[CodeGen] SIGSEGV in `updatePressureDiffs` with clang 21.1.8 -O{2,3}

## Backtrace
```
PLEASE submit a bug report to [https://github.com/llvm/llvm-project/issues/](https://github.com/llvm/llvm-project/issues/?q=sort%3Aupdated-desc+is%3Aissue+state%3Aopen+) and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0. Program arguments: clang++ -O3 -I. -MMD -I/usr/local/share/verilator/include -I/usr/local/share/verilator/include/vltstd -DVERILATOR=1 -DVM_COVERAGE=0 -DVM_SC=0 -DVM_TIMING=0 -DVM_TRACE=1 -DVM_TRACE_FST=1 -DVM_TRACE_VCD=0 -DVM_TRACE_SAIF=0 -faligned-new -fbracket-depth=4096 -fcf-protection=none -Xclang -fno-pch-timestamp -Qunused-arguments -Wno-bool-operation -Wno-c++11-narrowing -Wno-constant-logical-operand -Wno-int-in-bool-context -Wno-non-pod-varargs -Wno-parentheses-equality -Wno-shadow -Wno-sign-compare -Wno-tautological-bitwise-compare -Wno-tautological-compare -Wno-uninitialized -Wno-unused-but-set-parameter -Wno-unused-but-set-variable -Wno-unused-parameter -Wno-unused-variable -Wno-vla-cxx-extension -I/nfs/home/cirunner/ci-runner-xs/xs-builder-node031-1/_work/XiangShan/XiangShan/difftest/src/test/csrc/common -I/nfs/home/cirunner/ci-runner-xs/xs-builder-node031-1/_work/XiangShan/XiangShan/difftest/config -DNOOP_HOME=\"/nfs/home/cirunner/ci-runner-xs/xs-builder-node031-1/_work/XiangShan/XiangShan\" -I/nfs/home/cirunner/ci-runner-xs/xs-builder-node031-1/_work/XiangShan/XiangShan/build/generated-src -I/nfs/home/cirunner/ci-runner-xs/xs-builder-node031-1/_work/XiangShan/XiangShan/difftest/src/test/csrc/plugin/include -DNUM_CORES=1 -I/nfs/home/cirunner/ci-runner-xs/xs-builder-node031-1/_work/XiangShan/XiangShan/difftest/src/test/csrc/difftest -I/nfs/home/cirunner/ci-runner-xs/xs-builder-node031-1/_work/XiangShan/XiangShan/build -DENABLE_CONSTANTIN -DREF_PROXY=NemuProxy -DREF_HOME=\"/nfs/home/share/ci-workloads/NEMU\" -I/nfs/home/cirunner/ci-runner-xs/xs-builder-node031-1/_work/XiangShan/XiangShan/difftest/src/test/csrc/plugin/spikedasm -DCONFIG_DIFF_MMA_BATCH_SIZE=64 -DCONFIG_DIFF_MMA_BACKPRESSURE_FACTOR=4 -I/nfs/home/cirunner/ci-runner-xs/xs-builder-node031-1/_work/XiangShan/XiangShan/difftest/src/test/csrc/emu -DEMU_THREAD=8 -I/nfs/home/cirunner/ci-runner-xs/xs-builder-node031-1/_work/XiangShan/XiangShan/difftest/src/test/csrc/verilator -DVERILATOR --std=c++17 -DVERILATOR_4_210 -DENABLE_FST -include-pch VSimTop__pch.h.fast.gch -c VSimTop___024root__301.cpp
1. parser at end of file
2. Code generation
3. Running pass 'Function Pass Manager' on module 'VSimTop___024root__301.cpp'.
4. Running pass 'Machine Instruction Scheduler' on function '@_Z38VSimTop___024root___nba_comb__TOP__224P17VSimTop___024root'
#0 0x00005cc6a4053c57 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0x7e53c57)
#1 0x00005cc6a4053a25 llvm::sys::CleanupOnSignal(unsigned long) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0x7e53a25)
#2 0x00005cc6a400420e (anonymous namespace)::CrashRecoveryContextImpl::HandleCrash(int, unsigned long) CrashRecoveryContext.cpp:0:0
#3 0x00005cc6a40043de CrashRecoverySignalHandler(int) (.llvm.14160580481434374724) CrashRecoveryContext.cpp:0:0
#4 0x00007dfb16e45330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#5 0x00005cc6a698702f llvm::ScheduleDAGMILive::updatePressureDiffs(llvm::ArrayRef) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xa78702f)
#6 0x00005cc6a6984b3b llvm::ScheduleDAGMILive::schedule() (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xa784b3b)
#7 0x00005cc6a6619ed6 llvm::impl_detail::MachineSchedulerBase::scheduleRegions(llvm::ScheduleDAGInstrs&, bool) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xa419ed6)
#8 0x00005cc6a698a2bb llvm::impl_detail::MachineSchedulerImpl::run(llvm::MachineFunction&, llvm::TargetMachine const&, llvm::impl_detail::MachineSchedulerImpl::RequiredAnalyses const&) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xa78a2bb)
#9 0x00005cc6a698a22f (anonymous namespace)::MachineSchedulerLegacy::runOnMachineFunction(llvm::MachineFunction&) MachineScheduler.cpp:0:0
#10 0x00005cc6a67c31cf llvm::MachineFunctionPass::runOnFunction(llvm::Function&) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xa5c31cf)
#11 0x00005cc6a67c394c llvm::FPPassManager::runOnFunction(llvm::Function&) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xa5c394c)
#12 0x00005cc6a67c2ee8 llvm::FPPassManager::runOnModule(llvm::Module&) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xa5c2ee8)
#13 0x00005cc6a7420cec llvm::legacy::PassManagerImpl::run(llvm::Module&) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb220cec)
#14 0x00005cc6a741de2d clang::emitBackendOutput(clang::CompilerInstance&, clang::CodeGenOptions&, llvm::StringRef, llvm::Module*, clang::BackendAction, llvm::IntrusiveRefCntPtr, std::unique_ptr>, clang::BackendConsumer*) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb21de2d)
#15 0x00005cc6a09af1a8 clang::BackendConsumer::HandleTranslationUnit(clang::ASTContext&) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0x47af1a8)
#16 0x00005cc6a6dab797 clang::ParseAST(clang::Sema&, bool, bool) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xabab797)
#17 0x00005cc6a745c45d clang::FrontendAction::Execute() (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb25c45d)
#18 0x00005cc6a75572df clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb3572df)
#19 0x00005cc6a755717c clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb35717c)
#20 0x00005cc6a75565aa cc1_main(llvm::ArrayRef, char const*, void*) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb3565aa)
#21 0x00005cc6a75523b4 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&) driver.cpp:0:0
#22 0x00005cc6a7552267 void llvm::function_ref::callback_fn>, std::__cxx11::basic_string, std::allocator>*, bool*) const::$_0>(long) Job.cpp:0:0
#23 0x00005cc6a755223e llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb35223e)
#24 0x00005cc6a755212f clang::driver::CC1Command::Execute(llvm::ArrayRef>, std::__cxx11::basic_string, std::allocator>*, bool*) const (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb35212f)
#25 0x00005cc6a7551e8b clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb351e8b)
#26 0x00005cc6a7551d1b clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb351d1b)
#27 0x00005cc6a755196e clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb35196e)
#28 0x00005cc6a755429d clang_main(int, char**, llvm::ToolContext const&) (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb35429d)
#29 0x00005cc6a75536d2 main (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb3536d2)
#30 0x00007dfb16e2a1ca __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#31 0x00007dfb16e2a28b call_init ./csu/../csu/libc-start.c:128:20
#32 0x00007dfb16e2a28b __libc_start_main ./csu/../csu/libc-start.c:347:5
#33 0x00005cc6a72e6425 _start (/nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin/clang-21+0xb0e6425)
clang++: error: clang frontend command failed with exit code 139 (use -v to see invocation)
clang version 21.1.8 (https://github.com/llvm/llvm-project 2078da43e25a4623cab2d0d60decddf709aaea28)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /nfs/home/cirunner/tools/LLVM-21.1.8-Linux-X64/bin
clang++: note: diagnostic msg:
********************

PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang++: note: diagnostic msg: /tmp/VSimTop___024root__301-f103cf.cpp
clang++: note: diagnostic msg: /tmp/VSimTop___024root__301-f103cf.sh
clang++: note: diagnostic msg:

********************
```

