https://gcc.gnu.org/bugzilla/show_bug.cgi?id=127838
--- Comment #5 from Richard Sandiford <rsandifo at gcc dot gnu.org> --- (In reply to Richard Biener from comment #4) > 3. When length is passed as signed -16 (0xfffffff0), fold_convert > (sizetype, > length_factor) sign-extends to 0xfffffffffffffff0. Multiplying by 4 > overflows sizetype (modulo 2⁶⁴) to -64 (0xffffffffffffffc0). invert the range check inadvertedly. Yeah, the code predates early breaks and wasn't written with those in mind. At the time, the above would have meant UB, since the pointer accesses would wrap. The condition for early breaks is indeed more complicated.
