Index: llvm/lib/Transforms/Scalar/SimplifyCFGPass.cpp
===================================================================
--- llvm/lib/Transforms/Scalar/SimplifyCFGPass.cpp
+++ llvm/lib/Transforms/Scalar/SimplifyCFGPass.cpp
@@ -104,6 +104,21 @@
       continue;
     }
 
+    // Skip merging if this would result in a CallBr instruction with a
+    // duplicate destination. FIXME: See note in CodeGenPrepare.cpp.
+    bool SkipCallBr = false;
+    for (pred_iterator PI = pred_begin(&BB), E = pred_end(&BB);
+         PI != E && !SkipCallBr; ++PI) {
+      if (auto *CBI = dyn_cast<CallBrInst>((*PI)->getTerminator()))
+        for (unsigned i = 0, e = CBI->getNumSuccessors(); i != e; ++i)
+          if (RetBlock == CBI->getSuccessor(i)) {
+            SkipCallBr = true;
+            break;
+          }
+    }
+    if (SkipCallBr)
+      continue;
+
     // Otherwise, we found a duplicate return block.  Merge the two.
     Changed = true;
 
Index: llvm/test/Transforms/SimplifyCFG/callbr-destinations.ll
===================================================================
--- /dev/null
+++ llvm/test/Transforms/SimplifyCFG/callbr-destinations.ll
@@ -0,0 +1,28 @@
+; RUN: opt < %s -simplifycfg -disable-output
+;
+; Test that SimplifyCFG does not cause CallBr instructions to have duplicate
+; destinations, which will cause the verifier to assert.
+
+define void @fun0() {
+entry:
+  callbr void asm sideeffect "", "X"(i8* blockaddress(@fun0, %bb1))
+          to label %bb2 [label %bb1]
+
+bb1:                                              ; preds = %bb
+  ret void
+
+bb2:                                             ; preds = %bb
+  ret void
+}
+
+define void @fun1() {
+entry:
+  callbr void asm sideeffect "", "X"(i8* blockaddress(@fun1, %bb1))
+          to label %bb2 [label %bb1]
+
+bb2:                                             ; preds = %bb
+  ret void
+
+bb1:                                              ; preds = %bb
+  ret void
+}