https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103121
--- Comment #12 from Martin Sebor <msebor at gcc dot gnu.org> --- Okay, here's my question: when I call range_of_expr (vr, _4, stmt) with stmt being 'grp_name_37 = __builtin_alloca (_4)' in BB 4, should I not expect the result to be either VR_VARYING or [0, +INF]? What I think is wrong is that the result is VR_RANGE [1, 1]. That is true in BB 12 but I did not tell ranger that I'm asking about _4 for BB 12 (i.e., the 4->12 edge). I just asked it about _4 in BB 4. The result for the BB 12 query actually happens to be cached by the pointer_query class and retrieved for subsequent queries about pointers used in other BB's, but those queries are all independent of the path from BB 4 to the BB they're being made for. When I disable the caching then the first query about _4 in BB 4 (made on behalf of BB 12) gives me [1, 1], and the query for _4 in BB 4 (made on behalf of BB 13) gives me VR_VARYING and the warning disappears. The latter is as expected but I don't expect to get a different range for the same SSA_NAME in the same basic block unless I specify which outgoing edge I'm interested in. So what am I missing?