Bail out instead of asserting when we encounter this situation - which can actually happen.
Note that the assert I removed doesn't actually get hit (because it checks the wrong condition), but we assert a bit further down the line.
The reason the test uses the new PM is that the "bad" phi - incidentally - gets cleaned up by LoopSimplify. But LICM can create this kind of phi and preserve loop simplify form, so the cleanup has no chance to run.
This fixes PR31190.
We may want to solve this in a less conservative manner, since this phi is actually uniform within the inner loop (or we may want LICM to output a cleaner promotion to begin with), but I'd rather fix the crash for now.
Can you add the source code to the comments? You try to vectorize the "for.body3" loop, right? What PHI belongs to the outer loop?