clang crashes on valid code at -O{2,3} on x86_64-linux-gnu: Assertion `(isa<SCEVCouldNotCompute>(ConstantMaxNotTaken) || isa<SCEVConstant>(ConstantMaxNotTaken)) && "No point in having a non-constant max backedge taken count!"' failed

Compiler Explorer: https://godbolt.org/z/ja7fzKa38

Note:
- fails: 21.1.0 to trunk
- works: 20.1.0 and earlier

```
[594] % clangtk -v
clang version 23.0.0git (https://github.com/llvm/llvm-project.git 5b53190d1209bca676ca60797a30bdd3593edbb1)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/11
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/12
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/12
Candidate multilib: .;@m64
Candidate multilib: 32;@m32
Candidate multilib: x32;@mx32
Selected multilib: .;@m64
Found CUDA installation: /usr/local/cuda, version 12.1
[595] %
[595] % clangtk -O2 -c small.c
clangtk: /local/suz-local/software/clangbuild/llvm-project/llvm/lib/Analysis/ScalarEvolution.cpp:9068: llvm::ScalarEvolution::ExitLimit::ExitLimit(const llvm::SCEV*, const llvm::SCEV*, const llvm::SCEV*, bool, llvm::ArrayRef >): Assertion `(isa(ConstantMaxNotTaken) || isa(ConstantMaxNotTaken)) && "No point in having a non-constant max backedge taken count!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: clangtk -I/usr/local/include -I/local/suz-local/software/local/include -O2 -c small.c
1. parser at end of file
2. Optimizer
3. Running pass "require,function(invalidate),require,cgscc(devirt<4>(inline,function-attrs,openmp-opt-cgscc,function(sroa,early-cse,speculative-execution,jump-threading,correlated-propagation,jump-table-to-switch,simplifycfg,instcombine,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm,loop-rotate,licm,simple-loop-unswitch),simplifycfg,instcombine,loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full),sroa,vector-combine,mldst-motion,gvn<>,sccp,bdce,instcombine,dfa-jump-threading,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm),coro-elide,simplifycfg,instcombine),function-attrs,function(require),coro-split,coro-annotation-elide)),function(invalidate),cgscc(devirt<4>())" on module "small.c"
4. Running pass "cgscc(devirt<4>(inline,function-attrs,openmp-opt-cgscc,function(sroa,early-cse,speculative-execution,jump-threading,correlated-propagation,jump-table-to-switch,simplifycfg,instcombine,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm,loop-rotate,licm,simple-loop-unswitch),simplifycfg,instcombine,loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full),sroa,vector-combine,mldst-motion,gvn<>,sccp,bdce,instcombine,dfa-jump-threading,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm),coro-elide,simplifycfg,instcombine),function-attrs,function(require),coro-split,coro-annotation-elide))" on module "small.c"
5. Running pass "loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full)" on function "i"
#0 0x000055c8ff3c8369 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x44e2369)
#1 0x000055c8ff3c509c llvm::sys::RunSignalHandlers() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x44df09c)
#2 0x000055c8ff3c58f2 llvm::sys::CleanupOnSignal(unsigned long) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x44df8f2)
#3 0x000055c8ff2fe358 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
#4 0x00007fa80c313520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#5 0x00007fa80c3679fc __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#6 0x00007fa80c3679fc __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#7 0x00007fa80c3679fc pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#8 0x00007fa80c313476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#9 0x00007fa80c2f97f3 abort ./stdlib/./stdlib/abort.c:81:7
#10 0x00007fa80c2f971b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#11 0x00007fa80c30ae96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#12 0x000055c8fe2bd7cb (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x33d77cb)
#13 0x000055c8fe3217c3 llvm::ScalarEvolution::howManyGreaterThans(llvm::SCEV const*, llvm::SCEV const*, llvm::Loop const*, bool, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x343b7c3)
#14 0x000055c8fe2e0d29 llvm::ScalarEvolution::computeExitLimitFromICmp(llvm::Loop const*, llvm::CmpPredicate, llvm::SCEVUseT, llvm::SCEVUseT, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x33fad29)
#15 0x000055c8fe2f6c77 llvm::ScalarEvolution::computeExitLimitFromICmp(llvm::Loop const*, llvm::ICmpInst*, bool, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x3410c77)
#16 0x000055c8fe2e1475 llvm::ScalarEvolution::computeExitLimitFromCondImpl(llvm::ScalarEvolution::ExitLimitCache&, llvm::Loop const*, llvm::Value*, bool, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x33fb475)
#17 0x000055c8fe2e19ba llvm::ScalarEvolution::computeExitLimitFromCondCached(llvm::ScalarEvolution::ExitLimitCache&, llvm::Loop const*, llvm::Value*, bool, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x33fb9ba)
#18 0x000055c8fe2e1c48 llvm::ScalarEvolution::computeExitLimitFromCond(llvm::Loop const*, llvm::Value*, bool, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x33fbc48)
#19 0x000055c8fe2e1f20 llvm::ScalarEvolution::computeExitLimit(llvm::Loop const*, llvm::BasicBlock*, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x33fbf20)
#20 0x000055c8fe2e22ee llvm::ScalarEvolution::computeBackedgeTakenCount(llvm::Loop const*, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x33fc2ee)
#21 0x000055c8fe2e303e llvm::ScalarEvolution::getBackedgeTakenInfo(llvm::Loop const*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x33fd03e)
#22 0x000055c8fe3042c6 llvm::ScalarEvolution::hasLoopInvariantBackedgeTakenCount(llvm::Loop const*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x341e2c6)
#23 0x000055c903821131 llvm::LoopIdiomRecognizePass::run(llvm::Loop&, llvm::AnalysisManager&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x893b131)
#24 0x000055c900695326 llvm::detail::PassModel, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x57af326)
#25 0x000055c8ff1c622f std::optional llvm::PassManager, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runSinglePass, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&> > > >(llvm::Loop&, std::unique_ptr, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, std::default_delete, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&> > >&, llvm::AnalysisManager&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&, llvm::PassInstrumentation&) (.isra.0) LoopPassManager.cpp:0:0
