ExpressionSimplifier references variables declared in loop body when simplifying the post block

[lum7na]

Description

Hi! I tried to compile the following Solidity code using solc-latest --optimize --yul-optimizations 'xajs' --bin out.sol, enabling the custom optimization sequence xajs. solc threw an Invalid assembly/yul code exception.

contract Test {

  function g() private returns(bool) {
    assembly  {
      for {
        let x := 1
        let y := 1
      }
      iszero(eq(x, 10))
      {
        x := add(x, y)
      }
      { x := add(x, 1) }
    }
    return true;
  }


  function f() public returns(bool) {
    return g();
  }
}

Output:

Uncaught exception:
/solidity/libyul/AsmAnalysis.cpp(111): Throw in function static solidity::yul::AsmAnalysisInfo solidity::yul::AsmAnalyzer::analyzeStrictAssertCorrect(const solidity::yul::Dialect&, const solidity::yul::Block&, solidity::yul::Object::Structure)
Dynamic exception type: boost::wrapexcept<solidity::yul::YulAssertion>
std::exception::what: Invalid assembly/yul code.
[solidity::util::tag_comment*] = Invalid assembly/yul code.

Environment

• Compiler version: solc-0.8.25+

[cameel]

Simplified repro:

test.yul:

{
    for { let x := 1 } true { x := add(x, 1) }
    {
        let x_1 := x
        x := add(x_1, 1)
    }
}

solc --strict-assembly test.yul --optimize --yul-optimizations 's:' --ir-optimized

With #15907 the output looks like this:

Yul assertion failed:
/solidity/libyul/AsmAnalysis.cpp(133): Throw in function static solidity::yul::AsmAnalysisInfo solidity::yul::AsmAnalyzer::analyzeStrictAssertCorrect(const solidity::yul::Dialect&, const solidity::yul::Block&, solidity::yul::Object::Structure)
Dynamic exception type: boost::wrapexcept<solidity::yul::YulAssertion>
std::exception::what: {
    {
        let x := 1
        for { } true { x := add(x_1, 2) }
        {
            let x_1 := x
            x := add(x_1, 1)
        }
    }
}

Expected valid Yul, but errors were reported during analysis:
- DeclarationError 8198: Identifier "x_1" not found.

Looks like ExpressionSimplifier incorrectly assumes that variables declared in loop body are also in scope in the post block. This is detected as error during analysis.