The global-merge pass was crashing because it assumes that all ConstantExprs (reached via the global variables that they use) have at least one user.
I haven't worked out a way to test this, as an unused ConstantExpr cannot be represented by serialised IR, and global-merge can only be run in llc, which does not run any passes which can make a ConstantExpr dead.
This (reduced to the point of silliness) C code triggers this bug when compiled for arm-none-eabi at -O1:
static a = 7; static volatile b[10] = {&a}; c; main() { c = 0; for (; c < 10;) printf(b[c]); }