http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59083
--- Comment #17 from Jeffrey A. Law <law at redhat dot com> --- Markus, For the kernel case, note the qsort prototype and the non-null attribute. That explicitly states that the pointer arguments must not be null. Any code which then passes null for those arguments has stepped into the realm of undefined behaviour. Prior to CCP2 we have: main () { int * _3; ;; basic block 2, loop depth 0, count 0, freq 10000, maybe hot ;; prev block 0, next block 1, flags: (NEW, REACHABLE) ;; pred: ENTRY [100.0%] (FALLTHRU,EXECUTABLE) _3 = a.offset; qsort (_3, 0); return 0; ;; succ: EXIT [100.0%] } a.offset gets folded to zero by CCP2 resulting in: main () { ;; basic block 2, loop depth 0, count 0, freq 10000, maybe hot ;; prev block 0, next block 1, flags: (NEW, REACHABLE) ;; pred: ENTRY [100.0%] (FALLTHRU,EXECUTABLE) qsort (0B, 0); return 0; ;; succ: EXIT [100.0%] } Note we're passing NULL as the first argument to qsort, which has a declaration saying that none of its pointer arguments can be NULL. Note we're able to fold a.offset to zero because we can see "a"'s initializer. AFAICT the code is doing exactly what is expected.