https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82123
--- Comment #6 from Aldy Hernandez <aldyh at gcc dot gnu.org> --- (In reply to Jakub Jelinek from comment #2) > This is the typical case of value range info being more precise during vrp > pass (where we have ASSERT_EXPRs) rather than elsewhere (where we don't have > them and pin_3 here is set before the condition). Supposedly the planed on > demand value range stuff could help there, but I have no idea for ETA on > that. I haven't looked into this deeply, but for the record, the future on-demand range work seems to have enough information to see that the path into the sprintf has pin within the [0,255] range: ----- BB3 ----- Ranges on entry : s_2(D) : [0, 255] short unsigned int pin_3 : [0, 255] unsigned int <bb 3> [0.00%] [count: INV]: __builtin_sprintf (&name, "%02X", pin_3);