[Bug tree-optimization/107570] [13 Regression] ICE: Segmentation fault (in instantiate_scev_name/gimple_bb)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107570

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-11-08
           Priority|P3                          |P1
   Target Milestone|---                         |13.0
     Ever confirmed|0                           |1

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
#1  0x000000000167403c in instantiate_scev_name (
    instantiate_below=<edge 0x7ffff66ea330 (3 -> 7)>, 
    evolution_loop=0x7ffff651a848, inner_loop=0x7ffff651a848, chrec=
    <ssa_name 0x7ffff6522f30 2>, fold_conversions=0x0, size_expr=2)
    at /home/rguenther/src/trunk/gcc/tree-scalar-evolution.cc:2270
2270      basic_block def_bb = gimple_bb (SSA_NAME_DEF_STMT (chrec));
(gdb) p chrec
$1 = <ssa_name 0x7ffff6522f30 2>
(gdb) p debug_tree (chrec)
 <ssa_name 0x7ffff6522f30 type <error_mark 0x7ffff6517d80>
    nothrow
    def_stmt 
    version:2 in-free-list>
$2 = void

and we release the SSA name via

#0  release_ssa_name_fn (fn=0x7ffff66e9000, var=<ssa_name 0x7ffff6522f30 2>)
    at /home/rguenther/src/trunk/gcc/tree-ssanames.cc:555
#1  0x000000000187eeae in release_ssa_name (name=<ssa_name 0x7ffff6522f30 2>)
    at /home/rguenther/src/trunk/gcc/tree-ssanames.h:123
#2  0x0000000001881c24 in release_defs (stmt=<gimple_assign 0x7ffff66d1730>)
    at /home/rguenther/src/trunk/gcc/tree-ssanames.cc:832
#3  0x00000000017bd61c in substitute_and_fold_engine::substitute_and_fold (
    this=0x7fffffffda00, block=<basic_block 0x0>)
    at /home/rguenther/src/trunk/gcc/tree-ssa-propagate.cc:1009
#4  0x000000000193e886 in execute_ranger_vrp (fun=0x7ffff66e9000, 
    warn_array_bounds_p=false, final_p=true)
    at /home/rguenther/src/trunk/gcc/tree-vrp.cc:4543
#5  0x000000000193ebde in (anonymous namespace)::pass_vrp::execute (
    this=0x43b16f0, fun=0x7ffff66e9000)
    at /home/rguenther/src/trunk/gcc/tree-vrp.cc:4628
#6  0x00000000013b2c9d in execute_one_pass (
    pass=<opt_pass* 0x43b16f0 "vrp"(204)>)
    at /home/rguenther/src/trunk/gcc/passes.cc:2644

releasing SSA names while still folding looks dangerous in case the folding
eventually invokes SCEV which has a cache.