https://gcc.gnu.org/g:4f411e059595969d31fee76035369522e7d49be9
commit r17-5422-g4f411e059595969d31fee76035369522e7d49be9 Author: Merlin Warner-Huish <[email protected]> Date: Tue Oct 20 22:02:26 2026 -0600 Re: [PATCH] phiopt: Fix successor check in spaceship_replacement [PR126566] After setting cond3_bb = single_pred (cond2_bb), spaceship_replacement checked that cond2_bb has two successors. cond2_bb is already known to have two successors at that point; the check was meant for cond3_bb. When cond3_bb has a single successor, EDGE_SUCC (cond3_bb, 1) reads past the end of its successor vector, which ICEs with checking enabled. --- Bootstrapped and regression tested on x86_64-pc-linux-gnu with no new failures; the new test passes at all torture options. Thanks to Kyrylo Tkachov for the analysis in the problem report. PR tree-optimization/126566 gcc/ChangeLog: * tree-ssa-phiopt.cc (spaceship_replacement): Check the number of successors of cond3_bb rather than cond2_bb. gcc/testsuite/ChangeLog: * gcc.dg/torture/pr126566.c: New test. Diff: --- gcc/testsuite/gcc.dg/torture/pr126566.c | 27 +++++++++++++++++++++++++++ gcc/tree-ssa-phiopt.cc | 2 +- 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/gcc/testsuite/gcc.dg/torture/pr126566.c b/gcc/testsuite/gcc.dg/torture/pr126566.c new file mode 100644 index 000000000000..57f1e533ddc2 --- /dev/null +++ b/gcc/testsuite/gcc.dg/torture/pr126566.c @@ -0,0 +1,27 @@ +/* PR tree-optimization/126566 */ +/* { dg-do run } */ +/* { dg-require-effective-target label_values } */ + +void *gp; + +__attribute__((noipa)) int +f (int x, int y, int k) +{ + int c; + if (k) { c = 0; goto out; } + gp = &&lab; +lab: + if (x < y) c = -1; + else if (x > y) c = 1; + else c = -128; +out: + return c > 0; +} + +int +main (void) +{ + if (f (1, 2, 0) != 0) __builtin_abort (); + if (f (2, 1, 0) != 1) __builtin_abort (); + return 0; +} diff --git a/gcc/tree-ssa-phiopt.cc b/gcc/tree-ssa-phiopt.cc index 6f4eb8fe5472..a8c3a94a3f96 100644 --- a/gcc/tree-ssa-phiopt.cc +++ b/gcc/tree-ssa-phiopt.cc @@ -2449,7 +2449,7 @@ spaceship_replacement (basic_block cond_bb, basic_block middle_bb, if (!single_pred_p (cond2_bb) || !cond_only_block_p (cond2_bb)) return false; cond3_bb = single_pred (cond2_bb); - if (EDGE_COUNT (cond2_bb->succs) != 2) + if (EDGE_COUNT (cond3_bb->succs) != 2) return false; if (EDGE_SUCC (cond3_bb, 0)->dest == cond2_bb) {
