Running -jump-threading twice crashes opt in ValueHandleBase::ValueIsDeleted

Hi,

Running

build-all/bin/opt -S ./bugpoint-reduced-simplified.ll -jump-threading -jump-threading

on the attached bugpoint-reduced ll-file ends with

While deleting: label %bb1
An asserting value handle still pointed to this value!
UNREACHABLE executed at ../lib/IR/Value.cpp:686!

It's on the second invocation of jump-threading that it breaks, when it calls llvm::removeUnreachableBlocks:

0 opt 0x000000000163806a llvm::sys::PrintStackTrace(llvm::raw_ostream&) + 42
1 opt 0x0000000001637576 llvm::sys::RunSignalHandlers() + 86
2 opt 0x0000000001639893
3 libpthread.so.0 0x00007f57baa72340
4 libc.so.6 0x00007f57b9c9acc9 gsignal + 57
5 libc.so.6 0x00007f57b9c9e0d8 abort + 328
6 opt 0x00000000015f874d llvm::llvm_unreachable_internal(char const*, char const*, unsigned int) + 461
7 opt 0x00000000012a2ebb llvm::ValueHandleBase::ValueIsDeleted(llvm::Value*) + 1051
8 opt 0x00000000012a282b llvm::Value::~Value() + 43
9 opt 0x0000000001164cf9 llvm::BasicBlock::~BasicBlock() + 9
10 opt 0x00000000016749ec llvm::removeUnreachableBlocks(llvm::Function&) + 2956
11 opt 0x00000000014c2be7
12 opt 0x00000000012727ec llvm::FPPassManager::runOnFunction(llvm::Function&) + 524
13 opt 0x0000000001272a2b llvm::FPPassManager::runOnModule(llvm::Module&) + 43
14 opt 0x0000000001272f27 llvm::legacy::PassManagerImpl::run(llvm::Module&) + 935
15 opt 0x0000000000602304 main + 8164
16 libc.so.6 0x00007f57b9c85ec5 __libc_start_main + 245
17 opt 0x00000000005f3882

The code looks like this when jump-threading is invoked the second time:

*** IR Dump Before Jump Threading ***
define void @fn1() {
.split.us:
   br label %bb2.us.us

bb2.us.us: ; preds = %bb2.us.us, %.split.us
   br label %bb2.us.us

bb1.us: ; preds = %bb1.us
   br label %bb1.us

bb2.us4: ; preds = %bb2.us4
   br label %bb2.us4

bb2: ; preds = %bb1
   %_tmp3 = icmp slt i16 %_tmp18, 2
   br i1 %_tmp3, label %bb1, label %bb1

bb1: ; preds = %bb2, %bb2
   %_tmp18 = load i16, i16* @c
   %_tmp20 = icmp ne i16 %_tmp18, 0
   br i1 %_tmp20, label %bb2, label %bb6

bb6: ; preds = %bb1
   ret void
}

And when it tries to delete bb1 it crashes.

(We're not really that interested in running -jump-threading twice, but our test runs randomizes the opt flags and stumbled upon this.)

Should I write a TR on this or is this the expected outcome?

Regards,
Mikael

bugpoint-reduced-simplified.ll (1.82 KB)