Index: llvm/lib/Transforms/IPO/AttributorAttributes.cpp
===================================================================
--- llvm/lib/Transforms/IPO/AttributorAttributes.cpp
+++ llvm/lib/Transforms/IPO/AttributorAttributes.cpp
@@ -9438,7 +9438,7 @@
     // Process callee metadata if available.
     if (auto *MD = getCtxI()->getMetadata(LLVMContext::MD_callees)) {
       for (auto &Op : MD->operands()) {
-        Function *Callee = mdconst::extract_or_null<Function>(Op);
+        Function *Callee = mdconst::dyn_extract_or_null<Function>(Op);
         if (Callee)
           addCalledFunction(Callee, Change);
       }
Index: llvm/test/Transforms/Attributor/callgraph.ll
===================================================================
--- llvm/test/Transforms/Attributor/callgraph.ll
+++ llvm/test/Transforms/Attributor/callgraph.ll
@@ -76,9 +76,22 @@
   ret void
 }
 
+; Check there's no crash if something that isn't a function appears in !callees
+define void @undef_in_callees() {
+; CHECK-LABEL: @undef_in_callees(
+; CHECK-NEXT:  cond.end.i:
+; CHECK-NEXT:    call void undef(i8* undef, i32 undef, i8* undef), !callees !3
+; CHECK-NEXT:    ret void
+;
+cond.end.i:
+  call void undef(i8* undef, i32 undef, i8* undef), !callees !3
+  ret void
+}
+
 !0 = !{!1}
 !1 = !{i64 0, i1 false}
 !2 = !{void ()* @func3, void ()* @func4}
+!3 = distinct !{void (i8*, i32, i8*)* undef, void (i8*, i32, i8*)* null}
 
 ; UTC_ARGS: --disable