clang crashes on valid code at -O{s,2,3} on x86_64-linux-gnu: Assertion `(isa<SCEVCouldNotCompute>(ConstantMaxNotTaken) || isa<SCEVConstant>(ConstantMaxNotTaken)) && "No point in having a non-constant max backedge taken count!"' failed

Compiler Explorer: https://godbolt.org/z/jfh99dcWc

Note:
- fails: 21.1.0 to trunk
- works: 20.1.0 and earlier

```
[587] % clangtk -v
clang version 24.0.0git (https://github.com/llvm/llvm-project.git acfaabebcfd10d4dbabeb54cf0c60509648fb82f)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/10
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/11
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/14
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/9
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/14
Candidate multilib: .;@m64
Selected multilib: .;@m64
[588] %
[588] % clangtk -O3 small.c
clang-24: /local/suz-local/software/clangbuild/llvm-project/llvm/lib/Analysis/ScalarEvolution.cpp:9082: llvm::ScalarEvolution::ExitLimit::ExitLimit(const llvm::SCEV*, const llvm::SCEV*, const llvm::SCEV*, bool, llvm::ArrayRef >): Assertion `(isa(ConstantMaxNotTaken) || isa(ConstantMaxNotTaken)) && "No point in having a non-constant max backedge taken count!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24 -cc1 -triple x86_64-unknown-linux-gnu -O3 -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name small.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/local/suz-local/software/emitesting/bugs/20260721-clangtk-m64-O3-build-173935/delta -fcoverage-compilation-dir=/local/suz-local/software/emitesting/bugs/20260721-clangtk-m64-O3-build-173935/delta -resource-dir /local/home/suz/suz-local/software/local/clang-trunk/lib/clang/24 -I /usr/local/include -I /local/suz-local/software/local/include -internal-isystem /local/home/suz/suz-local/software/local/clang-trunk/lib/clang/24/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fmessage-length=130 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -vectorize-loops -vectorize-slp -faddrsig -fdwarf2-cfi-asm -o /tmp/small-aded6f.o -x c small.c
1. parser at end of file
2. Optimizer
3. Running pass "require,function(invalidate),require,cgscc(devirt<4>(inline,function-attrs,argpromotion,openmp-opt-cgscc,function(sroa,early-cse,speculative-execution,jump-threading,correlated-propagation,jump-table-to-switch,simplifycfg,instcombine,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm,loop-rotate,licm,simple-loop-unswitch),simplifycfg,instcombine,loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full),sroa,vector-combine,mldst-motion,gvn<>,sccp,bdce,instcombine,dfa-jump-threading,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm),coro-elide,simplifycfg,instcombine),function-attrs,function(require),coro-split,coro-annotation-elide)),function(invalidate),cgscc(devirt<4>())" on module "small.c"
4. Running pass "cgscc(devirt<4>(inline,function-attrs,argpromotion,openmp-opt-cgscc,function(sroa,early-cse,speculative-execution,jump-threading,correlated-propagation,jump-table-to-switch,simplifycfg,instcombine,aggressive-instcombine,libcalls-shrinkwrap,tailcallelim,simplifycfg,reassociate,constraint-elimination,loop-mssa(loop-instsimplify,loop-simplifycfg,licm,loop-rotate,licm,simple-loop-unswitch),simplifycfg,instcombine,loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full),sroa,vector-combine,mldst-motion,gvn<>,sccp,bdce,instcombine,dfa-jump-threading,jump-threading,correlated-propagation,adce,memcpyopt,dse,move-auto-init,loop-mssa(licm),coro-elide,simplifycfg,instcombine),function-attrs,function(require),coro-split,coro-annotation-elide))" on module "small.c"
5. Running pass "loop(loop-idiom,indvars,extra-simple-loop-unswitch-passes,loop-deletion,loop-unroll-full)" on function "main"
#0 0x000057cd50622fc1 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x3fb4fc1)
#1 0x000057cd5061f8cc llvm::sys::RunSignalHandlers() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x3fb18cc)
#2 0x000057cd5061fa2e SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x000057cd5061faec SignalHandlerTerminate(int, siginfo_t*, void*) Signals.cpp:0:0
#4 0x0000718cf6a45330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#5 0x0000718cf6a9eb2c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#6 0x0000718cf6a9eb2c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#7 0x0000718cf6a9eb2c pthread_kill ./nptl/pthread_kill.c:89:10
#8 0x0000718cf6a4527e raise ./signal/../sysdeps/posix/raise.c:27:6
#9 0x0000718cf6a288ff abort ./stdlib/abort.c:81:7
