tree-optimization/114624 - fix use-after-free in SCCP

We're inspecting the replaced PHI node after releasing it.

	PR tree-optimization/114624
	* tree-scalar-evolution.cc (final_value_replacement_loop):
	Get at the PHI arg location before releasing the PHI node.

	* gcc.dg/torture/pr114624.c: New testcase.

diff --git a/gcc/testsuite/gcc.dg/torture/pr114624.c b/gcc/testsuite/gcc.dg/torture/pr114624.c
new file mode 100644 (file)
index 0000000..ae03135
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr114624.c
@@ -0,0 +1,20 @@
+/* { dg-do compile } */
+
+int a, b;
+int main() {
+  int c, d = 1;
+  while (a) {
+    while (b)
+      if (d)
+        while (a)
+          ;
+    for (; b < 2; b++)
+      if (b)
+        for (c = 0; c < 8; c++)
+          d = 0;
+      else
+        for (a = 0; a < 2; a++)
+          ;
+  }
+  return 0;
+}

diff --git a/gcc/tree-scalar-evolution.cc b/gcc/tree-scalar-evolution.cc
index 25e3130e2f1282823f6a477ca5df58dff9ec06b8..b0a5e09a77c106c6f1ceb7e0a1e7f7b904db92d4 100644 (file)
--- a/gcc/tree-scalar-evolution.cc
+++ b/gcc/tree-scalar-evolution.cc
@@ -3877,6 +3877,7 @@ final_value_replacement_loop (class loop *loop)
         to a GIMPLE sequence or to a statement list (keeping this a
         GENERIC interface).  */
       def = unshare_expr (def);
+      auto loc = gimple_phi_arg_location (phi, exit->dest_idx);
       remove_phi_node (&psi, false);
 
       /* Propagate constants immediately, but leave an unused initialization
@@ -3888,8 +3889,7 @@ final_value_replacement_loop (class loop *loop)
       gimple_seq stmts;
       def = force_gimple_operand (def, &stmts, false, NULL_TREE);
       gassign *ass = gimple_build_assign (rslt, def);
-      gimple_set_location (ass,
-                          gimple_phi_arg_location (phi, exit->dest_idx));
+      gimple_set_location (ass, loc);
       gimple_seq_add_stmt (&stmts, ass);
 
       /* If def's type has undefined overflow and there were folded