https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65851
--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> --- Ok, so it goes like Visiting PHI node: f_12 = PHI <0B(2), f_8(5)> Argument #0 (2 -> 6 executable) 0B Value: CONSTANT 0B Argument #1 (5 -> 6 not executable) PHI node value: CONSTANT 0B ... Visiting statement: _15 = (long unsigned int) _14; which is likely CONSTANT Lattice value changed to CONSTANT 0x0 (0x0fffffffffffffff0). Adding SSA edges to worklist. Visiting statement: _3 = f_12 + _15; which is likely CONSTANT Applying pattern match.pd:54, gimple-match.c:9714 Applying pattern match.pd:54, generic-match.c:4594 Lattice value changed to CONSTANT 0x0 (0x0fffffffffffffff0). Adding SSA edges to worklist. (should have simplified to _15 ...? Ah, no - to (ptrtype)_15!) ... Visiting PHI node: f_12 = PHI <0B(2), f_8(5)> Argument #0 (2 -> 6 executable) 0B Value: CONSTANT 0B Argument #1 (5 -> 6 executable) f_8 Value: VARYING PHI node value: VARYING ... Visiting statement: _15 = (long unsigned int) _14; which is likely CONSTANT Lattice value changed to VARYING. Adding SSA edges to worklist. Now we can look at both defs when combining stmts during simplification: Visiting statement: _3 = f_12 + _15; which is likely CONSTANT Applying pattern match.pd:413, gimple-match.c:9792 Match-and-simplified f_12 + _15 to &e ICE. e.4_11 = (long int) &e; f.5_13 = (long int) f_12; _14 = e.4_11 - f.5_13; _15 = (long unsigned int) _14; _3 = f_12 + _15; and yes - that combines to &e. The interesting thing here is that our safety net for tuning down combining stmts is too conservative (again), because we can very well look at stmt definitions as long as we don't valueize anything for stmts we want to re-visit again. That's of course not so trivial to implement ... (ideally we'd have applied the simplification earlier - this is after all "unfolded" IL)