https://bugs.freedesktop.org/show_bug.cgi?id=84232
--- Comment #12 from Vitaliy Filippov vitalif@yourcmc.ru --- Hm... Checked the test from comment 6, the result is the same - there are two PHINode loops and one branch on constant.
Also checked the code, it looks like crash from comment 6 is also triggered by a branch-on-constant, the difference is that it crashes when a ConstantInt is dyn_cast<>'ed to incorrect class - Instruction (ConstantInt isn't an Instruction!!) in handleLoopCondition() and getTerminator() is called on it.