https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104475
--- Comment #18 from Richard Biener <rguenth at gcc dot gnu.org> --- The change improved the wording of the diagnostic by appending the note indicating an object at zero address. It didn't mitigate the diagnostic which as far as I analyzed is technically correct (but not very helpful). An improvement for these diagnostics would be analyzer-style reporting of the guarding conditions. Another possible improvement would be to somehow keep a pointer to the symbolic base we equality-propagated from the conditional so that we, for if (!d) if (enabled) *d = 0; can say the object pointed-to by 'd' when 'd' is nullptr is accessed here. The IL currently just has a pointer constant and doesn't know that was originally derived from 'd'.