Bug type: crash
Component: SimplifyCFG
Bug location: llvm/lib/Transforms/Utils/SimplifyCFG.cpp: simplifySwitchWhenUMin
Issue title: [simplifycfg] number of prof branch_weights metadata operands does not correspond to number of succesors
Labels: crash-on-valid
llvm:transforms
Reported by: TatyanaDoubts

To reproduce run opt with the test below, -passes=simplifycfg 

[reduced-stripped.ll.zip](https://github.com/user-attachments/files/25368313/reduced-stripped.ll.zip)

Reproducer: https://godbolt.org/z/TfbKohbnP

Stack dump:
```
0.	Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/opt -o /app/output.s -S -passes=simplifycfg <source>
1.	Running pass "function(simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;no-switch-range-to-icmp;no-switch-to-arithmetic;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>)" on module "<source>"
2.	Running pass "simplifycfg<bonus-inst-threshold=1;no-forward-switch-cond;no-switch-range-to-icmp;no-switch-to-arithmetic;no-switch-to-lookup;keep-loops;no-hoist-common-insts;no-hoist-loads-stores-with-cond-faulting;no-sink-common-insts;speculate-blocks;simplify-cond-branch;no-speculate-unpredictables>" on function "quux"
 #0 0x0000000005b8a888 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5b8a888)
 #1 0x0000000005b87764 SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007b6109242520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #3 0x00007b61092969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #4 0x00007b6109242476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #5 0x00007b61092287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #6 0x0000000005aba3da (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5aba3da)
 #7 0x0000000005869c8b (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x5869c8b)
 #8 0x0000000004e0da68 simplifySwitchWhenUMin(llvm::SwitchInst*, llvm::DomTreeUpdater*) SimplifyCFG.cpp:0:0
 #9 0x0000000004e338ef (anonymous namespace)::SimplifyCFGOpt::simplifySwitch(llvm::SwitchInst*, llvm::IRBuilder<llvm::ConstantFolder, llvm::IRBuilderDefaultInserter>&) SimplifyCFG.cpp:0:0
#10 0x0000000004e39b35 llvm::simplifyCFG(llvm::BasicBlock*, llvm::TargetTransformInfo const&, llvm::DomTreeUpdater*, llvm::SimplifyCFGOptions const&, llvm::ArrayRef<llvm::WeakVH>) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4e39b35)
#11 0x0000000004a18ab4 iterativelySimplifyCFG(llvm::Function&, llvm::TargetTransformInfo const&, llvm::DomTreeUpdater*, llvm::SimplifyCFGOptions const&) SimplifyCFGPass.cpp:0:0
#12 0x0000000004a19a14 simplifyFunctionCFGImpl(llvm::Function&, llvm::TargetTransformInfo const&, llvm::DominatorTree*, llvm::SimplifyCFGOptions const&) SimplifyCFGPass.cpp:0:0
#13 0x0000000004a1abe5 simplifyFunctionCFG(llvm::Function&, llvm::TargetTransformInfo const&, llvm::DominatorTree*, llvm::SimplifyCFGOptions const&) SimplifyCFGPass.cpp:0:0
#14 0x0000000004a1ad2a llvm::SimplifyCFGPass::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x4a1ad2a)
#15 0x000000000174221e llvm::detail::PassModel<llvm::Function, llvm::SimplifyCFGPass, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x174221e)
#16 0x00000000058f5961 llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x58f5961)
#17 0x0000000000f1420e llvm::detail::PassModel<llvm::Function, llvm::PassManager<llvm::Function, llvm::AnalysisManager<llvm::Function>>, llvm::AnalysisManager<llvm::Function>>::run(llvm::Function&, llvm::AnalysisManager<llvm::Function>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0xf1420e)
#18 0x00000000058f3f1a llvm::ModuleToFunctionPassAdaptor::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x58f3f1a)
#19 0x000000000096bdfe llvm::detail::PassModel<llvm::Module, llvm::ModuleToFunctionPassAdaptor, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x96bdfe)
#20 0x00000000058f38d1 llvm::PassManager<llvm::Module, llvm::AnalysisManager<llvm::Module>>::run(llvm::Module&, llvm::AnalysisManager<llvm::Module>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x58f38d1)
#21 0x0000000000975fba llvm::runPassPipeline(llvm::StringRef, llvm::Module&, llvm::TargetMachine*, llvm::TargetLibraryInfoImpl*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::ToolOutputFile*, llvm::StringRef, llvm::ArrayRef<llvm::PassPlugin>, llvm::ArrayRef<std::function<void (llvm::PassBuilder&)>>, llvm::opt_tool::OutputKind, llvm::opt_tool::VerifierKind, bool, bool, bool, bool, bool, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x975fba)
#22 0x000000000096a068 optMain (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x96a068)
#23 0x00007b6109229d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#24 0x00007b6109229e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#25 0x0000000000960ce5 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/opt+0x960ce5)
Program terminated with signal: SIGSEGV
Compiler returned: 139
```

[reduced-stripped.ll.zip](https://github.com/user-attachments/files/25368310/reduced-stripped.ll.zip)

Comments: author: antoniofrighetto
body: Maybe cc/ @mtrofin

Fix patch:
commit 31e5f86a3cdc960ef7b2f0a533c4a37cf526cacd
Author: Congcong Cai <congcongcai0907@163.com>
Date:   Fri Feb 20 07:03:27 2026 +0800

    [SimplifyCFG] process prof data when remove case in umin (#182261)
    
    In #164097, we introduce a optimization for umin. But it does not handle
    profile data correctly.
    This PR remove profile data when remove cases.
    Fixed: #181837

diff --git a/llvm/lib/Transforms/Utils/SimplifyCFG.cpp b/llvm/lib/Transforms/Utils/SimplifyCFG.cpp
index 8b56109990b2..b912baef6188 100644
--- a/llvm/lib/Transforms/Utils/SimplifyCFG.cpp
+++ b/llvm/lib/Transforms/Utils/SimplifyCFG.cpp
@@ -7724,7 +7724,7 @@ static bool simplifySwitchWhenUMin(SwitchInst *SI, DomTreeUpdater *DTU) {
     BasicBlock *DeadCaseBB = I->getCaseSuccessor();
     DeadCaseBB->removePredecessor(BB);
     Updates.push_back({DominatorTree::Delete, BB, DeadCaseBB});
-    I = SIW->removeCase(I);
+    I = SIW.removeCase(I);
     E = SIW->case_end();
   }
 


Regression tests:
file: llvm/test/Transforms/SimplifyCFG/switch-umin.ll
commands: opt -S -passes=simplifycfg < %s
tests: test_name: switch_remove_dead_cases
test_body: declare void @a()

declare void @b()

define void @switch_remove_dead_cases(i32 %x) {
  %min = call i32 @llvm.umin.i32(i32 %x, i32 4)
  switch i32 %min, label %unreachable [
    i32 2, label %case_a
    i32 3, label %case_b
    i32 4, label %case_ret
    i32 5, label %case_ret
  ], !prof !0

case_a:                                           ; preds = %0
  call void @a()
  ret void

case_b:                                           ; preds = %0
  call void @b()
  ret void

case_ret:                                         ; preds = %0, %0
  ret void

unreachable:                                      ; preds = %0
  unreachable
}

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare i32 @llvm.umin.i32(i32, i32) #0

attributes #0 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }

!0 = !{!"branch_weights", i32 11, i32 12, i32 13, i32 14, i32 15}