Detailed info in the PR. As we walk the DOM tree to calculate ranges, any block with multiple predecessors is processed by evaluating and unioning incoming values. This catches more complex cases where the dominator node itself may not carry range adjustments that we care about. What was missing was the "quick check" doesn't propagate any info. If the edge we check is dominated by this block (ie, its a back edge), then no additional useful information can be provided as it just leads back to where we currently are.   Only edges which are not dominated by the current block need be checked. The issue arose because this "quick check" mechanism gives up on complex cases and returns VARYING... so any backedge would union the real value from the dominators with the failed result "VARYING" from that edge, and we get VARYING instead of the correct result. The patch simply checks if the current block dominates the predecessor of an edge before launching the query. Performance impact in negligible. slight slowdown for the check, slight speedup by doing less work.. its a wash. Bootstraps on x86_64-pc-linux-gnu with no regressions. Ok for trunk? Andrew PS I have not managed to produce a reduced testcase yet.. If I do I will supply it.