https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117572
--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> --- After adding a hack like: ``` (simplify (minus (plus:c @2 (convert ADDR_EXPR@0)) (convert @1)) (if (tree_nop_conversion_p (type, TREE_TYPE (@0))) (with { poly_int64 diff; } (if (ptr_difference_const (@0, @1, &diff)) (plus @2 { build_int_cst_type (type, diff); }))))) (simplify (minus (plus:c @2 (convert @0)) (convert ADDR_EXPR@1)) (if (tree_nop_conversion_p (type, TREE_TYPE (@0))) (with { poly_int64 diff; } (if (ptr_difference_const (@0, @1, &diff)) (plus @2 { build_int_cst_type (type, diff); }))))) ``` For the original testcase we get: ``` _386 = (sizetype) &o; _390 = _386 + 2; h_391 = (char *) _390; h_392 = h_391 + 1; _394 = h_392 - &o; _395 = (int) _394; ``` Seems like h_391 could be optimized to just: `&o p+ 2 ` . Which means _395 is just 3. Filed that as PR 117601.