This crashes:

#include "Halide.h"

using namespace Halide;

int main(int argc, char **argv) {
    Func f;
    RDom r(0, 100);
    Var x, y;
    f(x, y) = 0;
    f(x, y) += r;

    RVar yr;
    Var z;
    f.update().fuse(y, r, yr).rfactor(yr, z);

    return 0;
}

I believe the issue is that the rfactor code has to handle splits, but doesn't correctly handle fusing a Var with an RVar to produce an RVar. Also it doesn't do enough validation. This should be an internal assert failure rather than a crash.