[Bug middle-end/126908] New: [17 Regression] ICE on glibc-2.42: SISGEGV in ranger ("during GIMPLE pass: thread") since r17-3298-g836cb4ed48c987

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126908

            Bug ID: 126908
           Summary: [17 Regression] ICE on glibc-2.42: SISGEGV in ranger
                    ("during GIMPLE pass: thread") since
                    r17-3298-g836cb4ed48c987
           Product: gcc
           Version: 17.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: slyfox at gcc dot gnu.org
  Target Milestone: ---

Noticed as an ICE when building  `glibc-2.42` on gcc-master, bisected to
r17-3298-g836cb4ed48c987. `cvise` produced the following reproducer:

// $ cat bug.c.c
struct obstack {
  char *next_free
} _obstack_newchunk(), collate_output_extrapool;
char obstack_int32_grow___o_2, obstack_int32_grow___o1_1;
long nwcs;
int collate_output_runp_6;
void obstack_int32_grow(struct obstack *obstack, int data) {
  struct obstack __o = *obstack;
  if (__o.next_free + sizeof obstack_int32_grow___o_2)
    _obstack_newchunk();
  obstack_int32_grow___o1_1 = data;
}
void collate_output() {
  obstack_int32_grow(&collate_output_extrapool, nwcs);
  struct obstack *__o = &collate_output_extrapool;
  int __len = nwcs;
  if (__o + __len)
    _obstack_newchunk();
  __o->next_free += __len;
  obstack_int32_grow(&collate_output_extrapool, collate_output_runp_6);
}

Crashing:

$ gcc/xgcc -Bgcc -O2 -fno-strict-overflow -c bug.c.c
bug.c.c:3:1: warning: no semicolon at end of struct or union
    3 | } _obstack_newchunk(), collate_output_extrapool;
      | ^
during GIMPLE pass: thread
bug.c.c: In function 'collate_output':
bug.c.c:13:6: internal compiler error: Segmentation fault
   13 | void collate_output() {
      |      ^~~~~~~~~~~~~~
0x28e6cc0 diagnostics::context::diagnostic_impl(rich_location*,
diagnostics::metadata const*, diagnostics::option_id, char const*,
__va_list_tag (*) [1], diagnostics::kind)
        ???:0
0x28d8eba internal_error(char const*, ...)
        ???:0
0x10cc875 crash_signal(int)
        ???:0
0x1312ae2 path_range_query::ssa_range_in_phi(vrange&, gphi*)
        ???:0
0x13135dc path_range_query::range_defined_in_block(vrange&, tree_node*,
basic_block_def*)
        ???:0
0x1313a11 path_range_query::internal_range_of_expr(vrange&, tree_node*,
gimple*)
        ???:0
0x1313d33 path_range_query::range_of_expr(vrange&, tree_node*, gimple*)
        ???:0
0xc8af13 fur_stmt::get_operand(vrange&, tree_node*)
        ???:0
0xc90967 fold_using_range::range_of_range_op(vrange&, gimple_range_op_handler&,
fur_source&)
        ???:0
0xc92e0c fold_using_range::fold_stmt(vrange&, gimple*, fur_source&, tree_node*)
        ???:0
0xc936b4 fold_range(vrange&, gimple*, range_query*)
        ???:0
0x131205b path_range_query::range_of_stmt(vrange&, gimple*, tree_node*)
        ???:0
0x131349f path_range_query::range_defined_in_block(vrange&, tree_node*,
basic_block_def*)
        ???:0
0x1313a11 path_range_query::internal_range_of_expr(vrange&, tree_node*,
gimple*)
        ???:0
0x1313d33 path_range_query::range_of_expr(vrange&, tree_node*, gimple*)
        ???:0
0x281a8f3 gimple_match_range_of_expr(vrange&, tree_node*, tree_node*)
        ???:0
0x2860c2b gimple_simplify_PLUS_EXPR(gimple_match_op*, gimple**, tree_node*
(*)(tree_node*), code_helper, tree_node*, tree_node*, tree_node*)
        ???:0
0x1aff767 gimple_simplify(gimple_match_op*, gimple**, tree_node*
(*)(tree_node*), code_helper, tree_node*, tree_node*, tree_node*)
        ???:0
0x1c182dc gimple_resimplify2(gimple**, gimple_match_op*, tree_node*
(*)(tree_node*))
        ???:0
0x1c183ec gimple_match_op::resimplify(gimple**, tree_node* (*)(tree_node*))
        ???:0
gcc/cc1 -quiet -iprefix /tmp/gb/gcc/../lib/gcc/x86_64-pc-linux-gnu/17.0.0/
-isystem gcc/include -isystem gcc/include-fixed bug.c.c -quiet -dumpbase
bug.c.c -dumpbase-ext .c -mtune=generic -march=x86-64 -O2 -fno-strict-overflow
-o /tmp/nix-shell-4117481-4263222461/ccbizHaz.s
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$ gcc/xgcc -Bgcc -v
Reading specs from gcc/specs
COLLECT_GCC=gcc/xgcc
COLLECT_LTO_WRAPPER=gcc/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /home/slyfox/dev/git/gcc/configure --disable-multilib
--disable-bootstrap --disable-lto --disable-libsanitizer --enable-languages=c
CFLAGS='-O1 -g0' CXXFLAGS='-O1 -g0' LDFLAGS='-O1 -g0'
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 17.0.0 20260816 (experimental) (GCC)