https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111519
Richard Biener <rguenth at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jakub at gcc dot gnu.org --- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> --- g = 0; for (; g <= 1; g++) { *n = **j; k[g] = 0 != &m; *e = l && k[0]; } this is g = 0; d = f; // 0 k[0] = 1; f = 1; g = 1; d = f; // 1 k[1] = 1; f = 1; g = 2; that looks still equivalent to what we have after unrolling this loop in cunroll and also after DOM3 which really points to strlen wrongly considering 'd' zero. Before strlen we have <bb 7> [local count: 1605787]: _2 = e; _3 = *_2; k[0] = 1; l.8_91 = l; if (l.8_91 != 0B) goto <bb 8>; [70.00%] else goto <bb 9>; [30.00%] <bb 8> [local count: 1124051]: <bb 9> [local count: 1605787]: # prephitmp_82 = PHI <0(7), 1(8)> *_2 = prephitmp_82; _7 = e; _8 = *_7; k[1] = 1; l.8_10 = l; if (l.8_10 != 0B) goto <bb 10>; [70.00%] else goto <bb 11>; [30.00%] <bb 10> [local count: 1124051]: <bb 11> [local count: 14598063]: # prephitmp_89 = PHI <1(10), 0(9)> *_7 = prephitmp_89; d = _8; g = 2; if (q_32(D) == 0) goto <bb 12>; [33.00%] else goto <bb 18>; [67.00%] that's the OK part, now into the tail loop - q_32(D) is 1: <bb 18> [local count: 9780702]: o.16_80 = o; if (o.16_80 <= 3) goto <bb 13>; [89.00%] else goto <bb 17>; [11.00%] <bb 13> [local count: 8704825]: d_lsm0.28_35 = d; <bb 14> [local count: 79134774]: # prephitmp_6 = PHI <o.16_80(13), _85(14)> _96 = (int) d_lsm0.28_35; _85 = prephitmp_6 + 1; if (_85 != 4) goto <bb 14>; [89.00%] else goto <bb 16>; [11.00%] <bb 16> [local count: 8704825]: a = _96; o = 4; <bb 17> [local count: 14598063]: a.17_23 = a; printf ("%d\n", a.17_23); return 0; and the strlen pass replaces d_lsm0.28_35 = d; with d_lsm0.28_35 = 0; which is wrong. Your assessment "Here the assignment to *_73 overwrites the value of f (at *e) which then invalidates the use of _72 resulting in the wrong value for d." seems odd, it's exactly writing the correct value (in fact both stores write the value one, only the very original value is zero). I don't know the strlen pass at all so I can't tell where it goes wrong.