https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63156
--- Comment #4 from Carrot <carrot at google dot com> --- In function df_uses_record, we have: ... case PRE_DEC: case POST_DEC: case PRE_INC: case POST_INC: case PRE_MODIFY: case POST_MODIFY: gcc_assert (!DEBUG_INSN_P (insn_info->insn)); /* Catch the def of the register being modified. */ df_ref_record (DF_REF_REGULAR, collection_rec, XEXP (x, 0), &XEXP (x, 0), bb, insn_info, DF_REF_REG_DEF, flags | DF_REF_READ_WRITE | DF_REF_PRE_POST_MODIFY); /* ... Fall through to handle uses ... */ default: break; } /* Recursively scan the operands of this expression. */ { const char *fmt = GET_RTX_FORMAT (code); int i; for (i = GET_RTX_LENGTH (code) - 1; i >= 0; i--) { if (fmt[i] == 'e') { /* Tail recursive case: save a function call level. */ if (i == 0) { loc = &XEXP (x, 0); goto retry; } df_uses_record (collection_rec, &XEXP (x, i), ref_type, bb, insn_info, flags); } ... For a AUTOINC rtl expression, we create two refs, one def and one use, but only the def gets the flag DF_REF_READ_WRITE, the use doesn't have this flag. While in web_main, it checks only use refs, but the use ref doesn't have the flag DF_REF_READ_WRITE, so it can't actually catch the AUTOINC cases, and does wrong renaming.