https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94940
--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> --- I think array_at_struct_end_p conservatively returns true for p->a[i] though. Indeed all calls to the function return the correct value. So is it somebody invented a "more clever" variant of said check? Or do we simply fail to call it? Ok, more clever it is: bool vrp_prop::check_array_ref (location_t location, tree ref, bool ignore_off_by_one) { ... if (!up_bound || TREE_CODE (up_bound) != INTEGER_CST || (warn_array_bounds < 2 && array_at_struct_end_p (ref))) { ... const bool compref = TREE_CODE (arg) == COMPONENT_REF; if (compref) { /* Try to determine the size of the trailing array from its initializer (if it has one). */ if (tree refsize = component_ref_size (arg, &interior_zero_len)) if (TREE_CODE (refsize) == INTEGER_CST) maxbound = refsize; and refsize == 0 here. Parsing an initializer for a union is tricky but this one clearly gets the wrong answer from that.