This backport contains 1 patch from gcc main stream tree.
The commit id of these patchs list as following in the order of time.

0001-cselim-Don-t-assume-it-is-safe-to-cstore-replace-a-s.patch
cf39dccf9284d2fd9f9aa7050760adea110c8d88

diff -uprN a/gcc/testsuite/gcc.c-torture/execute/pr94734.c b/gcc/testsuite/gcc.c-torture/execute/pr94734.c
new file mode 100644
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/execute/pr94734.c
@@ -0,0 +1,59 @@
+/* PR tree-optimization/94734 */
+
+__attribute__((noipa)) int
+foo (int n)
+{
+  int arr[16], s = 0;
+  for (int i = 0; i < n; i++)
+    {
+      if (i < 16)
+	arr[i] = i;
+    }
+  for (int i = 0; i < 16; i++)
+    s += arr[i];
+  return s;
+}
+
+__attribute__((noipa)) int
+bar (int n, int x, unsigned long y, unsigned long z)
+{
+  int arr[16], s = 0;
+  arr[4] = 42;
+  for (int i = 0; i < n; i++)
+    {
+      if (x == (i & 0x25))
+	arr[y] = i;
+    }
+  return arr[z];
+}
+
+__attribute__((noipa)) int
+baz (int n, int x, unsigned long z)
+{
+  int arr[16], s = 0;
+  arr[12] = 42;
+  for (int i = 0; i < n; i++)
+    {
+      if (x == (i & 0x25))
+	arr[7] = i;
+    }
+  return arr[z];
+}
+
+int
+main ()
+{
+  if (foo (10374) != 15 * 16 / 2)
+    __builtin_abort ();
+  if (bar (25, 0x25, (unsigned long) 0xdeadbeefbeefdeadULL, 4) != 42)
+    __builtin_abort ();
+  if (bar (25, 4, 15, 15) != 22)
+    __builtin_abort ();
+  if (baz (25, 0x25, 12) != 42)
+    __builtin_abort ();
+  if (baz (25, 4, 7) != 22)
+    __builtin_abort ();
+  if (baz (25, 4, 12) != 42)
+    __builtin_abort ();
+  return 0;
+}
diff -uprN a/gcc/testsuite/gcc.dg/tree-ssa/pr89430-1.c b/gcc/testsuite/gcc.dg/tree-ssa/pr89430-1.c
--- a/gcc/testsuite/gcc.dg/tree-ssa/pr89430-1.c
+++ b/gcc/testsuite/gcc.dg/tree-ssa/pr89430-1.c
@@ -9,4 +9,4 @@ unsigned test(unsigned k, unsigned b) {
         return a[0]+a[1];
 }
 
-/* { dg-final { scan-tree-dump "Conditional store replacement" "cselim" } } */
+/* { dg-final { scan-tree-dump "Conditional store replacement" "cselim" { xfail *-*-* } } } */
diff -uprN a/gcc/testsuite/gcc.dg/tree-ssa/pr89430-2.c b/gcc/testsuite/gcc.dg/tree-ssa/pr89430-2.c
--- a/gcc/testsuite/gcc.dg/tree-ssa/pr89430-2.c
+++ b/gcc/testsuite/gcc.dg/tree-ssa/pr89430-2.c
@@ -11,4 +11,4 @@ unsigned test(unsigned k, unsigned b) {
         return a[0]+a[1];
 }
 
-/* { dg-final { scan-tree-dump "Conditional store replacement" "cselim" } } */
+/* { dg-final { scan-tree-dump "Conditional store replacement" "cselim" { xfail *-*-* } } } */
diff -uprN a/gcc/testsuite/gcc.dg/tree-ssa/pr89430-5.c b/gcc/testsuite/gcc.dg/tree-ssa/pr89430-5.c
--- a/gcc/testsuite/gcc.dg/tree-ssa/pr89430-5.c
+++ b/gcc/testsuite/gcc.dg/tree-ssa/pr89430-5.c
@@ -13,4 +13,4 @@ int test(int b, int k) {
     return a.data[0] + a.data[1];
 }
 
-/* { dg-final { scan-tree-dump "Conditional store replacement" "cselim" } } */
+/* { dg-final { scan-tree-dump "Conditional store replacement" "cselim" { xfail *-*-* } } } */
diff -uprN a/gcc/testsuite/gcc.dg/tree-ssa/pr89430-6.c b/gcc/testsuite/gcc.dg/tree-ssa/pr89430-6.c
--- a/gcc/testsuite/gcc.dg/tree-ssa/pr89430-6.c
+++ b/gcc/testsuite/gcc.dg/tree-ssa/pr89430-6.c
@@ -16,4 +16,4 @@ int test(int b, int k) {
     return a.data[0].x + a.data[1].x;
 }
 
-/* { dg-final { scan-tree-dump "Conditional store replacement" "cselim" } } */
+/* { dg-final { scan-tree-dump "Conditional store replacement" "cselim" { xfail *-*-* } } } */
diff -uprN a/gcc/tree-ssa-phiopt.c b/gcc/tree-ssa-phiopt.c
--- a/gcc/tree-ssa-phiopt.c
+++ b/gcc/tree-ssa-phiopt.c
@@ -45,6 +45,7 @@ along with GCC; see the file COPYING3.  If not see
 #include "tree-inline.h"
 #include "params.h"
 #include "case-cfn-macros.h"
+#include "tree-eh.h"
 
 static unsigned int tree_ssa_phiopt_worker (bool, bool, bool);
 static bool two_value_replacement (basic_block, basic_block, edge, gphi *,
@@ -2237,10 +2238,13 @@ cond_store_replacement (basic_block middle_bb, basic_block join_bb,
      whose value is not available readily, which we want to avoid.  */
   if (!nontrap->contains (lhs))
     {
-      /* If LHS is a local variable without address-taken, we could
+      /* If LHS is an access to a local variable without address-taken
+	 (or when we allow data races) and known not to trap, we could
 	 always safely move down the store.  */
       tree base = get_base_address (lhs);
-      if (!auto_var_p (base) || TREE_ADDRESSABLE (base))
+      if (!auto_var_p (base)
+	  || (TREE_ADDRESSABLE (base) && !flag_store_data_races)
+	  || tree_could_trap_p (lhs))
 	return false;
     }