I came across two cases where instructions were being inserted above EH pad instructions that don't allow non-PHI instructions before the terminator. In one case, CodeGenPrepare was trying to sink a bitcast into a catchpad. In another case, GVN was trying to PRE a load in front of a catchpadend.
The precise conditions under which these circumstances arise are a bit involved, I think. I saw it on a branched project while compiling template-based code and couldn't come up with reduced C++ code that reproduces the problem on trunk, but both of the new IR test cases I'm adding failed for me before I applied my code changes.