#10 0x0000718cf6a2881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#11 0x0000718cf6a3b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#12 0x000057cd4f50002b (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2e9202b)
#13 0x000057cd4f5624e0 llvm::ScalarEvolution::howManyGreaterThans(llvm::SCEV const*, llvm::SCEV const*, llvm::Loop const*, bool, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2ef44e0)
#14 0x000057cd4f5651d1 llvm::ScalarEvolution::computeExitLimitFromICmp(llvm::Loop const*, llvm::CmpPredicate, llvm::SCEVUseT, llvm::SCEVUseT, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2ef71d1)
#15 0x000057cd4f5656e5 llvm::ScalarEvolution::computeExitLimitFromICmp(llvm::Loop const*, llvm::ICmpInst*, bool, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2ef76e5)
#16 0x000057cd4f565abf llvm::ScalarEvolution::computeExitLimitFromCondImpl(llvm::ScalarEvolution::ExitLimitCache&, llvm::Loop const*, llvm::Value*, bool, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2ef7abf)
#17 0x000057cd4f565fd6 llvm::ScalarEvolution::computeExitLimitFromCondCached(llvm::ScalarEvolution::ExitLimitCache&, llvm::Loop const*, llvm::Value*, bool, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2ef7fd6)
#18 0x000057cd4f566120 llvm::ScalarEvolution::computeExitLimitFromCond(llvm::Loop const*, llvm::Value*, bool, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2ef8120)
#19 0x000057cd4f51e822 llvm::ScalarEvolution::computeExitLimit(llvm::Loop const*, llvm::BasicBlock*, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2eb0822)
#20 0x000057cd4f51ee18 llvm::ScalarEvolution::computeBackedgeTakenCount(llvm::Loop const*, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2eb0e18)
#21 0x000057cd4f51f981 llvm::ScalarEvolution::getBackedgeTakenInfo(llvm::Loop const*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2eb1981)
#22 0x000057cd4f541575 llvm::ScalarEvolution::hasLoopInvariantBackedgeTakenCount(llvm::Loop const*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2ed3575)
#23 0x000057cd54a03dc3 llvm::LoopIdiomRecognizePass::run(llvm::Loop&, llvm::AnalysisManager&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x8395dc3)
#24 0x000057cd518d9105 llvm::detail::PassModel, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runImpl(llvm::detail::PassConcept, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>&, llvm::Loop&, llvm::AnalysisManager&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x526b105)
#25 0x000057cd5040f729 std::optional llvm::PassManager, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runSinglePass, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, llvm::detail::PassConcept, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::Deleter>>(llvm::Loop&, std::unique_ptr, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, llvm::detail::PassConcept, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::Deleter>&, llvm::AnalysisManager&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&, llvm::PassInstrumentation&) (.isra.0) LoopPassManager.cpp:0:0
#26 0x000057cd50411120 llvm::PassManager, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runWithoutLoopNestPasses(llvm::Loop&, llvm::AnalysisManager&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x3da3120)
#27 0x000057cd504114eb llvm::PassManager, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::run(llvm::Loop&, llvm::AnalysisManager&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x3da34eb)
#28 0x000057cd4d436a35 llvm::detail::PassModel, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>, llvm::AnalysisManager, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>::runImpl(llvm::detail::PassConcept, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&>&, llvm::Loop&, llvm::AnalysisManager&, llvm::LoopStandardAnalysisResults&, llvm::LPMUpdater&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0xdc8a35)
#29 0x000057cd50412a71 llvm::FunctionToLoopPassAdaptor::run(llvm::Function&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x3da4a71)
#30 0x000057cd4d436895 llvm::detail::PassModel>::runImpl(llvm::detail::PassConcept>&, llvm::Function&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0xdc8895)
#31 0x000057cd4ff1769d llvm::PassManager>::run(llvm::Function&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x38a969d)
#32 0x000057cd4d436045 llvm::detail::PassModel>, llvm::AnalysisManager>::runImpl(llvm::detail::PassConcept>&, llvm::Function&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0xdc8045)
