https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66163
--- Comment #9 from Jeffrey A. Law <law at redhat dot com> --- We don't thread because we don't lower UBSAN_NULL to actual conditionals until the end of the gimple/ssa pipeline. ie, in DOM2 we have: int test::foo(int&) (struct test * const this, int & b) { int _5; int _6; ;; basic block 2, loop depth 0, count 0, freq 10000, maybe hot ;; prev block 0, next block 3, flags: (NEW, REACHABLE) ;; pred: ENTRY [100.0%] (FALLTHRU,EXECUTABLE) if (this_2(D) != 0B) goto <bb 3>; else goto <bb 4>; ;; succ: 3 [78.3%] (TRUE_VALUE,EXECUTABLE) ;; 4 [21.6%] (FALSE_VALUE,EXECUTABLE) ;; basic block 3, loop depth 0, count 0, freq 7835, maybe hot ;; prev block 2, next block 4, flags: (NEW, REACHABLE) ;; pred: 2 [78.3%] (TRUE_VALUE,EXECUTABLE) UBSAN_NULL (this_2(D), 3B, 0); _5 = this_2(D)->a; ;; succ: 4 [100.0%] (FALLTHRU,EXECUTABLE) ;; basic block 4, loop depth 0, count 0, freq 10000, maybe hot ;; prev block 3, next block 1, flags: (NEW, REACHABLE) ;; pred: 2 [21.6%] (FALSE_VALUE,EXECUTABLE) ;; 3 [100.0%] (FALLTHRU,EXECUTABLE) # _6 = PHI <1(2), _5(3)> return _6; ;; succ: EXIT [100.0%] (EXECUTABLE) }