https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104970
--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> --- If that works, please add at least a check that TREE_CODE (typesize) == INTEGER_CST (or perhaps also POLY_INT_CST) if it really needs to be multiplied by the size of what the pointer points to. In which case the question is also what should happen for void * parameters, the code right now doesn't multiply it by anything in that case: if (typesize) sz = size_binop (MULT_EXPR, sz, typesize); but IMHO it should give up for arbitrary incomplete types and just handle the void * case (so punt on !typesize unless TREE_CODE (TREE_TYPE (TREE_TYPE (parm))) == VOID_TYPE?). The documentation says: "The optional @var{size-index} positional argument denotes a function argument of integer type that specifies the maximum size of the access. The size is the number of elements of the type referenced by @var{ref-index}, or the number of bytes when the pointer type is @code{void*}." so if you have struct S; void foo (struct S *p, int sz) with access attribute I think you just want to punt.