## Reproduce
Original .cpp and .sh source: [reprod.tar.gz](https://github.com/user-attachments/files/31543508/reprod.tar.gz)
Reduced with cvise: [reprod-cvise.cpp](https://github.com/user-attachments/files/31546042/reprod-cvise.cpp)

The source .cpp is compiled from verilog using verilator so it's quite large. I'm trying to work out a minimized reproducer, but to be honest, I'm quite stuck. I'm happy to take any suggestions.

Command: `clang++ -O3 -c VSimTop___024root__301-f103cf.cpp -o tmp.o`

Version:
- reproduced: 21.1.8 (2078da43e25a4623cab2d0d60decddf709aaea28)
- not reproduced: 19.1.7, 22.1.8, 23.1.0

I'm not sure if this has been fixed in newer versions or if it's just been masked by changes in other part of execution path.

Flag:
- reproduced: `-O{2,3}`, `-O3 -fno-vectorize`
- not reproduced: `-O{0,1}`, `-O3 -fno-slp-vectorize`

## Debugger findings
Running the reproduction under gdb stopped at:

```text
0x...8702f in llvm::ScheduleDAGMILive::updatePressureDiffs(...)
```

```asm
cmp %rcx,0x8(%r8)
```

Where `r8` is `0` at failing point. Seems like a null dereference here: https://github.com/llvm/llvm-project/blob/c3a8b929c432b8d3adb69c9a2e397838a7441044/llvm/lib/CodeGen/MachineScheduler.cpp#L1597-L1599

Start by compiling reprod-cvise.cpp with clang++ -O3, then compare it with the original reprod.tar.gz input and the reported optimization flags. Inspect llvm/lib/CodeGen/MachineScheduler.cpp around the updatePressureDiffs code at lines 1597-1599 and use the debugger findings to investigate the crash. Done means the reproducer no longer causes a SIGSEGV while the listed optimization behavior is understood.

Written by the indexing model from the issue text.