Filter callbr insts from critical edge splitting

Similarly to how splitting predecessors with an indirectbr isn't handled
in the generic way, we also shouldn't split callbrs, for similar
reasons.

(cherry picked from commit 2fe4576)

llvm/lib/Transforms/Scalar/LICM.cpp

@@ -1537,7 +1537,8 @@ static bool canSplitPredecessors(PHINode *PN, LoopSafetyInfo *SafetyInfo) {
     return false;
   for (pred_iterator PI = pred_begin(BB), E = pred_end(BB); PI != E; ++PI) {
     BasicBlock *BBPred = *PI;
-    if (isa<IndirectBrInst>(BBPred->getTerminator()))
+    if (isa<IndirectBrInst>(BBPred->getTerminator()) ||
+        isa<CallBrInst>(BBPred->getTerminator()))
       return false;
   }
   return true;

llvm/lib/Transforms/Utils/BasicBlockUtils.cpp

@@ -505,7 +505,8 @@ llvm::SplitAllCriticalEdges(Function &F,
   unsigned NumBroken = 0;
   for (BasicBlock &BB : F) {
     Instruction *TI = BB.getTerminator();
-    if (TI->getNumSuccessors() > 1 && !isa<IndirectBrInst>(TI))
+    if (TI->getNumSuccessors() > 1 && !isa<IndirectBrInst>(TI) &&
+        !isa<CallBrInst>(TI))
       for (unsigned i = 0, e = TI->getNumSuccessors(); i != e; ++i)
         if (SplitCriticalEdge(TI, i, Options))
           ++NumBroken;

llvm/test/Transforms/LICM/callbr-crash.ll

@@ -0,0 +1,18 @@
+; RUN: opt -licm -disable-output < %s
+
+define i32 @j() {
+entry:
+  br label %for.cond
+
+for.cond:                                         ; preds = %cond.true.i, %entry
+  callbr void asm sideeffect "", "X,~{dirflag},~{fpsr},~{flags}"(i8* blockaddress(@j, %for.end))
+          to label %cond.true.i [label %for.end]
+
+cond.true.i:                                      ; preds = %for.cond
+  %asmresult1.i.i = extractvalue { i8, i32 } zeroinitializer, 1
+  br i1 undef, label %for.end, label %for.cond
+
+for.end:                                          ; preds = %cond.true.i, %for.cond
+  %asmresult1.i.i2 = phi i32 [ %asmresult1.i.i, %cond.true.i ], [ undef, %for.cond ]
+  ret i32 undef
+}