https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66678
--- Comment #1 from vries at gcc dot gnu.org --- I. (In reply to vries from comment #0) > AFAIU: > - the loop iv i_1 has range [0, 4294967294], and This bit is incorrect. i_1 can actually be 4294967295. II. With this demonstrator patch: ... diff --git a/gcc/tree-vrp.c b/gcc/tree-vrp.c index fdaebe4..3dd2992 100644 --- a/gcc/tree-vrp.c +++ b/gcc/tree-vrp.c @@ -1890,7 +1890,8 @@ extract_range_from_assert (value_range_t *vr_p, tree expr) max = fold_build2 (PLUS_EXPR, TREE_TYPE (max), max, build_int_cst (TREE_TYPE (max), -1)); else - max = fold_build2 (MINUS_EXPR, TREE_TYPE (max), max, + max = fold_build2 (MINUS_EXPR, TREE_TYPE (max), + TYPE_MAXVAL (TREE_TYPE (max)), build_int_cst (TREE_TYPE (max), 1)); if (EXPR_P (max)) TREE_NO_WARNING (max) = 1; ... we get: ... # RANGE [1, 4294967295] i_17 = i_1 + 1; ...