[Bug tree-optimization/125857] New: ICE on valid code at -O{s,2,3} on x86_64-linux-gnu: in value_of_expr, at tree-vrp.cc:996

[zhendong.su at inf dot ethz.ch via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=125857

            Bug ID: 125857
           Summary: ICE on valid code at -O{s,2,3} on x86_64-linux-gnu: in
                    value_of_expr, at tree-vrp.cc:996
           Product: gcc
           Version: 16.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

Compiler Explorer: https://godbolt.org/z/YsdTv3jfv

Note:
- fails: trunk
- works: 16.1 and earlier

[509] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/home/suz/suz-local/software/local/gcc-trunk/bin/../libexec/gcc/x86_64-pc-linux-gnu/17.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--enable-checking=yes --prefix=/local/suz-local/software/local/gcc-trunk
--enable-sanitizers --enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 17.0.0 20260617 (experimental) (GCC) 
[510] % 
[510] % gcctk -O3 small.c
during GIMPLE pass: evrp
small.c: In function ‘main’:
small.c:10:1: internal compiler error: in value_of_expr, at tree-vrp.cc:996
   10 | int main() { *b = d(); }
      | ^~~
0x26684ab internal_error(char const*, ...)
        ../../gcc-trunk/gcc/diagnostic-global-context.cc:787
0xa2f74e fancy_abort(char const*, int, char const*)
        ../../gcc-trunk/gcc/diagnostics/context.cc:1813
0x1577531 rvrp_folder::value_of_expr(tree_node*, gimple*)
        ../../gcc-trunk/gcc/tree-vrp.cc:996
0x141334c substitute_and_fold_engine::replace_uses_in(gimple*)
        ../../gcc-trunk/gcc/tree-ssa-propagate.cc:575
0x141368c substitute_and_fold_dom_walker::before_dom_children(basic_block_def*)
        ../../gcc-trunk/gcc/tree-ssa-propagate.cc:854
0x23d0e87 dom_walker::walk(basic_block_def*)
        ../../gcc-trunk/gcc/domwalk.cc:311
0x141281b substitute_and_fold_engine::substitute_and_fold(basic_block_def*)
        ../../gcc-trunk/gcc/tree-ssa-propagate.cc:1003
0x1573d50 execute_ranger_vrp(function*, bool)
        ../../gcc-trunk/gcc/tree-vrp.cc:1096
/local/home/suz/suz-local/software/local/gcc-trunk/bin/../libexec/gcc/x86_64-pc-linux-gnu/17.0.0/cc1
-quiet -I /usr/local/include -I /local/suz-local/software/local/include
-imultiarch x86_64-linux-gnu -iprefix
/local/home/suz/suz-local/software/local/gcc-trunk/bin/../lib/gcc/x86_64-pc-linux-gnu/17.0.0/
small.c -quiet -dumpdir a- -dumpbase small.c -dumpbase-ext .c -mtune=generic
-march=x86-64 -O3 -o /tmp/cczonFyS.s
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[511] % 
[511] % cat small.c
int *a, **b = &a, c;
int *d() {
  int e, *f = &e;
  for (; c; c++)
    __builtin_abort();
  if (!b)
    __builtin_abort();
  return f;
}
int main() { *b = d(); }