https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86886
--- Comment #2 from Qirun Zhang <helloqirun at gmail dot com> --- (In reply to Andrew Pinski from comment #1) > I don't think this is a bug. You are taking the address of a field of an > union and accessing via that address. This is not tracked at all. Here is a reduced case without "union". $ gcc-6.1 -O3 abc.c; ./a.out 0 $ gcc abc.c; ./a.out 0 $ gcc-8.1 -O3 abc.c; ./a.out 1 $ gcc-trunk -O3 abc.c; ./a.out 1 $ cat abc.c void printf(); short b, c; int e, d; int *f = &e, *g = &d; unsigned short **h = (unsigned short **)&f; void i(int a) { *f = 0; for (; b;) ; c = **h; d = b = e ? (unsigned char)c : 0; *g = b; } int main() { **h = 1; i(6); printf("%d\n", c); }