From b82bc657de7aecf0eefff1a2aa90798cf7fcc7a1 Mon Sep 17 00:00:00 2001
From: Richard Biener <rguenther@suse.de>
Date: Mon, 30 Mar 2026 14:30:45 +0200
Subject: [PATCH] tree-optimization/124692 - update stmt before folding

The following makes sure SSA operands are up-to-date before folding.
Esp. when replace_uses_by is invoked from SCEV cprop which now has
ranger enabled we can otherwise end up ICEing where purpoted SSA
names now are constants.  This follows what forwprop does.

	PR tree-optimization/124692
	* tree-cfg.cc (replace_uses_by): Call update_stmt after
	substitution and before folding.

	* gcc.dg/torture/pr124692.c: New testcase.
---
 gcc/testsuite/gcc.dg/torture/pr124692.c | 22 ++++++++++++++++++++++
 gcc/tree-cfg.cc                         |  8 +++++---
 2 files changed, 27 insertions(+), 3 deletions(-)
 create mode 100644 gcc/testsuite/gcc.dg/torture/pr124692.c

diff --git a/gcc/testsuite/gcc.dg/torture/pr124692.c b/gcc/testsuite/gcc.dg/torture/pr124692.c
new file mode 100644
index 00000000000..340f7ea02d1
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr124692.c
@@ -0,0 +1,22 @@
+/* { dg-do compile } */
+
+int a, b, d, e[3][1], f, g, h;
+unsigned c;
+int main()
+{
+  while (b)
+    {
+      h = g;
+      for (b = 0; b < 2; b++)
+	;
+      for (; c; c++)
+	{
+	  int j = e[b][h];
+	  f = a < 0 ? j : j - a;
+	  if (!f)
+	    break;
+	  g = c;
+	}
+    }
+  return 0;
+}
diff --git a/gcc/tree-cfg.cc b/gcc/tree-cfg.cc
index 66ea54f8b85..3b95e0a68f1 100644
--- a/gcc/tree-cfg.cc
+++ b/gcc/tree-cfg.cc
@@ -1988,14 +1988,16 @@ replace_uses_by (tree name, tree val)
 		if (op && TREE_CODE (op) == ADDR_EXPR)
 		  recompute_tree_invariant_for_addr_expr (op);
 	      }
+	  update_stmt (stmt);
 
 	  if (fold_stmt (&gsi))
-	    stmt = gsi_stmt (gsi);
+	    {
+	      stmt = gsi_stmt (gsi);
+	      update_stmt (stmt);
+	    }
 
 	  if (maybe_clean_or_replace_eh_stmt (orig_stmt, stmt))
 	    gimple_purge_dead_eh_edges (gimple_bb (stmt));
-
-	  update_stmt (stmt);
 	}
     }