> Ok, I just looked for POINTER_PLUS_EXPR and tried to make sure its > offset is always sign-extended. Can you check where on the call > path above we miss this special treatment?
It looks like it drops past them all and gets the generic treatment, just before the MINUS_EXPR case.