https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91267
--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> --- The problem is in the - old_vr = get_value_range (var); + old_vr = get_lattice_entry (var); change because get_value_range used to return the address of the const varying constant, but get_lattice_entry returns NULL if SSA_NAME_VERSION (var) >= num_vr_values, and invoking !old_vr->equal_p (*new_vr, /*ignore_equivs=*/false); on NULL old_vr is UB which ICEs. The question is if we should just return false if old_vr is NULL, or if we should check that case in the callers or their callers and don't even call say record_ranges_from_stmt for setters of newly added SSA_NAMEs.