If the condition leading to a __builtin_unreachable involves more than
one SSA name, it is unsafe to assign a global range to an SSA name even
if all current uses are valid
if (a == 0)
return
<...>
if (a == b)
= b
else
__builtin_unreachable ()
DOM thinks all uses of b can be given the global value of [1, +INF]
because a value of 0 will hit the __builtin_unreachable() call.
It does not take into account that b has a relation with a, and if a
later pass moves these conditions around, that assumption may not be
valid any longer.
VRP refuses to attempt early resolution of builtin_unreachable () calls
if the expression leading the builtin_unreachable() contains 2 SSA names
as the relation introduced makes it unsafe.
This patch give DOM the same early exit... check if there are 2 SSA
names on the condition and not try to assign a global range if so.
Bootstraps on x86_64-pc-linux-gnu and no regressions. (Presumably..
there appear to be spurious avx testcases failing that seem unrelated to
whatever patch I apply)
OK?
Andrew
From 7f598acf45dd93e025c87947850969ed91461df5 Mon Sep 17 00:00:00 2001
From: Andrew MacLeod <[email protected]>
Date: Wed, 3 Jun 2026 17:46:03 -0400
Subject: [PATCH 11/11] DOM should not process unreachable if there is an SSA
relation.
DOM should follow VRP's lead and not attempt o assign global values to
SSA names when the branch leading to a __builtin_unreachable () has
2 ssa-names. Relations elsewhere may lead to this being invalid.
PR tree-optimization/125501
gcc/
* tree-ssa-dom.cc (set_global_ranges_from_unreachable_edges): Abort
if there are 2 SSA_NAMES on the branch condition.
gcc/testsuite/
* gcc.dg/pr125501.c: New.
---
gcc/testsuite/gcc.dg/pr125501.c | 35 +++++++++++++++++++++++++++++++++
gcc/tree-ssa-dom.cc | 6 ++++++
2 files changed, 41 insertions(+)
create mode 100644 gcc/testsuite/gcc.dg/pr125501.c
diff --git a/gcc/testsuite/gcc.dg/pr125501.c b/gcc/testsuite/gcc.dg/pr125501.c
new file mode 100644
index 00000000000..22cdd3f28f6
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/pr125501.c
@@ -0,0 +1,35 @@
+// { dg-do run }
+// { dg-options "-O3" }
+
+#include <stdint.h>
+int64_t g2, g27, g10;
+static void *g13, *g24;
+_Bool f11___trans_tmp_1, f11_c17;
+void __attribute__((noinline)) f11(int64_t a0, void *a4, void *a5)
+{
+ _Bool ob6;
+ int32_t v12;
+ int64_t v15;
+lbl_entry:
+lbl_sw_def4:
+ ob6 = g13 == a4;
+ if (ob6 || f11_c17) return;
+ if (f11___trans_tmp_1) v12 = g10;
+ a0 = (char *)a5 - (char *)a4;
+ ob6 = 0 == a0;
+ *(_Bool *)4 = 0;
+ if (ob6) goto lbl_b22;
+ __builtin_unreachable();
+lbl_b22:
+ g27 = v12;
+ switch (v15)
+ {
+ case 6009053803839173278: goto lbl_sw_def4;
+ case 70689892217558167: goto lbl_entry;
+ }
+}
+
+int main()
+{
+ f11(0, 0, g24);
+}
diff --git a/gcc/tree-ssa-dom.cc b/gcc/tree-ssa-dom.cc
index e54058ce6fa..5497577ffa8 100644
--- a/gcc/tree-ssa-dom.cc
+++ b/gcc/tree-ssa-dom.cc
@@ -1437,6 +1437,12 @@ dom_opt_dom_walker::set_global_ranges_from_unreachable_edges (basic_block bb)
|| !assert_unreachable_fallthru_edge_p (pred_e))
return;
+ // Bail if the condition leading to the assert has 2 ssa-names.
+ // See PR 125501.
+ if ((TREE_CODE (gimple_cond_lhs (stmt)) == SSA_NAME
+ && TREE_CODE (gimple_cond_rhs (stmt)) == SSA_NAME))
+ return;
+
tree name;
FOR_EACH_GORI_EXPORT_NAME (m_ranger->gori_ssa (), pred_e->src, name)
if (all_uses_feed_or_dominated_by_stmt (name, stmt)
--
2.45.0
