Index: llvm/lib/Target/X86/X86ISelDAGToDAG.cpp
===================================================================
--- llvm/lib/Target/X86/X86ISelDAGToDAG.cpp
+++ llvm/lib/Target/X86/X86ISelDAGToDAG.cpp
@@ -755,6 +755,8 @@
 }
 
 void X86DAGToDAGISel::PreprocessISelDAG() {
+  bool RemoveDeadNodes = false;
+
   for (SelectionDAG::allnodes_iterator I = CurDAG->allnodes_begin(),
        E = CurDAG->allnodes_end(); I != E; ) {
     SDNode *N = &*I++; // Preincrement iterator to avoid invalidation issues.
@@ -829,6 +831,10 @@
         continue;
       moveBelowOrigChain(CurDAG, Load, SDValue(N, 0), Chain);
       ++NumLoadMoved;
+      // This transform can leave dead token factor nodes. Make sure we find
+      // and remove them.
+      // FIXME: Should we be more precise on when to do this?
+      RemoveDeadNodes = true;
       continue;
     }
 
@@ -899,6 +905,9 @@
     ++I;
     CurDAG->DeleteNode(N);
   }
+
+  if (RemoveDeadNodes)
+    CurDAG->RemoveDeadNodes();
 }
 
 // Look for a redundant movzx/movsx that can occur after an 8-bit divrem.
Index: llvm/test/CodeGen/X86/fold-call-3.ll
===================================================================
--- llvm/test/CodeGen/X86/fold-call-3.ll
+++ llvm/test/CodeGen/X86/fold-call-3.ll
@@ -1,5 +1,7 @@
 ; RUN: llc < %s -mtriple=x86_64-apple-darwin | grep call | grep 560
 ; rdar://6522427
+; This command line used to crash due to dangling nodes left after PreprocessISelDAG
+; RUN: llc < %s -mtriple=x86_64-apple-darwin -pre-RA-sched=linearize
 
 	%"struct.clang::Action" = type { %"struct.clang::ActionBase" }
 	%"struct.clang::ActionBase" = type { i32 (...)** }