https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61409
--- Comment #16 from Jeffrey A. Law <law at redhat dot com> --- AFAICT tree-ssa-uninit won't look at the predicate associated with an undefined PHI argument and test it against the predicate for the actual use. ie, given this PHI from the testcase: ;; basic block 6, loop depth 0 ;; pred: 9 ;; 5 # ptr_1 = PHI <ptr_5(D)(9), ptr_9(5)> We want to look at the control dependent path that leads to the edge (9,5). For this test, that edge is control dependent on bb2: ;; basic block 2, loop depth 0 ;; pred: ENTRY if (i_4(D) != 0) goto <bb 3>; else goto <bb 9>; ie, we know that for ptr_1 to take the value ptr_5 that i_4 != 0 must be false. So the guard for the edge (9,5) is NOT i_4 != 0. And in this testcase, the actual use of ptr_1 is guarded by: if (i_4(D) != 0) goto <bb 7>; else goto <bb 11>; When i_4 != 0 is true, then we'll get to the use. So the guard for the use is i_4 != 0 Those two guards can never both be true. So there's no way at runtime for the value ptr_5 to flow into ptr_1 and then into the use of ptr_1 in bb7. And AFAICT, tree-ssa-uninit.c doesn't have the code to do that kind of analysis.