In r229405 I removed a call to redirect_edge_var_map_destroy from delete_tree_ssa which I thought cannot be necessary because that map isn't GCed and thus stale data in it should have caused quite some havoc otherwise. Turns out I was wrong ;) We were lucky instead. The following patch amends the code in remove_edge which clears data for removed edges (when in gimple!) in that it now destroys the map at RTL expansion time.
Now there is still a latent issue I believe as somebody is making use of the map for an edge it didn't previously push to (pushing always first clears the entry for the edge). The comment in redirect_edge_var_map_vector is also revealing in that context: redirect_edge_var_map_vector (edge e) { /* Hey, what kind of idiot would... you'd be surprised. */ if (!edge_var_maps) return NULL; In particular we probably have (very many?) redirect_edge_and_branch calls not paired with a redirect_edge_var_map_clear call. In all it looks like a very fragile thing, that SSA edge redirect hook stuff. Bootstrap / regtest running on x86_64-unknown-linux-gnu. Will apply if that succeeds and hope for the best. Richard. 2015-11-16 Richard Biener <rguent...@suse.de> PR middle-end/68117 * cfgexpand.c (pass_expand::execute): Destroy the edge redirection var map before setting RTL CFG hooks. Index: gcc/cfgexpand.c =================================================================== --- gcc/cfgexpand.c (revision 230404) +++ gcc/cfgexpand.c (working copy) @@ -6275,6 +6278,9 @@ pass_expand::execute (function *fun) expand_phi_nodes (&SA); + /* Release any stale SSA redirection data. */ + redirect_edge_var_map_destroy (); + /* Register rtl specific functions for cfg. */ rtl_register_cfg_hooks ();