https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108384
--- Comment #3 from David Binderman <dcb314 at hotmail dot com> --- (In reply to Andrew Pinski from comment #2) > The code is undefined ... > > func_23(l_26[1]); > > func_23(struct S0 p_24, struct S0 p_25) Interesting. It looks like the reduction has not preserved the two parameters required of func_23. >From the original csmith produced code: $ fgrep func_23 bug873.c static union U2 * func_23(struct S0 p_24, const struct S1 p_25); if ((((*l_9) &= 0x3631L) , (safe_div_func_int32_t_s_s((safe_sub_func_int8_t_s_s((((safe_mod_func_uint32_t_u_u(((func_17(func_23(l_26[1], l_27), l_9, ((*l_1367) = l_1366), (safe_add_func_uint32_t_u_u(((safe_div_func_uint8_t_u_u(((safe_rshift_func_uint8_t_u_s((l_27.f0 > p_3), 1)) || (((safe_div_func_int64_t_s_s(p_3, p_3)) != 0x47247D4EED584808LL) || g_1119)), 0x21L)) > g_1165[0]), 0xB3A4A36DL)), l_27.f4.f0) <= 0x334C102EE31FC4EFLL) & p_3), g_7.f0)) & g_1165[0]) || l_1397), 0L)), 0x55B9621EL)))) static union U2 * func_23(struct S0 p_24, const struct S1 p_25) Two parameters in the first declaration, two in the call and two in the definition.