<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/63042>63042</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            `IndirectBrExpandPass` Crashes due to PHI in `indirectbr` Destination
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          HazyFish
      </td>
    </tr>
</table>

<pre>
    ## Description

`IndirectBrExpandPass` could create invalid IR when the destination contains PHI instruction. This causes error `PHINode should have one entry for each predecessor of its parent basic block!` during verification.

Should we consider this as a bug for `IndirectBrExpandPass`, or should we not allow PHI in `indirectbr` destination?

## Minimal Reproduction

https://godbolt.org/z/1s5arzWPG

In this example, a new BB `switch_bb` is created to replace `indirectbr`. However, the PHI instruction in `bb1` is left unchanged and becomes invalid.

### Code

```ll
target triple = "wasm32"

@f.targets = constant [2 x ptr] [ptr blockaddress(@f, %bb1), ptr blockaddress(@f, %latch)]

define i8 @f(i32 %i, i32 %j) {
entry:
  %target0.ptr = getelementptr [2 x ptr], ptr @f.targets, i32 0, i32 %i
  %target0 = load ptr, ptr %target0.ptr
  indirectbr ptr %target0, [label %bb1, label %latch]

bb1:                                              ; preds = %latch, %entry
  %0 = phi i8 [ 2, %latch ], [ 1, %entry ]
  ret i8 %0

latch:                                            ; preds = %bb2, %bb1, %bb0
  %target1.ptr = getelementptr [2 x ptr], ptr @f.targets, i32 0, i32 %j
  %target1 = load ptr, ptr %target1.ptr
  indirectbr ptr %target1, [label %bb1, label %latch]
}
```

### Stack Trace

```console
*** IR Dump After Expand indirectbr instructions (indirectbr-expand) ***
define i8 @f(i32 %i, i32 %j) {
entry:
 %target0.ptr = getelementptr [2 x ptr], ptr @f.targets, i32 0, i32 %i
 %target0 = load ptr, ptr %target0.ptr, align 8
  %target0.switch_cast = ptrtoint ptr %target0 to i64
  br label %switch_bb

bb1: ; preds = %switch_bb
  %0 = phi i8 [ 2, %latch ], [ 1, %entry ]
  ret i8 %0

latch: ; preds = %switch_bb
  %target1.ptr = getelementptr [2 x ptr], ptr @f.targets, i32 0, i32 %j
  %target1 = load ptr, ptr %target1.ptr, align 8
  %target1.switch_cast = ptrtoint ptr %target1 to i64
  br label %switch_bb

switch_bb: ; preds = %latch, %entry
  %switch_value_phi = phi i64 [ %target0.switch_cast, %entry ], [ %target1.switch_cast, %latch ]
  switch i64 %switch_value_phi, label %bb1 [
    i64 2, label %latch
 ]
}
PHINode should have one entry for each predecessor of its parent basic block!
  %0 = phi i8 [ 2, %latch ], [ 1, %entry ]
in function f
LLVM ERROR: Broken function found, compilation aborted!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: /opt/compiler-explorer/clang-trunk/bin/opt -o /app/output.s -S --indirectbr-expand --print-after-all <source>
1.      Running pass 'Function Pass Manager' on module '<source>'.
2.      Running pass 'Module Verifier' on function '@f'
 #0 0x0000556ee5d8f48f llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-trunk/bin/opt+0x30a248f)
 #1 0x0000556ee5d8cf04 SignalHandler(int) Signals.cpp:0:0
 #2 0x00007f9d7e969420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #3 0x00007f9d7e43600b raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300b)
 #4 0x00007f9d7e415859 abort (/lib/x86_64-linux-gnu/libc.so.6+0x22859)
 #5 0x0000556ee338ffd4 llvm::UniqueStringSaver::save(llvm::StringRef) (.cold) StringSaver.cpp:0:0
 #6 0x0000556ee5ce40be (/opt/compiler-explorer/clang-trunk/bin/opt+0x2ff70be)
 #7 0x0000556ee572fe96 (anonymous namespace)::VerifierLegacyPass::runOnFunction(llvm::Function&) Verifier.cpp:0:0
 #8 0x0000556ee56816ca llvm::FPPassManager::runOnFunction(llvm::Function&) (/opt/compiler-explorer/clang-trunk/bin/opt+0x29946ca)
 #9 0x0000556ee5681859 llvm::FPPassManager::runOnModule(llvm::Module&) (/opt/compiler-explorer/clang-trunk/bin/opt+0x2994859)
#10 0x0000556ee5682440 llvm::legacy::PassManagerImpl::run(llvm::Module&) (/opt/compiler-explorer/clang-trunk/bin/opt+0x2995440)
#11 0x0000556ee33a923a main (/opt/compiler-explorer/clang-trunk/bin/opt+0x6bc23a)
#12 0x00007f9d7e417083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#13 0x0000556ee34944ae _start (/opt/compiler-explorer/clang-trunk/bin/opt+0x7a74ae)
Compiler returned: 139
```

