https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111303
--- Comment #3 from Jiu Fu Guo <guojiufu at gcc dot gnu.org> ---
In the pattern of match.pd, there is:
&& range_op_handler (PLUS_EXPR).overflow_free_p (vr0, vr1)
&& get_range_query (cfun)->range_of_expr (vr3, @3)
/* "X+C" and "X" are not of opposite sign. */
&& (TYPE_UNSIGNED (type)
|| (vr0.nonnegative_p () && vr3.nonnegative_p ())
|| (vr0.nonpositive_p () && vr3.nonpositive_p ())))
For this case, "vr3" is "undefined_p", then "vr3.nonnegative_p ()" trige ICE.
Checking "!vr3.undefine_p ()" would be a safe fix for this ICE.
