but I could use some help in understanding why. On pass 3 of dom I have a cfg
that looks like this:
bb1 (succ =2,3) bb2 (succ=5) p2 = ... bb3 (succ=4, 5) p3= ... bb4 (succ=5) bb5 (succ=6, 7) p5 = PHI (p2, p3) bb6 (succ=8) p6 = PHI (p5) bb7 (succ=8) p7 = PHI (p5) bb8 p8 = PHI (p6, p7)
The dominator opts propagate p5 forwards, observe that p8 is now single-valued,
and record p5 as TREE_SSA_VALUE (p8):
bb1 (succ =2,3) bb2 (succ=5) p2 = ... bb3 (succ=4, 5) p3= ... bb4 (succ=5) bb5 (succ=6, 7) p5 = PHI (p2, p3) bb6 (succ=8) bb7 (succ=8) bb8 p8 = PHI (p5, p5) Value = p5
Jump threading decides that the (3,5) edge can be short circuited, and creates
a copy of bb5 with a duplicate definition of p5:
bb1 (succ =2,3) bb2 (succ=5) p2 = ... bb3 (succ=4, 5b) p3= ... bb4 (succ=5) bb5 (succ=6, 7) p5 = PHI (p2, p3) bb5b (succ=7) p5 = PHI (p3) bb6 (succ=8) bb7 (succ=8) bb8 p8 = PHI (p5, p5) Value = p5
rewrite_ssa_into_ssa renames the duplicate p5's:
bb1 (succ =2,3) bb2 (succ=5) p2 = ... bb3 (succ=4, 5b) p3= ... bb4 (succ=5) bb5 (succ=6, 7) p5a = PHI (p2, p3) bb5b (succ=7) p5b = PHI (p3) bb6 (succ=8) bb7 (succ=8) bb8 p8 = PHI (p5a, p5b) Value = p5
But nobody has cleared the SSA_VALUE of p8, so it still points to p5, which
has been freed. This causes a fault on the next iteration, when
cprop_into_successor_phis tries to look at that value.
The crash can be easily fixed in this last routine, but is that the right approach?
I don't understand what mechanism is supposed to prevent this. Thanks.
