https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117279
--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> --- it's because p points to itself and thus p.ptr[index] "points to" p: p.ptr = &p.local_buf; .. _4 = p.ptr; _5 = _4 + index_11(D); _6 = *_5; _7 = (int) _6; __builtin_printf ("%c\n", _7); points-to does not use range-info to see that _4 + index_11(D) doesn't access p.ptr. In the end any non-constant pointer offsetting will cause us to consider the whole object. This could in theory be improved with (static) range-info.