https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83299
--- Comment #2 from Martin Sebor <msebor at gcc dot gnu.org> --- Yes, I know the POINTER_PLUS operand is represented as sizetype. But since (when) we know the operand comes from an unsigned expression as in the test case I'm wondering if that information could be used to constrain the POINTER_PLUS operand (or other expressions derived from it) to just the non-negetive subrange. The pointer arithmetic in the test case isn't eliminated until cddce1. There the IL looks like this: f (char * p, size_t i) { char * q; long int _1; signed long _7; <bb 2> : q_4 = p_2(D) + i_3(D); _7 = (signed long) i_3(D); _1 = -_7; if (_7 > 0) goto <bb 3>; [INV] else goto <bb 4>; [INV] <bb 3> : __builtin_abort (); <bb 4> : return; } Since i_3(D) is unsigned it must not be greater than PTRDIFF_MAX, which means that -(signed long) i_3(D) cannot be strictly positive.