Index: llvm/trunk/lib/Transforms/Scalar/Reassociate.cpp
===================================================================
--- llvm/trunk/lib/Transforms/Scalar/Reassociate.cpp
+++ llvm/trunk/lib/Transforms/Scalar/Reassociate.cpp
@@ -861,6 +861,8 @@
     if (TheNeg->getParent()->getParent() != BI->getParent()->getParent())
       continue;
 
+    bool FoundCatchSwitch = false;
+
     BasicBlock::iterator InsertPt;
     if (Instruction *InstInput = dyn_cast<Instruction>(V)) {
       if (InvokeInst *II = dyn_cast<InvokeInst>(InstInput)) {
@@ -868,10 +870,30 @@
       } else {
         InsertPt = ++InstInput->getIterator();
       }
-      while (isa<PHINode>(InsertPt)) ++InsertPt;
+
+      const BasicBlock *BB = InsertPt->getParent();
+
+      // Make sure we don't move anything before PHIs or exception
+      // handling pads.
+      while (InsertPt != BB->end() && (isa<PHINode>(InsertPt) ||
+                                       InsertPt->isEHPad())) {
+        if (isa<CatchSwitchInst>(InsertPt))
+          // A catchswitch cannot have anything in the block except
+          // itself and PHIs.  We'll bail out below.
+          FoundCatchSwitch = true;
+        ++InsertPt;
+      }
     } else {
       InsertPt = TheNeg->getParent()->getParent()->getEntryBlock().begin();
     }
+
+    // We found a catchswitch in the block where we want to move the
+    // neg.  We cannot move anything into that block.  Bail and just
+    // create the neg before BI, as if we hadn't found an existing
+    // neg.
+    if (FoundCatchSwitch)
+      break;
+
     TheNeg->moveBefore(&*InsertPt);
     if (TheNeg->getOpcode() == Instruction::Sub) {
       TheNeg->setHasNoUnsignedWrap(false);
Index: llvm/trunk/test/Transforms/Reassociate/reassociate-catchswitch.ll
===================================================================
--- llvm/trunk/test/Transforms/Reassociate/reassociate-catchswitch.ll
+++ llvm/trunk/test/Transforms/Reassociate/reassociate-catchswitch.ll
@@ -0,0 +1,41 @@
+; ModuleID = 'bugpoint-reduced-simplified.bc'
+source_filename = "catchswitch.cpp"
+target datalayout = "e-m:w-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-pc-windows-msvc19.11.0"
+
+define dso_local void @"?f@@YAX_N@Z"(i1 %b) local_unnamed_addr #0 personality i8* bitcast (i32 (...)* @__CxxFrameHandler3 to i8*) {
+entry:
+  br i1 %b, label %if.then, label %if.else
+
+if.then:                                          ; preds = %entry
+  invoke void @"?g@@YAXXZ"()
+          to label %cleanup unwind label %catch.dispatch
+
+if.else:                                          ; preds = %entry
+  invoke void @"?g2@@YAXXZ"()
+          to label %cleanup unwind label %catch.dispatch
+
+catch.dispatch:                                   ; preds = %if.else, %if.then
+  %z.0 = phi i32 [ 3, %if.then ], [ 5, %if.else ]
+  %0 = catchswitch within none [label %catch] unwind to caller
+
+catch:                                            ; preds = %catch.dispatch
+  %1 = catchpad within %0 [i8* null, i32 64, i8* null]
+  %blech = sub nsw i32 5, %z.0
+  %sub = sub nsw i32 %blech, %z.0
+  call void @"?use@@YAXHH@Z"(i32 %z.0, i32 %sub) [ "funclet"(token %1) ]
+  unreachable
+
+cleanup:                                          ; preds = %if.else, %if.then
+  ret void
+}
+
+declare dso_local void @"?g@@YAXXZ"() local_unnamed_addr #0
+
+declare dso_local i32 @__CxxFrameHandler3(...)
+
+declare dso_local void @"?g2@@YAXXZ"() local_unnamed_addr #0
+
+declare dso_local void @"?use@@YAXHH@Z"(i32, i32) local_unnamed_addr #0
+
+attributes #0 = { "use-soft-float"="false" }
Index: llvm/trunk/test/Transforms/Reassociate/reassociate-landingpad.ll
===================================================================
--- llvm/trunk/test/Transforms/Reassociate/reassociate-landingpad.ll
+++ llvm/trunk/test/Transforms/Reassociate/reassociate-landingpad.ll
@@ -0,0 +1,54 @@
+; Reassociate used to move the negation of $time_1_P14.0 above the
+; landingpad.
+;
+; RUN: opt -reassociate -disable-output < %s
+;
+; ModuleID = 'bugpoint-reduced-simplified.bc'
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+%"lp.2234.4378.7378.12512.15079.17646.20213.22780.25347.27914.40747.53580.74113.76680.86947.89514.92081.94648.115163.130561" = type { i8*, i32 }
+%__type_info.2235.4379.7379.12513.15080.17647.20214.22781.25348.27915.40748.53581.74114.76681.86948.89515.92082.94649.115162.130560 = type { i64*, i8* }
+
+declare i32 @__gxx_personality_v0(...)
+
+declare void @b() #0
+
+define void @a() #0 personality i32 (...)* @__gxx_personality_v0 {
+", bb1":
+  invoke void @b()
+          to label %invoke.cont unwind label %"bb22"
+
+", bb8":                                          ; preds = %invoke.cont
+  invoke void @c()
+          to label %invoke.cont25 unwind label %"bb22"
+
+", bb15":                                         ; preds = %invoke.cont
+  ret void
+
+"bb22":     ; preds = %", bb8", %", bb1"
+  %"$time_1_P14.0" = phi i64 [ undef, %", bb8" ], [ undef, %", bb1" ]
+  %0 = landingpad %"lp.2234.4378.7378.12512.15079.17646.20213.22780.25347.27914.40747.53580.74113.76680.86947.89514.92081.94648.115163.130561"
+          cleanup
+          catch %__type_info.2235.4379.7379.12513.15080.17647.20214.22781.25348.27915.40748.53581.74114.76681.86948.89515.92082.94649.115162.130560* null
+  %r79 = sub i64 0, %"$time_1_P14.0"
+  %r81 = add i64 %r79, undef
+  %r93 = add i64 %r81, undef
+  %r95 = sub i64 %r93, %"$time_1_P14.0"
+  %r98 = icmp ult i64 %r95, undef
+  unreachable
+
+invoke.cont:                                      ; preds = %", bb1"
+  br i1 undef, label %", bb15", label %", bb8"
+
+invoke.cont25:                                    ; preds = %", bb8"
+  unreachable
+}
+
+declare void @c() #0
+
+attributes #0 = { "no-frame-pointer-elim-non-leaf" }
+
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 1, !"Debug Info Version", i32 3}