[Bug tree-optimization/102940] [12 Regression] ICE: Segmentation fault (in gimple_bb)

[rguenth at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102940

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aldyh at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
It looks like ranger dives into stmts not in the IL or freed.

(gdb) p debug_tree (chrec)
 <ssa_name 0x7ffff63a5b40 type <error_mark 0x7ffff6543d20>
    nothrow
    def_stmt 
    version:96 in-free-list>

in fact, execute_ranger_vrp calls the array bound checker after substitute &
fold
which removes stmts and releases SSA names but it fails to clear the SCEV cache
which the array bound checker happily looks at.  The following fixes this.

diff --git a/gcc/tree-vrp.c b/gcc/tree-vrp.c
index ba7a4efc7c6..c1abee25feb 100644
--- a/gcc/tree-vrp.c
+++ b/gcc/tree-vrp.c
@@ -4425,6 +4425,7 @@ execute_ranger_vrp (struct function *fun, bool
warn_array_bounds_p)
            else
              e->flags |= EDGE_EXECUTABLE;
        }
+      scev_reset ();
       array_bounds_checker array_checker (fun, ranger);
       array_checker.check ();
     }