[BUG][Ascend] PlanMemory pass crashes with "buffer memory has been released"

[togepro]

Summary

PlanMemory pass (-hivm-plan-memory) crashes with assertion "The buffer memory has been released and cannot be used again!" when processing IR patterns containing nested scf.for → scf.if → scf.for control flow with arith.select creating buffer aliases. This pattern appears in real workloads such as FlashAttention forward kernels.

Environment

• Triton 3.5 (FlagTree triton_v3.5.x) Ascend 910B backend
• CANN : 9.1.0 beta.3 (bishengir-opt 1.1.0 (75ff276a5e4b 2026-06-25))

Minimal reproduction

module {
  // CHECK-LABEL: func.func @test_fa_select_alias_premature_kill
  func.func @test_fa_select_alias_premature_kill(%n: i32) attributes {
      hacc.entry,
      hacc.function_kind = #hacc.function_kind<DEVICE>,
      hivm.func_core_type = #hivm.func_core_type<AIV>} {
    %c0 = arith.constant 0 : i32
    %c1 = arith.constant 1 : i32
    %c2 = arith.constant 2 : i32
    %alloc = memref.alloc() {alignment = 64 : i64} : memref<64xf32, #hivm.address_space<ub>>
    %init = memref.alloc() {alignment = 64 : i64} : memref<64xf32, #hivm.address_space<ub>>
    // CHECK: scf.for
    %r = scf.for %iv = %c0 to %n step %c1 iter_args(%p = %init) -> (memref<64xf32, #hivm.address_space<ub>>)  : i32 {
      %cond = arith.cmpi slt, %iv, %n : i32
      %res = scf.if %cond -> (memref<64xf32, #hivm.address_space<ub>>) {
        %t0 = memref.alloc() {alignment = 64 : i64} : memref<64xf32, #hivm.address_space<ub>>
        hivm.hir.copy ins(%alloc : memref<64xf32, #hivm.address_space<ub>>)
                      outs(%t0 : memref<64xf32, #hivm.address_space<ub>>)
        // CHECK: scf.for
        %inner = scf.for %jv = %c0 to %c2 step %c1 iter_args(%ja = %t0) -> (memref<64xf32, #hivm.address_space<ub>>)  : i32 {
          %flag = arith.cmpi eq, %jv, %c0 : i32
          %tmp = memref.alloc() {alignment = 64 : i64} : memref<64xf32, #hivm.address_space<ub>>
          hivm.hir.copy ins(%alloc : memref<64xf32, #hivm.address_space<ub>>)
                        outs(%tmp : memref<64xf32, #hivm.address_space<ub>>)
          %s = arith.select %flag, %tmp, %ja : memref<64xf32, #hivm.address_space<ub>>
          %out = memref.alloc() {alignment = 64 : i64} : memref<64xf32, #hivm.address_space<ub>>
          hivm.hir.copy ins(%s : memref<64xf32, #hivm.address_space<ub>>)
                        outs(%out : memref<64xf32, #hivm.address_space<ub>>)
          scf.yield %out : memref<64xf32, #hivm.address_space<ub>>
        }
        scf.yield %inner : memref<64xf32, #hivm.address_space<ub>>
      } else {
        scf.yield %p : memref<64xf32, #hivm.address_space<ub>>
      }
      scf.yield %res : memref<64xf32, #hivm.address_space<ub>>
    }
    return
  }
}