https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88936
--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> --- So the idea for the fix is to make locals that escape through recursive edges behave as if they were really *ptr with ptr pointing to &local, &localp where localp would be "the other locals". This could be done on the constraint level. Semantically equivalent is doing the above by post-processing the points-to sets after propagation and replacing 'local' with 'local + localp'. We'd need to gather a bitmap of candidate UIDs for this which we could eventually prune by the set of vars that do not escape through such an edge (implementation is not entirely clear). What is missing right now is a conservative predicate telling us whether defined function X is reachable recursively. Honza?
