Ignore indirect branches from callbr.

[void]

Summary

We can't speculate around indirect branches: indirectbr and invoke. The
callbr instruction needs to be included here.

[chandlerc]

LGTM.

Also LGTM for cherrypick to the release branch.

lib/Transforms/Scalar/SpeculateAroundPHIs.cpp

for (auto *PredBB : PNs[0]->blocks()) {
     if (!PredSet.insert(PredBB))
       continue;
 
     // We cannot speculate when a predecessor is an indirect branch.
     // FIXME: We also can't reliably create a non-critical edge block for
     // speculation if the predecessor is an invoke. This doesn't seem
     // fundamental and we should probably be splitting critical edges
     // differently.
-    if (isa<IndirectBrInst>(PredBB->getTerminator()) ||
-        isa<InvokeInst>(PredBB->getTerminator())) {
+    const auto *TermInst = PredBB->getTerminator();
+    if (isa<IndirectBrInst>(TermInst) ||
+        isa<InvokeInst>(TermInst) ||
+        isa<CallBrInst>(TermInst)) {
       LLVM_DEBUG(dbgs() << "  Invalid: predecessor terminator: "
                         << PredBB->getName() << "\n");
       return false;
     }
   }
   if (PredSet.size() < 2) {
     LLVM_DEBUG(dbgs() << "  Unimportant: phi with only one predecessor\n");
     return false;

test/Transforms/SpeculateAroundPHIs/pr42991.ll

+; RUN: opt -S -passes=spec-phis %s
+
+; This testcase crashes during the speculate around PHIs pass. The pass however
+; results in no changes.
+
+define i32 @test1() {
+entry:
+  callbr void asm sideeffect "", "X,X,~{dirflag},~{fpsr},~{flags}"(i8* blockaddress(@test1, %return), i8* blockaddress(@test1, %f))
+          to label %asm.fallthrough [label %return, label %f]
+
+asm.fallthrough:
+  br label %return
+
+f:
+  br label %return
+
+return:
+  %retval.0 = phi i32 [ 0, %f ], [ 1, %asm.fallthrough ], [ 1, %entry ]
+  ret i32 %retval.0
+}
+
+define void @test2() {
+entry:
+  br label %tailrecurse
+
+tailrecurse:
+  %call = tail call i32 @test3()
+  %tobool1 = icmp eq i32 %call, 0
+  callbr void asm sideeffect "", "X,X,~{dirflag},~{fpsr},~{flags}"(i8* blockaddress(@test2, %test1.exit), i8* blockaddress(@test2, %f.i))
+          to label %if.end6 [label %test1.exit, label %f.i]
+
+f.i:
+  br label %test1.exit
+
+test1.exit:
+  %retval.0.i = phi i1 [ false, %f.i ], [ true, %tailrecurse ]
+  %brmerge = or i1 %tobool1, %retval.0.i
+  br i1 %brmerge, label %if.end6, label %tailrecurse
+
+if.end6:
+  ret void
+}
+
+declare i32 @test3()