Ok, I managed to reproduce the crash locally (it was not that easy) At the point of failure the node passes verification and I suppose problem is that the call stmt hash contains indirect call while it is supposed to contain direct call.
Edge removal code probably replaces direct edge by indreict one since it does not know about additional speculations. I will continue tomorrow. Honza
