https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108793
--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> --- It's caused by -1 -A -> ~A being invoked from number_of_iterations_until_wrap: 1497 num = fold_build2 (MINUS_EXPR, niter_type, wide_int_to_tree (type, max), 1498 iv1->base); (gdb) p iv1->base $3 = <addr_expr 0x7ffff6a77560> (gdb) p niter_type $4 = <integer_type 0x7ffff68e81f8> while _until_wrap probably doesn't make much sense for pointer IVs, the above has signed vs. unsigned type issues anyway.