clang crashes at -O{1,2,3} on x86_64-linux-gnu: Assertion `I != ValueState.end() && "V not found in ValueState nor Paramstate map!"' failed

Compiler Explorer: https://godbolt.org/z/voT4TPKbM

Note:
- fails: trunk
- works: 22.1.0 and earlier

```
[522] % clangtk -v
clang version 24.0.0git (https://github.com/llvm/llvm-project.git 742031c8aaf9c6509139f2242475250d6548a657)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/10
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/11
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/14
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/9
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/14
Candidate multilib: .;@m64
Selected multilib: .;@m64
[523] %
[523] % clangtk -O1 -w small.c
clang-24: /local/suz-local/software/clangbuild/llvm-project/llvm/lib/Transforms/Utils/SCCPSolver.cpp:992: const llvm::ValueLatticeElement& llvm::SCCPInstVisitor::getLatticeValueFor(llvm::Value*) const: Assertion `I != ValueState.end() && "V not found in ValueState nor Paramstate map!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24 -cc1 -triple x86_64-unknown-linux-gnu -O1 -emit-obj -dumpdir a- -disable-free -clear-ast-before-backend -main-file-name small.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/local/suz-local/software/emitesting/bugs/20260812-clangtk-m64-O3-mavx2-build-110758/delta -fcoverage-compilation-dir=/local/suz-local/software/emitesting/bugs/20260812-clangtk-m64-O3-mavx2-build-110758/delta -resource-dir /local/home/suz/suz-local/software/local/clang-trunk/lib/clang/24 -I /usr/local/include -I /local/suz-local/software/local/include -internal-isystem /local/home/suz/suz-local/software/local/clang-trunk/lib/clang/24/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -w -ferror-limit 19 -fmessage-length=130 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/small-4a637a.o -x c small.c
1. parser at end of file
2. Optimizer
3. Running pass "ipsccp" on module "small.c"
#0 0x0000580a49211661 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x401a661)
#1 0x0000580a4920df6c llvm::sys::RunSignalHandlers() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x4016f6c)
#2 0x0000580a4920e0ce SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x0000580a4920e18c SignalHandlerTerminate(int, siginfo_t*, void*) Signals.cpp:0:0
#4 0x000071fc94645330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#5 0x000071fc9469ec0c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
#6 0x000071fc9469ec0c __pthread_kill_internal ./nptl/pthread_kill.c:78:10
#7 0x000071fc9469ec0c pthread_kill ./nptl/pthread_kill.c:89:10
#8 0x000071fc9464527e raise ./signal/../sysdeps/posix/raise.c:27:6
#9 0x000071fc946288ff abort ./stdlib/abort.c:81:7
#10 0x000071fc9462881b _nl_load_domain ./intl/loadmsgcat.c:1177:9
#11 0x000071fc9463b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#12 0x0000580a4d79f3ad llvm::SCCPInstVisitor::getLatticeValueFor(llvm::Value*) const (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x85a83ad)
#13 0x0000580a4d7a3fe5 llvm::SCCPInstVisitor::getConstantOrNull(llvm::Value*) const (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x85acfe5)
#14 0x0000580a4d7a4582 llvm::SCCPSolver::tryToReplaceWithConstant(llvm::Value*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x85ad582)
#15 0x0000580a4d7a4be2 llvm::SCCPSolver::simplifyInstsInBlock(llvm::BasicBlock&, llvm::SmallPtrSetImpl&, llvm::TrackingStatistic&, llvm::TrackingStatistic&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x85adbe2)
#16 0x0000580a4ad44456 runIPSCCP(llvm::Module&, llvm::DataLayout const&, llvm::AnalysisManager*, std::function, std::function, std::function, std::function, std::function, bool) SCCP.cpp:0:0
#17 0x0000580a4ad46435 llvm::IPSCCPPass::run(llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x5b4f435)
#18 0x0000580a4a4c50a5 llvm::detail::PassModel>::runImpl(llvm::detail::PassConcept>&, llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x52ce0a5)
#19 0x0000580a48b0234d llvm::PassManager>::run(llvm::Module&, llvm::AnalysisManager&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x390b34d)
#20 0x0000580a49649613 (anonymous namespace)::EmitAssemblyHelper::RunOptimizationPipeline(clang::BackendAction, std::unique_ptr>&, std::unique_ptr>&, clang::BackendConsumer*) BackendUtil.cpp:0:0
#21 0x0000580a4964c124 (anonymous namespace)::EmitAssemblyHelper::emitAssembly(clang::BackendAction, std::unique_ptr>, clang::BackendConsumer*) BackendUtil.cpp:0:0
