https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86216
--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> --- I can't fully reproduce the obfuscation of the C++ FE (the +-1) but the following is close but it also works: typedef int intptr_t; void foo (intptr_t n, unsigned a) { typedef intptr_t ArrTy[(long)a+1]; ArrTy buffer2; ArrTy buffer1[(long)a+1]; void bar () { n = sizeof(buffer1[n]); void baz() { n = sizeof(buffer2); } baz(); } bar(); } and it has similar gimplification (but not broken): foo (intptr_t n, unsigned int a) { ... _1 = (long int) a; D.1910 = _1 + 1; bar () { static void baz (); _1 = (unsigned int) D.1910; _2 = _1 * 4; n = (intptr_t) _2; baz (); } baz () { _1 = (unsigned int) D.1910; _2 = _1 * 4; n = (intptr_t) _2; } without the array size adjustment I get the SAVE_EXPR only wrapping a, so some promotion done by the C++ FE ends up breaking things.