https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91597
--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> --- As mentioned by Richi, else if (code == BIT_AND_EXPR) { /* For pointer types, we are really only interested in asserting whether the expression evaluates to non-NULL. */ if (!range_includes_zero_p (&vr0) && !range_includes_zero_p (&vr1)) vr->set_nonzero (expr_type); is incorrect, even when both pointer value ranges are non-zero, the result of BIT_AND_EXPR can be zero, as can be seen on this testcase. The first argument being non-NULL as dereferenced, the other argument constant 1B, the pointer aligned and thus actually & 1 always zero, not always non-zero, but even if it would not be always aligned, it could be sometimes zero and sometimes not.