https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90982
--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> --- OK, so this is IPA SRAs fault which fails to rewrite the d.c[i] expression with the parameter replacement. After the cited rev. range-info makes d.c[i] appear as d.c[2] from get_ref_base_and_extent analysis. Evaluating PARAM group sizes for d (UID: 2336): access { base = (2336)'d', offset = 128, size = 64, expr = d.c[i_4], type = long int, non_addressable = 0, reverse = 0, grp_read = 0, grp_write = 0, grp_assignment_read = 1, grp_assignment_write = 0, grp_scalar_read = 0, grp_scalar_write = 0, grp_total_scalarization = 0, grp_hint = 0, grp_covered = 0, grp_unscalarizable_region = 0, grp_unscalarized_data = 0, grp_same_access_path = 0, grp_partial_lhs = 0, grp_to_be_replaced = 0, grp_to_be_debug_replaced = 0, grp_maybe_modified = 0, grp_not_necessarilly_dereferenced = 0 ....will be split into 1 components IPA param adjustments: 0. base_index: 0 - this, base: this, copy_param 1. base_index: 1 - d, base: d, offset 128, type: <integer_type 0x7ffff6897738 long int> ... S<3>::_ZN1SILi3EE1fES0_.isra.0 (struct SD.2331 * const thisD.2425, long intD.12 ISRA.1D.2429) { intD.9 iD.2427; long intD.12 _3; long intD.12 _4; long intD.12 _5; <bb 5> : <bb 2> : <bb 3> : # i_2 = PHI <2(2), i_6(4)> _3 = this_1(D)->cD.2333[i_2]; _4 = dD.2426.cD.2333[i_2]; _5 = _3 & _4; this_1(D)->cD.2333[i_2] = _5; i_6 = i_2 + 1; and now dD.2426 is stale. With -fno-inline we ICE differently: during IPA pass: cp t.ii: In function ‘void S<n>::f(S<n>) [with int n = 3]’: t.ii:21:1: internal compiler error: in visit_ref_for_mod_analysis, at ipa-prop.c:2461 21 | } | ^ 0x112f91e visit_ref_for_mod_analysis /space/rguenther/src/svn/trunk2/gcc/ipa-prop.c:2461 0x102985b walk_stmt_load_store_addr_ops(gimple*, void*, bool (*)(gimple*, tree_node*, tree_node*, void*), bool (*)(gimple*, tree_node*, tree_node*, void*), bool (*)(gimple*, tree_node*, tree_node*, void*)) /space/rguenther/src/svn/trunk2/gcc/gimple-walk.c:783 0x112f9e8 ipa_analyze_params_uses_in_bb /space/rguenther/src/svn/trunk2/gcc/ipa-prop.c:2488 0x112fcbc analysis_dom_walker::before_dom_children(basic_block_def*) /space/rguenther/src/svn/trunk2/gcc/ipa-prop.c:2568 probably because there's a PARAM_DECL in the IL that isn't an actual parameter. Somehow during ipa_get_adjustment_candidate the access appears unconstrained by i_2 value-range. Ah, this is because we do new_node = node->create_version_clone_with_body (redirect_callers, NULL, NULL, false, NULL, NULL, "isra"); and the inline machinery doesn't copy SSA name range info.