https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83298
--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> --- This goes wrong during dom2, before that we have: <bb 2> [local count: 161061274]: b.1_11 = b; if (b.1_11 <= 0) goto <bb 7>; [85.00%] else goto <bb 4>; [15.00%] <bb 7> [local count: 136902083]: <bb 3> [local count: 912680551]: # b.1_12 = PHI <b.1_11(7), b.1_2(8)> # RANGE [-2147483647, 1] _1 = b.1_12 + 1; b = _1; b.1_2 = b; if (b.1_2 <= 0) goto <bb 8>; [85.00%] else goto <bb 4>; [15.00%] <bb 8> [local count: 775778470]: goto <bb 3>; [100.00%] <bb 4> [local count: 161061274]: a.2_3 = a; c.3_4 = c; _5 = a.2_3 <= 0 ? c.3_4 : 0; if (_5 == 0) goto <bb 5>; [0.00%] else goto <bb 6>; [99.96%] <bb 5> [count: 0]: # USE = nonlocal null # CLB = nonlocal null __builtin_abort (); <bb 6> [local count: 160996849]: return 0; and so all paths from ENTRY go through bb 4. dom2 decides to thread this: <bb 2> [local count: 161061274]: b.1_11 = b; if (b.1_11 <= 0) goto <bb 3>; [85.00%] else goto <bb 4>; [15.00%] <bb 3> [local count: 912680551]: # b.1_12 = PHI <b.1_11(2), _1(3)> # RANGE [-2147483647, 1] _1 = b.1_12 + 1; b = _1; b.1_2 = _1; if (_1 <= 0) goto <bb 3>; [85.00%] else goto <bb 7>; [15.00%] <bb 4> [local count: 161061274]: a.2_3 = a; c.3_4 = c; _5 = a.2_3 <= 0 ? c.3_4 : 0; if (_5 == 0) goto <bb 5>; [0.00%] else goto <bb 6>; [99.96%] <bb 5> [count: 0]: # USE = nonlocal null # CLB = nonlocal null __builtin_abort (); <bb 6> [local count: 160996849]: return 0; <bb 7> [count: 0]: a.2_10 = a; c.3_15 = c; _16 = a.2_10 <= 0 ? c.3_15 : 0; goto <bb 5>; [0.00%] which is wrong, the ranges of b*/_1 are in no way related to the ranges of a*/c*, so _16 isn't guaranteed to be 0. Jeff, can you please have a look?