https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105642
--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> --- That seems completely correct. Try: int foo (struct ceph_inode_info *n) { int *i = &n->vfs_inode; return __builtin_object_size(i, 1); } This returns 4, even GCC 4.6 returned that. So, __builtin_object_size(i + 1, 1); which matches what you actually do in the testcase is 0. Now, with 0 instead of 1 as last argument it is -1 of course in both cases.