https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> --- Slightly more readable testcase: int * foo (int x, int y, int z, int w) { int *p = __builtin_malloc (z * sizeof (int)); int *q = p - 1; while (--x > 0) { if (w + 1 > y) q = p - 1; ++*q; ++q; } return p; }