https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102974
--- Comment #13 from cqwrteur <unlvsur at live dot com> --- Hi, the problem comes out GCC does not do a very good job to deal with crypto computations that usually exploit all sorts of patterns. template<typename T> inline constexpr T add_carry_no_carry_in(T a,T b,T& carryout) noexcept { T res{a+b}; carryout=res<a; return res; } template<typename T> inline constexpr T add_carry(T a,T b,T carryin,T& carryout) noexcept { assume(carryout==0||carryout==1); a=add_carry_no_carry_in(carryin,a,carryout); a=add_carry_no_carry_in(a,b,carryin); carryout+=carryin; return a; } See this pattern https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106865 I suggest just adding this addc pattern to GCC instead of adding a built-in like clang. This can improve the existing code. It is, however, needed for adding a backend hook for dealing with it.