[SpirvOpt] sample segfault with `--loop-unroll --eliminate-dead-branches`

[Kerilk]

Hello, we found this spirv sample that passes spirv-val but segfaults spitv-opt. It has been minimized from an example that would directly crash spirv-opt -O though this one does not, but it crashes spirv-opt --loop-unroll --eliminate-dead-branches which was determined to be the crux of the issue. It reproduces on on 2025.3, 2026.1, and main. I've attached the binary in a zip file.

; SPIR-V
; Version: 1.0
; Generator: Khronos SPIR-V Tools Assembler; 0
; Bound: 21
; Schema: 0
               OpCapability Addresses
               OpCapability Kernel
               OpCapability Int64
               OpMemoryModel Physical64 OpenCL
               OpEntryPoint Kernel %1 "main_kernel"
       %void = OpTypeVoid
       %uint = OpTypeInt 32 0
      %ulong = OpTypeInt 64 0
%_ptr_CrossWorkgroup_uint = OpTypePointer CrossWorkgroup %uint
          %6 = OpTypeFunction %void %_ptr_CrossWorkgroup_uint %ulong
       %bool = OpTypeBool
       %true = OpConstantTrue %bool
          %1 = OpFunction %void None %6
          %9 = OpFunctionParameter %_ptr_CrossWorkgroup_uint
         %10 = OpFunctionParameter %ulong
         %11 = OpLabel
               OpSelectionMerge %12 None
               OpBranchConditional %true %12 %13
         %12 = OpLabel
               OpBranch %14
         %13 = OpLabel
               OpReturn
         %15 = OpLabel
               OpLoopMerge %16 %17 None
               OpBranch %18
         %18 = OpLabel
               OpSelectionMerge %19 None
               OpBranchConditional %true %20 %20
         %20 = OpLabel
               OpBranch %19
         %19 = OpLabel
               OpBranch %17
         %17 = OpLabel
               OpBranch %15
         %16 = OpLabel
               OpBranch %14
         %14 = OpLabel
               OpReturn
               OpFunctionEnd

reproducer.zip