r205941 changed the logic, so that a cast happens *before* 'Result' is compared to 'AddrMode.BaseReg'.
In the case that 'AddrMode.BaseReg' is nullptr, 'Result' will also be nullptr, so the cast causes an assertion.
We should use dyn_cast_or_null here to check 'Result' is not null and it is an instruction.
Bug found by Mats Petersson, and I reduced his IR to get a test case.
Also r205941 didn't have a test case, so it'd be good to get one for that commit too.