csmith may generate this code:
int g_1;
int g_2;
int g_3[1]={ 0};
int* g_4 = &g_1;
……
for( int i=0; i<=2; i++){
g_3[g_2] = (*g_4)++;
g_4 = &g_2;
}
There is no problem until the second round, where *g_4 = g_2, and "g_3[g_2] = g_2++;" doesn't satisfy effect safety. But when generate this statement, we didn't know g_4 would point to g_2 in the future, and in Block::post_creation_analysis, it seems also no consideration of this situation.