https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105112
--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> --- Example state (picked at random from -fdump-analyzer-exploded-nodes-2 output): EN 113734: preds: EN: 113733 succs: EN: 113735 callstring: [] before (SN: 12511 stmt: 0): if (j_8254 <= 8191) 31 | for (j = 0; j < 8192; j++) { \ | ~~^~~~~~ rmodel: stack depth: 1 frame (index 0): frame: ‘func_schar’@1 clusters within root region cluster for: (*INIT_VAL(a_8725(D))) ESCAPED TOUCHED key: {byte 0} value: ‘unsigned char’ {(CAST(unsigned char, CONJURED(_7228 = get_i ();, (*INIT_VAL(a_8725(D)))))+(CAST(unsigned char, CONJURED(_7228 = get_i () ;, (*INIT_VAL(b_8726(D)))))*CAST(unsigned char, CONJURED(_7228 = get_i ();, (*INIT_VAL(c_8727(D)))))))} key: {byte 1} value: ‘signed char’ {UNKNOWN(signed char)} cluster for: (*INIT_VAL(b_8726(D))): UNKNOWN(schar) (ESCAPED) (TOUCHED) cluster for: (*INIT_VAL(c_8727(D))): UNKNOWN(schar) (ESCAPED) (TOUCHED) clusters within frame: ‘func_schar’@1 cluster for: i_8127: CONJURED(i_8707 = get_i ();, i_8707) cluster for: accum_8740: UNKNOWN(schar) cluster for: z_7997: UNKNOWN(schar) cluster for: x_7611: UNKNOWN(schar) cluster for: y_7867: UNKNOWN(schar) cluster for: j_8254: WIDENING({after SN: 12510}, (int)1, (int)2) m_called_unknown_fn: TRUE constraint_manager: equiv classes: ec0: {(int)0 == [m_constant]‘0’} ec1: {(void *)0B == [m_constant]‘0B’} ec2: {INIT_VAL(a_8725(D))} ec3: {INIT_VAL(b_8726(D))} ec4: {INIT_VAL(c_8727(D))} ec5: {CONJURED(i_8707 = get_i ();, i_8707)} constraints: 0: ec2: {INIT_VAL(a_8725(D))} != ec1: {(void *)0B == [m_constant]‘0B’} 1: ec3: {INIT_VAL(b_8726(D))} != ec1: {(void *)0B == [m_constant]‘0B’} 2: ec4: {INIT_VAL(c_8727(D))} != ec1: {(void *)0B == [m_constant]‘0B’} 3: ec5: {CONJURED(i_8707 = get_i ();, i_8707)} != ec0: {(int)0 == [m_constant]‘0’}