Index: lib/Transforms/InstCombine/InstCombineVectorOps.cpp
===================================================================
--- lib/Transforms/InstCombine/InstCombineVectorOps.cpp
+++ lib/Transforms/InstCombine/InstCombineVectorOps.cpp
@@ -611,7 +611,8 @@
   // until we hit something that isn't an insert of the splatted value.
   while (CurrIE) {
     ConstantInt *Idx = dyn_cast<ConstantInt>(CurrIE->getOperand(2));
-    if (!Idx || CurrIE->getOperand(1) != SplatVal)
+    if (!Idx || Idx->getSExtValue() >= NumElements ||
+        CurrIE->getOperand(1) != SplatVal)
       return nullptr;
 
     InsertElementInst *NextIE =
Index: test/Transforms/InstCombine/out-of-bounds-indexes.ll
===================================================================
--- test/Transforms/InstCombine/out-of-bounds-indexes.ll
+++ test/Transforms/InstCombine/out-of-bounds-indexes.ll
@@ -11,3 +11,13 @@
 }
 
 declare void @llvm.assume(i1)
+
+define void @test(<4 x double> %a, <4 x double> %b) {
+entry:
+  %sub.i = fsub ninf <4 x double> %a, %b
+  %I = insertelement <4 x double> %sub.i, double 0x7FEFFFFFFFFFFFFF, i64 4294967296
+  %B = lshr i8 127, 0
+  store i8 %B, i8* undef
+  store <4 x double> %I, <4 x double>* undef
+  ret void
+}