https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103121
--- Comment #8 from Martin Sebor <msebor at gcc dot gnu.org> --- The [1, 1] range comes from a call to qry->range_of_expr (vr, exp, stmt) in in get_size_range() in pointer-query.cc: (gdb) p debug(gimple_bb(stmt)) <bb 4> [local count: 118111600]: _4 = _1 + 1; grp_name_37 = __builtin_alloca (_4); p_38 = _32->identifier.id.str; q_39 = _35->identifier.id.str; if (_1 != 0) goto <bb 16>; [89.00%] else goto <bb 12>; [11.00%] $3 = void (gdb) n 326 max = wi::to_wide (vr.max ()); (gdb) p range_type $4 = VR_RANGE (gdb) p debug_tree(vr.min()) <integer_cst 0x7ffff6da91e0 type <integer_type 0x7ffff78b69d8 size_t> constant 1> $5 = void (gdb) p debug_tree(vr.max()) <integer_cst 0x7ffff6da91e0 type <integer_type 0x7ffff78b69d8 size_t> constant 1> $6 = void (gdb) up #1 0x0000000001513720 in gimple_call_alloc_size (stmt=0x7ffff4c23d80, rng1=0x7fffffffc980, qry=0x7fffffffd8a0) at /src/gcc/master/gcc/pointer-query.cc:506 506 if (!get_size_range (qry, size, stmt, r, SR_ALLOW_ZERO | SR_USE_LARGEST)) (gdb) #2 0x000000000151a68c in handle_ssa_name (ptr=0x7ffff4d0ebd0, addr=false, ostype=1, pref=0x7fffffffd230, snlim=..., qry=0x7fffffffd978) at /src/gcc/master/gcc/pointer-query.cc:2088 2088 if (gimple_call_alloc_size (stmt, wr, rvals)) (gdb) #3 0x000000000151bd4c in compute_objsize_r (ptr=0x7ffff4d0ebd0, stmt=0x7ffff4de2730, addr=false, ostype=1, pref=0x7fffffffd230, snlim=..., qry=0x7fffffffd978) at /src/gcc/master/gcc/pointer-query.cc:2380 2380 return handle_ssa_name (ptr, addr, ostype, pref, snlim, qry); (gdb) #4 0x0000000001519e17 in handle_mem_ref (mref=0x7ffff47f8a00, stmt=0x7ffff4de2730, ostype=1, pref=0x7fffffffd230, snlim=..., qry=0x7fffffffd978) at /src/gcc/master/gcc/pointer-query.cc:1976 1976 if (!compute_objsize_r (mrefop, stmt, false, ostype, pref, snlim, qry)) (gdb) #5 0x000000000151b844 in compute_objsize_r (ptr=0x7ffff47f8a00, stmt=0x7ffff4de2730, addr=false, ostype=1, pref=0x7fffffffd230, snlim=..., qry=0x7fffffffd978) at /src/gcc/master/gcc/pointer-query.cc:2314 2314 return handle_mem_ref (ptr, stmt, ostype, pref, snlim, qry); (gdb) #6 0x000000000151befc in compute_objsize (ptr=0x7ffff47f8a00, stmt=0x7ffff4de2730, ostype=1, pref=0x7fffffffd230, ptr_qry=0x7fffffffd978) at /src/gcc/master/gcc/pointer-query.cc:2414 2414 if (!compute_objsize_r (ptr, stmt, false, ostype, pref, snlim, ptr_qry)) (gdb) #7 0x000000000192c0df in strlen_pass::maybe_warn_overflow ( this=0x7fffffffd880, stmt=0x7ffff4de2730, call_lhs=true, len=0x7ffff78ff4e0, si=0x0, plus_one=false, rawmem=false) at /src/gcc/master/gcc/tree-ssa-strlen.c:2038 2038 tree destsize = compute_objsize (dest, stmt, ostype, &aref, &ptr_qry); (gdb) dg stmt # .MEM_53 = VDEF <.MEM_36> *grp_name_37 = 0; $7 = (gimple *) 0x7ffff4de2730