https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68185
--- Comment #2 from Thomas Preud'homme <thopre01 at gcc dot gnu.org> ---
Here's a quick update. What I found so far is that after split2, we have:
(insn 148 61 304 16 (set (reg:CCNO 17 flags)
(compare:CCNO (reg:HI 44 r15 [orig:91 pretmp_9 ] [91])
(const_int 0 [0]))) pr68185.c:20 2 {*cmphi_ccno_1}
(nil))
(insn 304 148 308 16 (set (reg/v:QI 5 di [orig:98 g ] [98])
(mem/c:QI (plus:DI (reg/f:DI 7 sp)
(const_int 15 [0xf])) [3 %sfp+-1 S1 A8])) pr68185.c:20 89
{*movqi_internal}
(nil))
(insn 308 304 67 16 (set (reg:SI 6 bp [orig:90 g ] [90])
(if_then_else:SI (gt (reg:CCNO 17 flags)
(const_int 0 [0]))
(reg:SI 6 bp [orig:90 g ] [90])
(reg:SI 5 di [orig:98 g ] [98]))) pr68185.c:20 957 {*movsicc_noc}
(nil))
(insn 67 308 151 16 (set (reg:SI 1 dx [orig:99 _23 ] [99])
(sign_extend:SI (reg/v:QI 6 bp [orig:90 g ] [90]))) pr68185.c:21 149
{extendqisi2}
(nil))
Where the second instruction load the value of w on the stack into di, then the
third instruction set bp to that value if t (in reg:HI 44) is smaller or equal
to 0 and then this value is extended into dx.
But after ree has run, we have:
(insn 148 61 304 16 (set (reg:CCNO 17 flags)
(compare:CCNO (reg:HI 44 r15 [orig:91 pretmp_9 ] [91])
(const_int 0 [0]))) pr68185.c:20 2 {*cmphi_ccno_1}
(nil))
(insn 304 148 312 16 (set (reg:SI 1 dx)
(sign_extend:SI (mem/c:QI (plus:DI (reg/f:DI 7 sp)
(const_int 15 [0xf])) [3 %sfp+-1 S1 A8]))) pr68185.c:20 149
{extendqisi2}
(nil))
(insn 312 304 308 16 (set (reg:SI 6 bp)
(reg:SI 1 dx)) pr68185.c:20 -1
(nil))
(insn 308 312 151 16 (set (reg:SI 6 bp [orig:90 g ] [90])
(if_then_else:SI (gt (reg:CCNO 17 flags)
(const_int 0 [0]))
(reg:SI 6 bp [orig:90 g ] [90])
(reg:SI 5 di [orig:98 g ] [98]))) pr68185.c:20 957 {*movsicc_noc}
(nil))
So the extension happens first from the value of w on the stack (insn 304),
then that value is put into bp (insn 312) and then bp takes the value of di
(which equals 0 at this point, coming from z I believe) if t (in reg:HI 44) is
smaller or equal to 0.
So the condition seems to have been reversed. This in turn leads to q not being
set to 1 after and thus the abort. Next step will be to investigate why ree
think this is safe to do, maybe some meta information not represented here that
was not updated correctly by loop2_invariant.
