https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94858
--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> --- It looks like we lose the: cluster for: (*INIT_VAL(td_14(D))) ESCAPED key: {kind: direct, start: 0, size: 64, next: 64} value: ‘hashNx *’ {&HEAP_ALLOCATED_REGION(0)} at the "*index.0_1 = -1;", where the whole cluster for *INIT_VAL(td_14(D)) becomes unknown. I think the aliasing code conservatively assumes that this write could affect the *INIT_VAL(td_14(D)). But that was the initial value of a pointer param, whereas HEAP_ALLOCATED_REGION is a freshly allocated heap region, so they can't alias. Looks like I need to teach that to the pointer-aliasing logic.