C1's IR maintains bidirectional edges in the CFG and various passes which manipulate those edges verify that they are kept up to date. There are a few CFG optimizations near the end of linear scan which don't verify the final CFG. Adding verification in the appropriate places showed that substitute_sux was updating the edges in the wrong order resulting in incorrect predecessors edges in some cases. It's just luck as far as I can tell that we haven't hit this with other CFG manipulations.