From 9f1da8432d2c0079774d65166fd89c4da109ac33 Mon Sep 17 00:00:00 2001
From: David Majnemer <david.majnemer@gmail.com>
Date: Wed, 21 Oct 2015 18:22:24 +0000
Subject: [PATCH] [SimplifyCFG] Don't use-after-free an SSA value

SimplifyTerminatorOnSelect didn't consider the possibility that the
condition might be related to one of PHI nodes.

This fixes PR25267.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@250922 91177308-0d34-0410-b5e6-96231b3b80d8
---
 lib/Transforms/Utils/SimplifyCFG.cpp   |  3 ++-
 test/Transforms/SimplifyCFG/PR25267.ll | 24 ++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 test/Transforms/SimplifyCFG/PR25267.ll

diff --git a/lib/Transforms/Utils/SimplifyCFG.cpp b/lib/Transforms/Utils/SimplifyCFG.cpp
index e98f3349eff..e435537c3a7 100644
--- a/lib/Transforms/Utils/SimplifyCFG.cpp
+++ b/lib/Transforms/Utils/SimplifyCFG.cpp
@@ -2571,7 +2571,8 @@ static bool SimplifyTerminatorOnSelect(TerminatorInst *OldTerm, Value *Cond,
     else if (Succ == KeepEdge2)
       KeepEdge2 = nullptr;
     else
-      Succ->removePredecessor(OldTerm->getParent());
+      Succ->removePredecessor(OldTerm->getParent(),
+                              /*DontDeleteUselessPHIs=*/true);
   }
 
   IRBuilder<> Builder(OldTerm);
diff --git a/test/Transforms/SimplifyCFG/PR25267.ll b/test/Transforms/SimplifyCFG/PR25267.ll
new file mode 100644
index 00000000000..a13d45a0f27
--- /dev/null
+++ b/test/Transforms/SimplifyCFG/PR25267.ll
@@ -0,0 +1,24 @@
+; RUN: opt < %s -simplifycfg -S | FileCheck %s
+
+define void @f() {
+entry:
+  br label %for.cond
+
+for.cond:
+  %phi = phi i1 [ false, %entry ], [ true, %for.body ]
+  %select = select i1 %phi, i32 1, i32 2
+  br label %for.body
+
+for.body:
+  switch i32 %select, label %for.cond [
+    i32 1, label %return
+    i32 2, label %for.body
+  ]
+
+return:
+  ret void
+}
+
+; CHECK-LABEL: define void @f(
+; CHECK: br label %[[LABEL:.*]]
+; CHECK: br label %[[LABEL]]
-- 
2.34.1