[gcc r14-9829] tree-optimization/114624 - fix use-after-free in SCCP

[Richard Biener <rguenth@gcc.gnu.org>]

https://gcc.gnu.org/g:97d5cd8740384dbce5a83080916388f80d8976dd

commit r14-9829-g97d5cd8740384dbce5a83080916388f80d8976dd
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Apr 8 10:38:49 2024 +0200

    tree-optimization/114624 - fix use-after-free in SCCP
    
    We're inspecting the replaced PHI node after releasing it.
    
            PR tree-optimization/114624
            * tree-scalar-evolution.cc (final_value_replacement_loop):
            Get at the PHI arg location before releasing the PHI node.
    
            * gcc.dg/torture/pr114624.c: New testcase.

Diff:
---
 gcc/testsuite/gcc.dg/torture/pr114624.c | 20 ++++++++++++++++++++
 gcc/tree-scalar-evolution.cc            |  4 ++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/gcc/testsuite/gcc.dg/torture/pr114624.c b/gcc/testsuite/gcc.dg/torture/pr114624.c
new file mode 100644
index 00000000000..ae031356982
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr114624.c
@@ -0,0 +1,20 @@
+/* { dg-do compile } */
+
+int a, b;
+int main() {
+  int c, d = 1;
+  while (a) {
+    while (b)
+      if (d)
+        while (a)
+          ;
+    for (; b < 2; b++)
+      if (b)
+        for (c = 0; c < 8; c++)
+          d = 0;
+      else
+        for (a = 0; a < 2; a++)
+          ;
+  }
+  return 0;
+}
diff --git a/gcc/tree-scalar-evolution.cc b/gcc/tree-scalar-evolution.cc
index 25e3130e2f1..b0a5e09a77c 100644
--- a/gcc/tree-scalar-evolution.cc
+++ b/gcc/tree-scalar-evolution.cc
@@ -3877,6 +3877,7 @@ final_value_replacement_loop (class loop *loop)
 	 to a GIMPLE sequence or to a statement list (keeping this a
 	 GENERIC interface).  */
       def = unshare_expr (def);
+      auto loc = gimple_phi_arg_location (phi, exit->dest_idx);
       remove_phi_node (&psi, false);
 
       /* Propagate constants immediately, but leave an unused initialization
@@ -3888,8 +3889,7 @@ final_value_replacement_loop (class loop *loop)
       gimple_seq stmts;
       def = force_gimple_operand (def, &stmts, false, NULL_TREE);
       gassign *ass = gimple_build_assign (rslt, def);
-      gimple_set_location (ass,
-			   gimple_phi_arg_location (phi, exit->dest_idx));
+      gimple_set_location (ass, loc);
       gimple_seq_add_stmt (&stmts, ass);
 
       /* If def's type has undefined overflow and there were folded