https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103121
--- Comment #14 from Andrew Macleod <amacleod at redhat dot com> --- As near as I can tell, you are calling debug_ranger () to see what ranger could produce. That routine creates a new ranger and populates it, dumps out the results, kills the ranger and returns. When I put a breakpoint in the code: 2181 tree tlen = build_int_cst (size_type_node, len); (gdb) c Continuing. Breakpoint 1, strlen_pass::maybe_warn_overflow (this=0x7fffffffcec0, stmt=0x7fffe9f63910, call_lhs=true, len=0x7fffe9f4ed50, si=0x0, plus_one=false, rawmem=false) at /gcc/master/gcc/gcc/tree-ssa-strlen.c:1998 1998 if (!len || warning_suppressed_p (stmt, OPT_Wstringop_overflow_)) (gdb) p print_gimple_stmt (stderr, stmt, 0 ,0) *grp_name_25 = 0; $8 = void (gdb) enable 2 (gdb) c Continuing. Breakpoint 2, vr_values::range_of_expr (this=0x7fffffffcee0, r=..., expr=0x7fffe9f5d0d8, stmt=0x7fffe9f5b240) at /gcc/master/gcc/gcc/vr-values.c:182 182 if (!gimple_range_ssa_p (expr)) (gdb) p print_generic_expr (stderr, expr, 0) _2$9 = void (gdb) p print_gimple_stmt (stderr, stmt, 0, 0) grp_name_25 = __builtin_alloca (_2); $10 = void So yes, you are asking for the range of _2 at that statement.... but note the traceback shows you are invoking: Breakpoint 2, vr_values::range_of_expr Which means you aren't using ranger... that callback is into vr_values... which is the old EVRP engine. Have you called enable_ranger() to turn it on for your pass? You should be seeing gimple-ranger::range_of_expr() in that traceback. That also explains why when I range --param=ranger-debug=trace I wasn't seeing any calls in your listing. Looking deeper, the place where this is called from in get_size_range: if (!query) query = get_range_query (cfun); if (integral) { value_range vr; query->range_of_expr (vr, exp, stmt); p get_range_query (cfun) $11 = (range_query *) 0x40d9a80 <global_ranges> So if you didn't have a range query, it would have picked up global ranges.. Looking down the call chain: #0 vr_values::range_of_expr (this=0x7fffffffcee0, r=..., expr=0x7fffe9f5d0d8, stmt=0x7fffe9f5b240) at /gcc/master/gcc/gcc/vr-values.c:182 #1 0x000000000163c58c in get_size_range (query=0x7fffffffcee0, exp=0x7fffe9f5d0d8, stmt=0x7fffe9f5b240, range=0x7fffffffb840, flags=3) at /gcc/master/gcc/gcc/pointer-query.cc:320 #2 0x000000000163d724 in gimple_call_alloc_size (stmt=0x7fffe9f5b240, rng1=0x7fffffffbb20, qry=0x7fffffffcee0) at /gcc/master/gcc/gcc/pointer-query.cc:506 #3 0x0000000001643501 in compute_objsize_r (ptr=0x7fffe9f5d870, stmt=0x7fffe9f5b240, ostype=1, pref=0x7fffffffc7f0, snlim=..., qry=0x7fffffffcfb8) at /gcc/master/gcc/gcc/pointer-query.cc:1970 #4 0x000000000164224c in handle_mem_ref (mref=0x7fffe9f6d230, stmt=0x7fffe9f63910, ostype=1, pref=0x7fffffffc7f0, snlim=..., qry=0x7fffffffcfb8) at /gcc/master/gcc/gcc/pointer-query.cc:1702 #5 0x0000000001642d63 in compute_objsize_r (ptr=0x7fffe9f6d230, stmt=0x7fffe9f63910, ostype=1, pref=0x7fffffffc7f0, snlim=..., qry=0x7fffffffcfb8) at /gcc/master/gcc/gcc/pointer-query.cc:1865 #6 0x00000000016441a9 in compute_objsize (ptr=0x7fffe9f6d230, stmt=0x7fffe9f63910, ostype=1, pref=0x7fffffffc7f0, ptr_qry=0x7fffffffcfb8) at /gcc/master/gcc/gcc/pointer-query.cc:2154 #7 0x0000000001a71634 in strlen_pass::maybe_warn_overflow (this=0x7fffffffcec0, stmt=0x7fffe9f63910, call_lhs=true, len=0x7fffe9f4ed50, si=0x0, plus_one=false, rawmem=false) at /gcc/master/gcc/gcc/tree-ssa-strlen.c:2038 I see you are passing this range_query down the call chain from the maybe_warn_overflow. I am not sure where you picked up a vr-values range query... but if you had simply called enable_ranger() at the start of the pass, and let cfun->get_range_query() get the query object in get_size_range(), I would expect you to see rangers results. As it is, I don't know what you are looking at, nor where it came from.