This is not vanilla 4.3.0 but gcc-4_3-branch from 2008-03-13. Here is a source:
struct S {struct S *field;}; extern struct S True, False, Z; static inline int f(void) {return 1;} static inline int g(struct S **obj) { return f() && *obj == &Z; } struct S **h(struct S **x) { if (x) return g(x) ? &True.field : &False.field; else return &True.field; } "gcc -S -O -ftree-vrp bug.c" produces the following code for h: h: pushl %ebp movl $True, %eax movl %esp, %ebp leave ret This is obviously wrong: there are condidions when it should return &False.field. The bug is not triggered without -ftree-vrp, or after minor modifications like manually inlining f() or g(). A correct code: h: pushl %ebp movl $True, %eax movl %esp, %ebp movl 8(%ebp), %edx testl %edx, %edx je .L3 cmpl $Z, (%edx) movl $True, %eax je .L3 movl $False, %eax .L3: leave ret -- Summary: Wrong code generated with -ftree-vrp Product: gcc Version: 4.3.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: tree-optimization AssignedTo: unassigned at gcc dot gnu dot org ReportedBy: qrczak at knm dot org dot pl GCC build triplet: i686-pc-linux-gnu GCC host triplet: i686-pc-linux-gnu GCC target triplet: i686-pc-linux-gnu http://gcc.gnu.org/bugzilla/show_bug.cgi?id=35833