[gcc r17-3356] testsuite: reproducers for PR126876

https://gcc.gnu.org/g:92a49b653b21fc8cf55c114e24a83d6f40d19f2b

commit r17-3356-g92a49b653b21fc8cf55c114e24a83d6f40d19f2b
Author: Aldy Hernandez <[email protected]>
Date:   Mon Aug 17 14:51:59 2026 +0000

    testsuite: reproducers for PR126876
    
    ICE-on-valid at -O2 in the thread pass since r17-3298: the path
    query becomes the current query during fold_using_range::fold_stmt,
    match.pd's gimple_match_range_of_expr then queries it with a context
    statement resolved via gimple_match_ctx to SSA_NAME_DEF_STMT of a
    capture -- a statement from an arbitrary block.  internal_range_of_expr
    feeds gimple_bb (stmt) to range_defined_in_block, and for a PHI,
    ssa_range_in_phi resolves the incoming edge positionally via
    prev_bb () -- valid only when the PHI's block is the current path
    position.  Out of position, find_edge (prev, bb) is NULL (here
    prev == bb: the PHI's block is m_path[m_pos + 1]) and the
    EDGE_ABNORMAL checking assert's e_in->flags dereference segfaults.
    No abnormal edges are involved; the assert line is merely the first
    dereference -- the pre-assert PHI_ARG_DEF_FROM_EDGE would have
    crashed identically.
    
            PR tree-optimization/126876
            * gcc.dg/tree-ssa/pr126876.c: New test.

Diff:
---
 gcc/testsuite/gcc.dg/tree-ssa/pr126876.c | 35 ++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/gcc/testsuite/gcc.dg/tree-ssa/pr126876.c b/gcc/testsuite/gcc.dg/tree-ssa/pr126876.c
new file mode 100644
index 000000000000..796916151b58
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/tree-ssa/pr126876.c
@@ -0,0 +1,35 @@
+/* PR tree-optimization/126876 */
+/* { dg-do compile } */
+/* { dg-options "-O2 -w" } */
+
+unsigned char *S_parser_feed_eol;
+char S_parser_feed_end;
+void S_parser_feed(unsigned char *buffer) {
+  while (buffer) {
+    int chunk_len;
+    for (; S_parser_feed_eol;)
+      chunk_len = S_parser_feed_eol - buffer;
+    buffer += chunk_len;
+    if (S_parser_feed_end)
+      if (*buffer)
+        buffer++;
+  }
+}
+
+/* Second reducer, from Emacs coding.c (comment #9).  */
+int b;
+
+int c(char *p) {
+  if (b) {
+    p[0] = 0;
+    return 1;
+  }
+  return 0;
+}
+
+void d(char *e) {
+  while (e) {
+    e += c(e);
+    e += c(e);
+  }
+}