https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117572
--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
After adding a hack like:
```
(simplify
(minus (plus:c @2 (convert ADDR_EXPR@0)) (convert @1))
(if (tree_nop_conversion_p (type, TREE_TYPE (@0)))
(with { poly_int64 diff; }
(if (ptr_difference_const (@0, @1, &diff))
(plus @2 { build_int_cst_type (type, diff); })))))
(simplify
(minus (plus:c @2 (convert @0)) (convert ADDR_EXPR@1))
(if (tree_nop_conversion_p (type, TREE_TYPE (@0)))
(with { poly_int64 diff; }
(if (ptr_difference_const (@0, @1, &diff))
(plus @2 { build_int_cst_type (type, diff); })))))
```
For the original testcase we get:
```
_386 = (sizetype) &o;
_390 = _386 + 2;
h_391 = (char *) _390;
h_392 = h_391 + 1;
_394 = h_392 - &o;
_395 = (int) _394;
```
Seems like h_391 could be optimized to just:
`&o p+ 2 ` .
Which means _395 is just 3.
Filed that as PR 117601.