https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94675
--- Comment #20 from Andrew Pinski <pinskia at gcc dot gnu.org> --- So on the trunk we get: c_len.0_1 = c_len; _2 = (long unsigned int) c_len.0_1; _6 = &c + _2; MEM <const void *> [(struct pstream_t *)&ps] = &c; MEM <const void *> [(struct pstream_t *)&ps + 8B] = _6; _17 = (signed long) c_len.0_1; _11 = _17; _12 = (long unsigned int) _11; if (_12 > 6) goto <bb 3>; [50.00%] else goto <bb 4>; [50.00%] <bb 3> [local count: 483183820]: ps.D.4009.s = &MEM <byte> [(void *)&c + 7B]; <bb 4> [local count: 590558005]: Which is correct, I think the original testcase and the testcase in comment #1 and comment #11 are bogus and incorrect. There is always an out of bounds.