https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81281
--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> --- void foo (unsigned p, unsigned a, unsigned b) { unsigned q = p + 7; if (a - (1U + __INT_MAX__) >= 2) __builtin_unreachable (); int d = p + b; int c = p + a; if (c - d != __INT_MAX__) __builtin_abort (); } void bar (unsigned p, unsigned a) { unsigned q = p + 7; if (a - (1U + __INT_MAX__) >= 2) __builtin_unreachable (); int c = p; int d = p + a; if (c - d != -__INT_MAX__ - 1) __builtin_abort (); } int main () { foo (-1U, 1U + __INT_MAX__, 1U); bar (-1U, 1U + __INT_MAX__); return 0; } is a testcase that fails on the trunk with -O2 because of this (without any sanitization). On the other side, when add is a plus and not pointer_plus, the pattern doesn't contain :c as I found when writing the testcase, so it matches only if the SSA_NAMEs are in the right order.