</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzMWE1z2zjS_jX0pUsqEPw-6GDZ0RtXJe-47NnZowokmxISCuACoGXn128BoCRS0mTjSWZrU05ikv3xdD_djSaZ1nwjEBdBsgyS-xvWm61Ui4_s29uK6-1NKeu3RUCjgEZwj7pSvDNcioDcB-R2-DclD6LmCiuzVB9eOybqR6Z1kBKoZN_WUClkBoGLF9byGh6eYL9FAWaLUKM2XDBrEiopDONCw-PHB-BCG9VX9sEcft9yDRXrNWpApaSCICWPHx_-X9YIeuucbNkLghQIKIx6g0YqQFZtoVNYY4VaSwWyAW40dEyhMFAyzSsoW1l9DWho4da94mIDL6h4wyuHaj6O9Nm72qPFqnmNCoyFxjQwKPuN8_rn6QjoHUh1ALxHENIAa1u5H0K2unzQLZVDdMpPEK0mWfecfOaC71gLT9gpWfuEjcW2xnQ6iG4DugroaiPrUrZmLtUmoKtvAV2FOmHq2z8f_2-s9CB8XPjKdl2LFjcDgXtYLi1Eveem2q7L0iK0zDh-azASFHYtq_AikDl8lHt8QWVtWeLPOB6CL8twsNliY6AX1ZaJDdbARA0lVnKH-lBH88ts2ITcyRrPqtP_tK2_YZjaoAGjeNciBNE9BJTumd5FNKB0ohqTZu7FtRO0rBsmDATJksIrdEYFyb296ozylcTqWqHWAc2tto02oIkNixb24vtyLTPV1kom92McNTZcIPAcvGzOI2rFuVUbfv8S0AKCbOk1XA9Y1t0VWAEfB5lbBDaWDRpscYfCuDvjgA5Ax_EfXJGRT35p3pluJaudqYOdifeD0qk-zoRcMpJly0psj9m7g-O1z9I0RVYmuoV3_QmipZsOeiiCQ_odFT6Dp_h8ZN2WOxqSJdAxZzBkzT4IxxbgiBNAoXHKNCFj6N7r-8BfQC9LOq614TdyQVD4K_n_cmn--_yHP8J_-E7-s_uzRr8-F54Nq77C74pV18eD7W3ZHp7R4cceVvf9roPbxqACP87H0EczTINtzeOjGTph15cHc7-on__edn5fN9uzoeUbAfmVYTOcFBXTxvePUUZyYc4M2ZODp_HBQKlOZJ_Omstuv-iCM-H_VuP-EI7_nf77DmPhDzIWvpex081r-fre4B00X1jb49rSeKQzjR1t18vtgsuB5OuhXpTE4N-LeFeXUCZTqSxD6-CgCU6JXhlcQ5NdzK9fvc_-whbgAppe-EWt8bc-ffrjM3x4evrtyTK6VPIrjoVkbyffHVRy1_HW7_eslMpgfcT2-OnD7fMH0H2542ZYoBV2UhlbXWeLKzfbvpxXchfQVdu-HP6bdUp-wcoEdMW17lEHdAV-RFdtX6PbNSvF9BZKVn01dvwPi6M_EOp-1x0HK5kHpHhUcqPYDpja9LY9tStZupKd9eIDQjfdW6nsQruqWiY2M6N68TWgq5ILLw0zafVY19nr3nS9mWuYPcNsdnFKwGzWKS7MjNlzZsbaFoLoTsteVRhEHzy80MJ76oWwLykd0_bAyVaHnNuXDPjMBNtYUBlIATtZ93bHpdnEGM2GFNBrBj97pT_cS9DR1JFaa8ydWtnxuIgIkFdCCEmSFDGp8ybOG3AsRbdBdKvftP_l0Ybo8u7PYZqfhBTbr6U2CtkuoKmbcsL4wzP_K9kP6JK8RoTROG_sSn0EG56BrRoSwzPfCNZ-ZKJurdF88O1v63nV2SIh7u_REB0MZU1RZ1ikRUwJrNcKtZEK18oM0FteBnT1mqfrNJ61XPSvs43o_YPObBWyeq7lnDjEYRxTMsEbTdzEUUpICYpxjT9gv7KWU2c5jggpJ5bjqeUwyZPCd-n7LFOaJ8XEcjLOcRTlTVPHo4L4h-D_6vHZ2LftZ2bfCn2dsJdpTXiJJ2yGOphXsnUL1Uj1OjfphOQKY1LiT1USbZqMlDiJMps4yWiDRWqdMCHF2072GgTboe5cqRc-pENbfcINq97chwFf_r34TRx6eZKE083Uhn4wcD3ufAIpzcO0YqPErx6tx8OQeJ_jn8peUcRpxSbZK86h2ur7z1D9eJoAPdz6JTDHpWynBTmDSeOYjGC2jsdhvJ0AP-y69gj6bwObxDGZgA2nfccKGjHYMS5-ylNaVjRiE0f0bHRkJI9gvbZzYa0NU2Y98vqjYyQmeTTxEk3CiYs4Zgje_k8FlLEsZqdevhvU7aLfK4G1PfHDqLj6XnlTL6K6iAp2g4swzZMki9OsuNku8iIs6iSr8ibGJsrKtKakCcsiwTJJsjq84QtKaESSKLRMhcW8aUrMGLKQ0LygjT1Xccd4O7fVMpdqc-N2mkUakZjeuDVSu--0lArcg3sYUBok9zdq4bahst_oICYt10afrBhuWlx85zPtnV2QUEPdo129_uxj5P3pY-RNr9rFX1_RXET_DgAA___jX6vq">