https://gcc.gnu.org/g:f91e2ce3348941e24541861e55647267fc878c50
commit r15-11221-gf91e2ce3348941e24541861e55647267fc878c50 Author: Jakub Jelinek <[email protected]> Date: Thu Apr 16 10:02:16 2026 +0200 tree-ssa-propagate: Call update_stmt before folding [PR124891] The following testcase ICEs, because we did_replace |= substitute_and_fold_engine->replace_uses_in (stmt); and replace some SSA_NAME with INTEGER_CST and without update_stmt call fold_stmt. Now fold_stmt ends up asking ranger about something end ICEs because it attempts to walk SSA_USE_OPs on that stmt and because we haven't updated the stmt, walks even the INTEGER_CST among ssa uses and checking ICEs because it attempts to test SSA_NAME flags on the INTEGER_CST. The following patch fixes it by calling update_stmt before folding in that case, it is called again after folding just in case it is folded. 2026-04-16 Jakub Jelinek <[email protected]> PR tree-optimization/124891 * tree-ssa-propagate.cc (substitute_and_fold_dom_walker::before_dom_children): Call update_stmt in the did_replace case before calling fold_stmt. * gcc.dg/torture/pr124891.c: New test. Reviewed-by: Richard Biener <[email protected]> (cherry picked from commit a133372acfb6f97f67c641916f686d906b7aba77) Diff: --- gcc/testsuite/gcc.dg/torture/pr124891.c | 10 ++++++++++ gcc/tree-ssa-propagate.cc | 1 + 2 files changed, 11 insertions(+) diff --git a/gcc/testsuite/gcc.dg/torture/pr124891.c b/gcc/testsuite/gcc.dg/torture/pr124891.c new file mode 100644 index 000000000000..6b350301d986 --- /dev/null +++ b/gcc/testsuite/gcc.dg/torture/pr124891.c @@ -0,0 +1,10 @@ +/* PR tree-optimization/124891 */ +/* { dg-do compile } */ + +void +foo (int x, int y, int z, int *buf) +{ + for (int i = 0; i < x; ++i) + for (int j = z; j < x-z; ++z) + buf[j + (y - z +i) * x] = buf[x]; +} diff --git a/gcc/tree-ssa-propagate.cc b/gcc/tree-ssa-propagate.cc index 872f881b644c..51530abd7bd4 100644 --- a/gcc/tree-ssa-propagate.cc +++ b/gcc/tree-ssa-propagate.cc @@ -864,6 +864,7 @@ substitute_and_fold_dom_walker::before_dom_children (basic_block bb) /* If we made a replacement, fold the statement. */ if (did_replace) { + update_stmt (stmt); fold_stmt (&i, follow_single_use_edges); stmt = gsi_stmt (i); gimple_set_modified (stmt, true);