#33 0x000057cd4f362f55 llvm::CGSCCToFunctionPassAdaptor::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2cf4f55)
#34 0x000057cd4d436095 llvm::detail::PassModel, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::runImpl(llvm::detail::PassConcept, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>&, llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0xdc8095)
#35 0x000057cd4f35b52e llvm::PassManager, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2ced52e)
#36 0x000057cd518d46f5 llvm::detail::PassModel, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>, llvm::AnalysisManager, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::runImpl(llvm::detail::PassConcept, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>&, llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x52666f5)
#37 0x000057cd4f35f3f5 llvm::DevirtSCCRepeatedPass::run(llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2cf13f5)
#38 0x000057cd518d9595 llvm::detail::PassModel, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>::runImpl(llvm::detail::PassConcept, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&>&, llvm::LazyCallGraph::SCC&, llvm::AnalysisManager&, llvm::LazyCallGraph&, llvm::CGSCCUpdateResult&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x526b595)
#39 0x000057cd4f35d730 llvm::ModuleToPostOrderCGSCCPassAdaptor::run(llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x2cef730)
#40 0x000057cd4d438785 llvm::detail::PassModel>::runImpl(llvm::detail::PassConcept>&, llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0xdca785)
#41 0x000057cd4ff1630d llvm::PassManager>::run(llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x38a830d)
#42 0x000057cd52030a27 llvm::ModuleInlinerWrapperPass::run(llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x59c2a27)
#43 0x000057cd518d5d35 llvm::detail::PassModel>::runImpl(llvm::detail::PassConcept>&, llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x5267d35)
#44 0x000057cd4ff1630d llvm::PassManager>::run(llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x38a830d)
#45 0x000057cd50a63e42 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr>&, std::unique_ptr>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#46 0x000057cd50a66794 (anonymous namespace)::EmitAssemblyHelper::emitAssembly(clang::BackendAction, std::unique_ptr>, clang::BackendConsumer*) BackendUtil.cpp:0:0
#47 0x000057cd50a68858 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr, std::unique_ptr>, clang::BackendConsumer*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x43fa858)
#48 0x000057cd5113d080 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x4acf080)
#49 0x000057cd52cab13c clang::ParseAST(clang::Sema&, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x663d13c)
#50 0x000057cd514ac651 clang::FrontendAction::Execute() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x4e3e651)
#51 0x000057cd51434358 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x4dc6358)
#52 0x000057cd515883fe clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x4f1a3fe)
#53 0x000057cd4cf36549 cc1_main(llvm::ArrayRef, char const*, void*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x8c8549)
#54 0x000057cd4cf2c4b7 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#55 0x000057cd4cf312b3 clang_main(int, char**, llvm::ToolContext const&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x8c32b3)
#56 0x000057cd4ce3e5c0 main (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x7d05c0)
#57 0x0000718cf6a2a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#58 0x0000718cf6a2a28b call_init ./csu/../csu/libc-start.c:128:20
#59 0x0000718cf6a2a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#60 0x000057cd4cf2b935 _start (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x8bd935)
clangtk: error: unable to execute command: Aborted
clangtk: error: clang frontend command failed with exit code -2 (use -v to see invocation)
clang version 24.0.0git (https://github.com/llvm/llvm-project.git acfaabebcfd10d4dbabeb54cf0c60509648fb82f)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
clangtk: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING CRASH REPRODUCER FILES TO THE BUG REPORT:
clangtk: note: diagnostic msg: /tmp/small-d240c2.c
clangtk: note: diagnostic msg: /tmp/small-d240c2.sh
clangtk: note: diagnostic msg:

********************
Aborted
```

```c
long *a, b;
int main() {
long c = ((long)b >> 56) + 3827108648379050775, d = c;
while (1) {
a = &c;
*a = c + 1073741823 * d;
if (d > c + c)
break;
}
return 0;
}
```