https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109791
--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> --- So the first pass that makes things difficult is reassoc which transforms _51 = (unsigned long) &MEM <char[3]> [(void *)&str + 2B]; _4 = (unsigned long) __i_44; _65 = _51 - _4; _48 = _65 + 18446744073709551615; _46 = _48 > 13; if (_46 != 0) to _51 = (unsigned long) &MEM <char[3]> [(void *)&str + 2B]; _4 = (unsigned long) __i_44; _12 = -_4; _119 = _51 + 18446744073709551615; _48 = _119 - _4; _46 = _48 > 13; if (_46 != 0) (also leaving garbage around). That's probably because of the PHI biasing and __i_44 being defined by a PHI. niter analysis produces # of iterations (((unsigned long) &MEM <char[3]> [(void *)&str + 2B] - (unsigned long) __i_44) + 18446744073709551615) / 2, bounded by 9223372036854775807 but doesn't expand __i_44 (not sure if we'd fold the thing then). The gimplifier folds stmts w/o following SSA edges when we eventually re-gimplify those expressions for insertion. If we expand offsetting of invariant bases we get instead # of iterations ((unsigned long) &MEM <char[3]> [(void *)&str + 2B] - (unsigned long) (&str + (_69 + 1))) / 2, bounded by 9223372036854775807 but that's still not simplified. I think ptr_difference_const should handle this - of course the difference here isn't const... /* Try folding difference of addresses. */ (simplify (minus (convert ADDR_EXPR@0) (convert @1)) (if (tree_nop_conversion_p (type, TREE_TYPE (@0))) (with { poly_int64 diff; } (if (ptr_difference_const (@0, @1, &diff)) { build_int_cst_type (type, diff); })))) (simplify (minus (convert @0) (convert ADDR_EXPR@1)) (if (tree_nop_conversion_p (type, TREE_TYPE (@0))) (with { poly_int64 diff; } (if (ptr_difference_const (@0, @1, &diff)) { build_int_cst_type (type, diff); })))) it works fine when adding (simplify (minus (convert ADDR_EXPR@0) (convert (pointer_plus @1 @2))) (if (tree_nop_conversion_p (type, TREE_TYPE (@0))) (with { poly_int64 diff; } (if (ptr_difference_const (@0, @1, &diff)) (minus { build_int_cst_type (type, diff); } (convert @2)))))) then we get # of iterations (1 - (unsigned long) _69) / 2, bounded by 9223372036854775807 and the diagnostic is gone.