#22 0x0000580a4964e248 clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr, std::unique_ptr>, clang::BackendConsumer*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x4457248)
#23 0x0000580a49d25d30 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x4b2ed30)
#24 0x0000580a4b8b82ac clang::ParseAST(clang::Sema&, bool, bool) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x66c12ac)
#25 0x0000580a4a0983d1 clang::FrontendAction::Execute() (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x4ea13d1)
#26 0x0000580a4a020378 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x4e29378)
#27 0x0000580a4a17557e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x4f7e57e)
#28 0x0000580a45ab5979 cc1_main(llvm::ArrayRef, char const*, void*) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x8be979)
#29 0x0000580a45aab8f7 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#30 0x0000580a45ab06f3 clang_main(int, char**, llvm::ToolContext const&) (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x8b96f3)
#31 0x0000580a459bc6e0 main (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x7c56e0)
#32 0x000071fc9462a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#33 0x000071fc9462a28b call_init ./csu/../csu/libc-start.c:128:20
#34 0x000071fc9462a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#35 0x0000580a45aaad75 _start (/local/home/suz/suz-local/software/local/clang-trunk/bin/clang-24+0x8b3d75)
clangtk: error: unable to execute command: Aborted
clangtk: error: clang frontend command failed with exit code -2 (use -v to see invocation)
clang version 24.0.0git (https://github.com/llvm/llvm-project.git 742031c8aaf9c6509139f2242475250d6548a657)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /local/home/suz/suz-local/software/local/clang-trunk/bin
Build config: +assertions
clangtk: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING CRASH REPRODUCER FILES TO THE BUG REPORT:
clangtk: note: diagnostic msg: /tmp/small-5d53f7.c
clangtk: note: diagnostic msg: /tmp/small-5d53f7.sh
clangtk: note: diagnostic msg:

********************
Aborted
```

```c
int f, j, k, r, s, t, u, ab, ac, ad, af, ag, ah, ao, as, av, bb, w, bf, x, y, *o, **q, **v;
long n, m, ae, ak, al, am, an, ap, aq, ar, au, aw, ax, ay, az, bc;
char l, ai, aj, at, ba, be, *p;
short z, bd, bg;
double fmod(double, double);
struct S {
int a[10];
} ss;
struct S b(int, int) { return ss; }
int c(void *, void *) { return 0; }
int aa(int) { return 1; }
long d(long, long) { return 0; }
int e(int);
void g(int, int, int, int, int, int) {
double h;
int i = e(0);
j = f;
if (0 <= -32768 + i)
fmod(h, h);
}
int e(int bh) {
short h;
*o = l = be + 5 % r + 51 * r;
*o = r + r * c(g - r * r + r, c) - 4673100525;
m = *p + r ^ r & 7 | 7;
r = r ^ ao;
bg = k = m + m ^ an;
ak = k & 30377224139;
az = ak;
ax = k | 30377224139;
k = ax & ak;
k = k ^ 30377224139;
k = k ^ an;
k = k ^ 2675151200;
*v = *q;
h = bh == 0 ?: bd - z - 6 * bd;
bf = -aa(-(4 * r));
r - 70 + n ?: 90855 > r - 8 + ((long)l >> 6) - 8 + 1;
bb = r & 30;
av = ~bb;
as = r | as & av ^ 30;
r = r ^ 1043233084;
v = 0;
l = k > 0 ?: h << 8 >> l < k ^ m ^ 302641690 ^ 605027994800857;
ar = m & 605027994800857;
ay = ~ar;
ap = m | ap & ay;
while (h + h + 50)
*v = &y;
k = 2 * bc - 5 * k ^ 9057291425337;
k = k ^ 20326373568378;
ae = k & 9057291425337;
au = ~ae;
am = k | 9057291425337;
k = am & au;
k = k ^ aw;
z--;
if (z + 5) {
bf = 8 ^ r - 1 + 8 * be - 6;
aj = l & ba;
ai = ~aj;
at = l | ba;
l = at & l << 6 >> 6;
l = al = l ^ ba;
bf = -(90 * r);
if (-d(-(1073741821 * m + 107296144), k + 7))
*q = *q = &r;
((long)f << 40 >> 40) + (r ^ ah ^ ag ^ af);
aq = r << 2 >> 2;
r = aq + 7 + -(7 * r);
*o = r + *o - 60411495444348 + l >= r;
bf = r + ((r < 0 ?: 3) - 108 + 90351698 << r) + (m ?: 6) - 3 & be;
r = (l << 6 >> 6) - 6 - 1 - 050 + -n + 5 << n + (bc > 0 ?: n) > 0;
}
s = k % 7 ^ 9;
s + s % 7;
t = (long)f << t % 7 + u % 7;
ab = ac * u % 7;
ab = ab + ac % 7;
ad = *o;
g(bd - 5, ab - 1, 0, 0, ad - 6, 0);
b(0, 0);
b(0, 0);
b(0, 0);
b(0, w > 4);
b(0, f);
b(0, h > 8);
b(0, bg > 8);
b(0, 0);
b(0, 0);
b(0, x);
b(0, 0);
b(0, 6);
b(0, 0);
b(0, r);
b(0, z > 8);
b(0, 0);
b(0, 0);
b(0, be > 6);
b(0, 0);
b(0, n > 6);
b(0, *o);
b(0, 0);
return 0;
}
```

Start by compiling the provided small.c reproducer with clang at -O1, -O2, and -O3, then inspect the IPSCCP path named in the stack dump. Read llvm/lib/Transforms/Utils/SCCPSolver.cpp around getLatticeValueFor and follow the ipsccp caller in SCCP.cpp. Done means the reproducer no longer triggers the ValueState assertion and regression coverage is added.

Written by the indexing model from the issue text.