http://gcc.gnu.org/bugzilla/show_bug.cgi?id=60363
--- Comment #7 from bin.cheng <amker.cheng at gmail dot com> --- The problem has nothing to do with VRP, and might be a missed opportunity of jump threading. The dump after VRP but before jump threading at the end of VRP is like: ... <bb 21>: goto <bb 7>; ... <bb 7>: # kill_elt_3 = PHI <kill_elt_4(20), 0B(21), kill_elt_2(6)> if (b_elt_11(D) != 0B) goto <bb 8>; else goto <bb 14>; <bb 8>: if (kill_elt_3 != 0B) goto <bb 9>; else goto <bb 22>; <bb 22>: goto <bb 14>; ... <bb 14>: # changed_19 = PHI <changed_1(7), changed_1(22), changed_26(12), changed_1(11), changed_1(9)> # kill_elt_18 = PHI <kill_elt_3(7), 0B(22), kill_elt_3(12), kill_elt_3(11), kill_elt_3(9)> <bb 17>: # changed_1 = PHI <changed_19(14), 0(2)> # kill_elt_4 = PHI <kill_elt_18(14), kill_elt_7(D)(2)> if (a_elt_9(D) != 0B) goto <bb 24>; else goto <bb 15>; There is jump threading path like: Registering jump thread: (21, 7) incoming edge; (7, 8) joiner; (8, 22) normal; After jump threading, the dump is like: <bb 18>: # kill_elt_2 = PHI <kill_elt_10(5), kill_elt_14(4)> if (kill_elt_2 != 0B) goto <bb 6>; else goto <bb 21>; <bb 21>: goto <bb 27>; ... <bb 14>: # changed_19 = PHI <changed_1(7), changed_1(22), changed_26(12), changed_1(11), changed_1(9), changed_1(27), changed_1(29)> # kill_elt_18 = PHI <kill_elt_3(7), 0B(26), kill_elt_3(12), kill_elt_3(11), kill_elt_3(9), kill_elt_3(27), kill_elt_3(29)> <bb 17>: # changed_1 = PHI <changed_19(14), 0(2)> # kill_elt_4 = PHI <kill_elt_18(14), kill_elt_7(D)(2)> if (a_elt_9(D) != 0B) goto <bb 24>; else goto <bb 15>; ... <bb 26>: goto <bb 14>; <bb 27>: # kill_elt_41 = PHI <0B(21)> if (b_elt_11(D) != 0B) goto <bb 26>; else goto <bb 14>; During jump threading process, GCC updates phi node in destination basic block like "kill_elt_18 = PHI <". Because bb27 is duplicated from bb7, the phi argument "kill_elt_3(27)" is copied directly from "kill_elt_3(7)". Although "kill_elt_3 == 0" holds when coming from edge <bb27, bb14>, gcc doesn't know this fact. At last, cfgcleanup tries to remove forwarder block bb26, but it can't make it because the phi arguments from edge<bb27, bb14> and edge<bb26, bb14> doesn't match. I am thinking maybe jump threading can back trace the threading path and try to add phi argument for edge<bb27, bb14> with the value(0) of kill_elt_3 (i.e., "0(27)"). The value is available along the jump threading path.