https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72488
--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> --- -Os -fno-tree-sink -fno-tree-reassoc -fno-tree-loop-im -fno-tree-pre -fdisable-tree-ifcombine -fno-tree-loop-optimize -fno-tree-forwprop -fdisable-tree-vrp2 -fdisable-tree-phiopt3 -fdisable-tree-phiopt2 -fdump-tree-all-lineno -fdisable-tree-widening_mul -fdisable-tree-dom3 -fdisable-tree-phicprop2 -fdisable-tree-slsr -fdisable-tree-pre -fdisable-tree-dom2 -fdisable-tree-cselim -fdisable-tree-phiopt1 -fdisable-tree-tailr2 -fdisable-tree-ch2 -fdisable-tree-cdce -fdisable-tree-isolate-paths -fno-if-conversion -fno-if-conversion2 -fdbg-cnt=registered_jump_thread:0 -fdisable-tree-phicprop1 -fdisable-tree-bswap -fdisable-tree-laddress -fdisable-tree-sra -fno-move-loop-invariants -da -fdisable-rtl-hoist still reproduces it. Looking at VRP1 in more detail may be worth, eventually adding some debug counter for substitute-and-fold to force some ranges varying.
