$ cat test.cpp
class A {};
class B {
public:
  A m_fn1();
};
class C {
public:
  C();
  void operator&(A);
};
using InterfaceId = int;
class D;
class F {
  class G;
  enum ClientCallBehavior {};
  bool m_fn2(D *, ClientCallBehavior *);
  void m_fn3();
  G *m_fn4(InterfaceId, bool);
};
class F::G {
public:
  bool m_fn5() { return closed_; }
  bool closed_;
};

bool a;
bool F::m_fn2(D *p1, ClientCallBehavior *) {
  A b;
  InterfaceId c = 0;
  G *d = m_fn4(c, a);
  if (d->m_fn5())
    return true;
  if (d)
    return false;
  B().m_fn1();
  C() & b;
  if (p1)
    m_fn3();
  return true;
}

$ clang++ -fstack-protector --target=arm-linux-androideabi -march=armv7-a -mthumb -Os -fsanitize=address -std=gnu++11 -c test.cpp
[...]
*** Bad machine code: MBB exits via unconditional fall-through but its successor differs from its CFG successor! ***
- function:    _ZN1F5m_fn2EP1DPNS_18ClientCallBehaviorE
- basic block: BB#6 (null) (0x4fb3df0)

*** Bad machine code: MBB exits via unconditional fall-through but its successor differs from its CFG successor! ***
- function:    _ZN1F5m_fn2EP1DPNS_18ClientCallBehaviorE
- basic block: BB#8 (null) (0x4fb3ea0)

*** Bad machine code: Using an undefined physical register ***
- function:    _ZN1F5m_fn2EP1DPNS_18ClientCallBehaviorE
- basic block: BB#9 if.end5 (0x4f98b88)
- instruction: BUNDLE
- operand 166:   %R0_R1<imp-use,kill>

*** Bad machine code: Using an undefined physical register ***
- function:    _ZN1F5m_fn2EP1DPNS_18ClientCallBehaviorE
- basic block: BB#9 if.end5 (0x4f98b88)
- instruction: %R0<def> = tMOVr
- operand 4:   %R0<imp-use>

*** Bad machine code: Using an undefined physical register ***
- function:    _ZN1F5m_fn2EP1DPNS_18ClientCallBehaviorE
- basic block: BB#9 if.end5 (0x4f98b88)
- instruction: tBL
- operand 11:   %R0_R1<imp-use,kill>
fatal error: error in backend: Found 5 machine code errors.

I have reopened the Phabricator revision for this patch. Go there for a first analysis of the provided test case.

http://reviews.llvm.org/D20907

(In reply to comment #2)
> I have reopened the Phabricator revision for this patch. Go there for a
> first analysis of the provided test case.
> 
> http://reviews.llvm.org/D20907

Commented there. For tracking purposes summarizing what I said.
I believe the patch itself is correct but the liveness information we get within IfConversion is incorrect and we need to figure out why.

I reran this test case after re-commiting the bug fix for IfConversion. The live-in lists are indeed more reasonable (thanks to Matthias' fix on https://reviews.llvm.org/D22027), and the particular error we saw before here is now gone :-)

However, this test case gets stopped by the verifier at a later stage, after "Unpack machine instruction bundles". Not sure what is going on there...