This archive contains the files required to reproduce the problem.

To reproduce, do:

spirv-opt -O small.spv -o temp.spv

I get:

SPIRV-Tools/source/opt/constants.cpp:189: spvtools::opt::Instruction* spvtools::opt::analysis::ConstantManager::GetDefiningInstruction(const spvtools::opt::analysis::Constant*, uint32_t, spvtools::opt::Module::inst_iterator*): Assertion `type_id == 0 || context()->get_type_mgr()->GetType(type_id) == c->type()' failed.

The .spv file comes from the attached .frag file, via glslangValidator.

The .frag file exhibits and out-of-bounds access: v is a vec4, and v[i] attempts to index v at 4.

I am unsure what the semantics of out-of-bounds accesses are in SPIR-V, but I note that an OpAccessChain, rather than an OpInBoundsAccessChain, is used; I would assume that the existence of OpInBoundsAccessChain means that OpAccessChain is supposed to account for the out-of-bounds case.

Found via https://github.com/google/graphicsfuzz.