https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111766
--- Comment #1 from Andrew Macleod <amacleod at redhat dot com> --- Imports: bb_3(D) Exports: _2 bb_3(D) _2 : bb_3(D)(I) bb_3(D) [irange] int [0, 3] MASK 0x3 VALUE 0x0 <bb 4> : _2 = bb_3(D) & 1; if (_2 == 0) goto <bb 5>; [INV] else goto <bb 6>; [INV] _2 : [irange] int [0, 1] MASK 0x1 VALUE 0x0 4->5 (T) _2 : [irange] int [0, 0] MASK 0x1 VALUE 0x0 4->5 (T) bb_3(D) : [irange] int [0, 0][2, 2] MASK 0x2 VALUE 0x0 4->6 (F) _2 : [irange] int [1, 1] MASK 0x1 VALUE 0x0 4->6 (F) bb_3(D) : [irange] int [1, 3] MASK 0x2 VALUE 0x1 Looks like its just a lack of completeness in operator_bitwise_and::op1_range(). on the edge from 4->6 ranger knows _2 is [1,1], but when op1_range solves for _2 = bb_3 & 1 we have [1,1] = int [0, 3] MASK 0x3 VALUE 0x0 & 1 and it produces int [1, 3] rather than [1,1][3,3]