https://gcc.gnu.org/bugzilla/show_bug.cgi?id=78655
--- Comment #10 from Andrew Macleod <amacleod at redhat dot com> --- We currently get everything except the last tidbit. a_1(D) int * VARYING <bb 2> : x_2 = a_1(D) == 0B; a_3 = a_1(D) + 40; return x_2; When we see a_3 = a_1(D) + 40; Are we allowed to assume that a_1 is non-null, just like we do with *a_1? That seems a little dicier Because if that is a valid assumption, we can handle pointer_plus the same as we do non-null pointer tracking of dereferences. That alone might handle it. We could also consider recalculating x_2 at the return location if need be. If we cant make that assumption, then there isn't much else to do here as the rest of the PR is covered.