https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126876
--- Comment #14 from GCC Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by Aldy Hernandez <[email protected]>: https://gcc.gnu.org/g:92a49b653b21fc8cf55c114e24a83d6f40d19f2b commit r17-3356-g92a49b653b21fc8cf55c114e24a83d6f40d19f2b Author: Aldy Hernandez <[email protected]> Date: Mon Aug 17 14:51:59 2026 +0000 testsuite: reproducers for PR126876 ICE-on-valid at -O2 in the thread pass since r17-3298: the path query becomes the current query during fold_using_range::fold_stmt, match.pd's gimple_match_range_of_expr then queries it with a context statement resolved via gimple_match_ctx to SSA_NAME_DEF_STMT of a capture -- a statement from an arbitrary block. internal_range_of_expr feeds gimple_bb (stmt) to range_defined_in_block, and for a PHI, ssa_range_in_phi resolves the incoming edge positionally via prev_bb () -- valid only when the PHI's block is the current path position. Out of position, find_edge (prev, bb) is NULL (here prev == bb: the PHI's block is m_path[m_pos + 1]) and the EDGE_ABNORMAL checking assert's e_in->flags dereference segfaults. No abnormal edges are involved; the assert line is merely the first dereference -- the pre-assert PHI_ARG_DEF_FROM_EDGE would have crashed identically. PR tree-optimization/126876 * gcc.dg/tree-ssa/pr126876.c: New test.
