The fold_using_range operand fetching mechanism has a variety of modes.  The "normal" mechanism simply invokes the current or supplied range_query to satisfy fetching current range info for any ssa-names used during the evalaution of the statement, I also added support for fur_list which allows a list of ranges to be supplied which is used to satisfy ssa-names as they appear in the stmt.  Once the list is exhausted, then it reverts to using the range query. This allows us to fold a stmt using whatever values we want. ie, a_2 = b_3 + c_4 i can call fold_stmt (r, stmt, [1,2],  [4,5]) and a_2 would be calculated using [1,2] for the first ssa_name, and [4,5] for the second encountered name.  This allows us to manually fold stmts when we desire. There was a bug in the implementation of fur_list where it was using the supplied values for *any* encountered operand, not just ssa_names. The PHI analyzer is the first consumer of the fur_list API, and was tripping over this.     [local count: 1052266993]:   # a_lsm.12_29 = PHI   iftmp.1_15 = 3 / a_lsm.12_29;   [local count: 1063004408]:   # iftmp.1_11 = PHI   # ivtmp_2 = PHI   ivtmp_36 = ivtmp_2 - 1;   if (ivtmp_36 != 0)     goto ; [98.99%]   else     goto ; [1.01%] It detemined that the initial value of iftmp.1_11 was [2, 2] (from the edge 2->4), and that the only modifying statement is iftmp.1_15 = 3 / a_lsm.12_29; One of the things it tries to do is determine is if a few iterations feeding the initial value and combining it with the result of the statement converge, thus providing a complete initial range.  Its uses fold_range supplying the value for the ssa-operand directly..  but tripped over the bug. So for the first iteration, instead of calculating   _15 = 3 / [2,2]  and coming up with [1,1],   it was instead calculating [2,2]/VARYING, and coming up with [-2, 2].  Next pass of the iteration checker then erroneously calculated [-2,2]/VARYING and the result was [-2,2] and convergence was achieved, and the initial value of the PHI set to[-2, 2] ... incorrectly.  and of course bad things happened. This patch fixes fur_list::get_operand to check for an ssa-name before it pulling a value from the supplied list.  With this, no partlculary good starting value for the PHI node can be determined. Andrew