https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104303
--- Comment #5 from Jan Hubicka <hubicka at gcc dot gnu.org> --- So what modref see on calle is: void concat5_pkg1.make_failed (struct s) { struct string___XUB * s$P_BOUNDS; <bb 2> [local count: 1073741824]: concat5_pkg2.compare (s); return; } and it believes that it is safe to only consider global memory accesses since the parameter escapes because we have no EAF flags attached to concat5_pkg1.make_failes nor to concat5_pkg1.compare. Now alias sees: ESCAPED, points-to non-local, points-to NULL, points-to vars: { D.5011 D.5040 } (escaped) .... S9b.6_22 = .builtin_alloca_with_align (_5, 8); (*S9b.6_22)[1 ...]{lb: 1 sz: 1} = "option "; _6 = MAX_EXPR <L7b_19, 7>; _7 = (sizetype) _6; _8 = _7 + 18446744073709551609; _9 = s.P_ARRAY; _10 = &(*S9b.6_22)[8 ...]{lb: 1 sz: 1}; .builtin_memcpy (_10, _9, _8); _11 = iftmp.5_14 + 8; _12 = (sizetype) _11; VIEW_CONVERT_EXPR<character[1:23]>((*S9b.6_22)[_12 ...]{lb: 1 sz: 1}) = " should start with \'--\'"; D.5010.P_ARRAY = S9b.6_22; D.5011.LB0 = 1; D.5011.UB0 = L8b_20; D.5010.P_BOUNDS = &D.5011; concat5_pkg1.make_failed (D.5010); D.5040 is points-to var of the alloca call. I will have to single-step tomorrow to figure out why the oracle thinks that it can not be aliased by global memory when it is seen as escaping...