_t*, void*) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/Unix/Signals.inc:448:14
#3 0x0000ffff88fbc7dc (linux-vdso.so.1+0x7dc)
#4 0x0000ffff88b22008 (/lib/aarch64-linux-gnu/libc.so.6+0x82008)
#5 0x0000ffff88ada83c gsignal (/lib/aarch64-linux-gnu/libc.so.6+0x3a83c)
#6 0x0000ffff88ac7134 abort (/lib/aarch64-linux-gnu/libc.so.6+0x27134)
#7 0x0000aaaab107ad70 llvm::report_fatal_error(llvm::StringRef, bool) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/lib/Support/ErrorHandling.cpp:99:68
#8 0x0000aaaab107adf4 (/data/x27zhou/compiler-nightly/install/llvm/bin/opt+0x4b4adf4)
#9 0x0000aaaab0f1c36c (/data/x27zhou/compiler-nightly/install/llvm/bin/opt+0x49ec36c)
#10 0x0000aaaaaccc8350 llvm::detail::PassModel >::run(llvm::Module&, llvm::AnalysisManager&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/PassManagerInternal.h:94:3
#11 0x0000aaaab0ee30d4 llvm::PassManager >::run(llvm::Module&, llvm::AnalysisManager&) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/PassManagerImpl.h:80:18
#12 0x0000aaaaaccd2740 llvm::SmallPtrSetImplBase::~SmallPtrSetImplBase() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/SmallPtrSet.h:89:5
#13 0x0000aaaaaccd2740 llvm::SmallPtrSetImpl::~SmallPtrSetImpl() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/SmallPtrSet.h:366:35
#14 0x0000aaaaaccd2740 llvm::SmallPtrSet::~SmallPtrSet() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/ADT/SmallPtrSet.h:533:7
#15 0x0000aaaaaccd2740 llvm::PreservedAnalyses::~PreservedAnalyses() /data/x27zhou/compiler-nightly/src/llvm-project/llvm/include/llvm/IR/Analysis.h:112:7
#16 0x0000aaaaaccd2740 llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef, llvm::ArrayRef >, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind,bool, bool, bool, bool, bool, bool, bool, bool) /data/x27zhou/compiler-nightly/src/llvm-project/llvm/tools/opt/NewPMDriver.cpp:572:10
#17 0x0000aaaaaccc6f58 optMain /data/x27zhou/compiler-nightly/src/llvm-project/llvm/tools/opt/optdriver.cpp:798:5
#18 0x0000ffff88ac7400 (/lib/aarch64-linux-gnu/libc.so.6+0x27400)
#19 0x0000ffff88ac74d8 __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x274d8)
#20 0x0000aaaaaccbd170 _start (/data/x27zhou/compiler-nightly/install/llvm/bin/opt+0x78d170)
zsh: abort (core dumped) opt -passes='require,function(chr)' small.ll -disable-output
```

small.ll
```
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128-Fn32"
target triple = "aarch64-unknown-linux-gnu"

define i16 @func_39() !prof !29 {
entry:
br label %if.end21

for.cond1.loopexit: ; No predecessors!
br i1 false, label %for.end43, label %if.end21

if.end21: ; preds = %for.cond1.loopexit, %entry
%z.addr.04 = phi i8 [ 0, %entry ], [ %spec.select7, %for.cond1.loopexit ]
%tobool22.not = icmp eq i8 %z.addr.04, 0
br i1 %tobool22.not, label %cond.false, label %cond.end, !prof !30

cond.false: ; preds = %if.end21
br label %cond.end

cond.end: ; preds = %cond.false, %if.end21
%spec.select7 = select i1 false, i8 0, i8 0
%tobool22.not.1 = icmp eq i8 %z.addr.04, 0
br i1 %tobool22.not.1, label %cond.false.1, label %for.cond23.1, !prof !31

cond.false.1: ; preds = %cond.end
br label %for.cond23.1

for.cond23.1: ; preds = %for.cond23.1, %cond.false.1, %cond.end
br label %for.cond23.1

for.end43: ; preds = %for.cond1.loopexit
ret i16 0
}

!llvm.module.flags = !{!0}

!0 = !{i32 1, !"ProfileSummary", !1}
!1 = !{!2, !3, !4, !5, !6, !7, !8, !9, !10, !11}
!2 = !{!"ProfileFormat", !"InstrProf"}
!3 = !{!"TotalCount", i64 2049}
!4 = !{!"MaxCount", i64 1024}
!5 = !{!"MaxInternalCount", i64 1024}
!6 = !{!"MaxFunctionCount", i64 1024}
!7 = !{!"NumCounts", i64 285}
!8 = !{!"NumFunctions", i64 2}
!9 = !{!"IsPartialProfile", i64 0}
!10 = !{!"PartialProfileRatio", double 0.000000e+00}
!11 = !{!"DetailedSummary", !12}
!12 = !{!13, !14, !15, !16, !17, !18, !19, !20, !21, !22, !23, !24, !25, !26, !27, !28}
!13 = !{i32 10000, i64 1024, i32 2}
!14 = !{i32 100000, i64 1024, i32 2}
!15 = !{i32 200000, i64 1024, i32 2}
!16 = !{i32 300000, i64 1024, i32 2}
!17 = !{i32 400000, i64 1024, i32 2}
!18 = !{i32 500000, i64 1024, i32 2}
!19 = !{i32 600000, i64 1024, i32 2}
!20 = !{i32 700000, i64 1024, i32 2}
!21 = !{i32 800000, i64 1024, i32 2}
!22 = !{i32 900000, i64 1024, i32 2}
!23 = !{i32 950000, i64 1024, i32 2}
!24 = !{i32 990000, i64 1024, i32 2}
!25 = !{i32 999000, i64 1024, i32 2}
!26 = !{i32 999900, i64 1024, i32 2}
!27 = !{i32 999990, i64 1024, i32 2}
!28 = !{i32 999999, i64 1024, i32 2}
!29 = !{!"function_entry_count", i64 1024}
!30 = !{!"branch_weights", i32 1, i32 1025}
!31 = !{!"branch_weights", i32 1, i32 2051}
```

Start by running the issue's opt command against small.ll and inspect the ControlHeightReductionPass (CHR) path that produces the broken phi/select. Done means the reproducer no longer crashes verification and the resulting IR satisfies LLVM's dominance rules.

Written by the indexing model from the issue text.