#26 0x000055c8ff1c7750 llvm::PassManager, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runWithoutLoopNestPasses(llvm::Loop&, llvm::AnalysisManager&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x42e1750)
#27 0x000055c8ff1c7aec llvm::PassManager, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x42e1aec)
#28 0x000055c8ff1c8b32 llvm::FunctionToLoopPassAdaptor::run(llvm::Function&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x42e2b32)
#29 0x000055c8fc24c7d6 llvm::detail::PassModel >::run(llvm::Function&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x13667d6)
#30 0x000055c8feccee67 llvm::PassManager >::run(llvm::Function&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x3de8e67)
#31 0x000055c8fc24e976 llvm::detail::PassModel >, llvm::AnalysisManager >::run(llvm::Function&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x1368976)
#32 0x000055c8fe116993 llvm::CGSCCToFunctionPassAdaptor::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x3230993)
#33 0x000055c8fc24bc96 llvm::detail::PassModel, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x1365c96)
#34 0x000055c8fe10ed2a llvm::PassManager, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x3228d2a)
#35 0x000055c900691c66 llvm::detail::PassModel, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>, llvm::AnalysisManager, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x57abc66)
#36 0x000055c8fe112d94 llvm::DevirtSCCRepeatedPass::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x322cd94)
#37 0x000055c900691cb6 llvm::detail::PassModel, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x57abcb6)
#38 0x000055c8fe110c2f llvm::ModuleToPostOrderCGSCCPassAdaptor::run(llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x322ac2f)
#39 0x000055c8fc24bc46 llvm::detail::PassModel >::run(llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x1365c46)
#40 0x000055c8feccd9d7 llvm::PassManager >::run(llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x3de79d7)
#41 0x000055c900de0cc0 llvm::ModuleInlinerWrapperPass::run(llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x5efacc0)
#42 0x000055c900691306 llvm::detail::PassModel >::run(llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x57ab306)
#43 0x000055c8feccd9d7 llvm::PassManager >::run(llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x3de79d7)
#44 0x000055c8ff7fc4de (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr >&, std::unique_ptr >&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#45 0x000055c8ff7fec84 (anonymous namespace)::EmitAssemblyHelper::emitAssembly(clang::BackendAction, std::unique_ptr >, clang::BackendConsumer*) BackendUtil.cpp:0:0
#46 0x000055c8ff800cf8 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr, std::unique_ptr >, clang::BackendConsumer*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x491acf8)
#47 0x000055c8ffedfa8a clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x4ff9a8a)
#48 0x000055c901a4362c clang::ParseAST(clang::Sema&, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x6b5d62c)
#49 0x000055c90023a821 clang::FrontendAction::Execute() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x5354821)
#50 0x000055c9001c2045 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x52dc045)
#51 0x000055c900337093 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x5451093)
#52 0x000055c8fbd45c69 cc1_main(llvm::ArrayRef, char const*, void*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0xe5fc69)
#53 0x000055c8fbd3b76a ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#54 0x000055c8fbd3b8ff int llvm::function_ref&)>::callback_fn&)>(long, llvm::SmallVectorImpl&) driver.cpp:0:0
#55 0x000055c8fff5824d void llvm::function_ref::callback_fn >, std::__cxx11::basic_string, std::allocator >*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#56 0x000055c8ff2fe770 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x4418770)
#57 0x000055c8fff59053 clang::driver::CC1Command::Execute(llvm::ArrayRef >, std::__cxx11::basic_string, std::allocator >*, bool*) const (.part.0) Job.cpp:0:0
#58 0x000055c8fff112c7 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x502b2c7)
#59 0x000055c8fff123af clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl >&, bool) const (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x502c3af)
#60 0x000055c8fff21a74 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl >&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0x503ba74)
#61 0x000055c8fbd410d3 clang_main(int, char**, llvm::ToolContext const&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0xe5b0d3)
#62 0x000055c8fbc55471 main (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0xd6f471)
#63 0x00007fa80c2fad90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#64 0x00007fa80c2fae40 call_init ./csu/../csu/libc-start.c:128:20
#65 0x00007fa80c2fae40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#66 0x000055c8fbd3ad95 _start (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-23+0xe54d95)
clangtk: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 23.0.0git (https://github.com/llvm/llvm-project.git 5b53190d1209bca676ca60797a30bdd3593edbb1)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
clangtk: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING CRASH REPRODUCER FILES TO THE BUG REPORT:
clangtk: note: diagnostic msg: /tmp/small-6a406b.c
clangtk: note: diagnostic msg: /tmp/small-6a406b.sh
clangtk: note: diagnostic msg:

********************
Aborted
```

```
long *a, c;
int b;
void g(long h) {
long d = 1;
while (1) {
a = &d;
*a = d + 1073741823 * h;
if (-1073741824 * h > d + d)
return;
}
}
void i() {
int j = 1;
l:
c = j - 9112134326663612914;
if (b)
goto k;
g(c);
j = 0;
k:
goto l;
}
```

Start by reproducing the crash with the Compiler Explorer link and clang at -O2 or -O3. Read llvm/lib/Analysis/ScalarEvolution.cpp around line 9068 and follow the stack through LoopIdiomRecognizePass. Done means the valid small.c reproducer no longer triggers the assertion, with a regression test covering the failure.

Written by the indexing model from the issue text.