diff --git a/gcc/testsuite/gcc.dg/torture/pr114048.c b/gcc/testsuite/gcc.dg/torture/pr114048.c
new file mode 100644
index 0000000000000000000000000000000000000000..338000b30062ba20e9e197b2dfa999725b6a9808
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/torture/pr114048.c
@@ -0,0 +1,25 @@
+/* { dg-do compile } */
+
+typedef struct {
+  void *child[2];
+  char otherbits;
+} critbit0_node;
+
+int allprefixed_traverse(char *top)
+{
+  if (top)
+    {
+      critbit0_node *q = (void *)top - 1;
+      int direction = 0;
+      for (;; ++direction)
+	switch (allprefixed_traverse(q->child[direction]))
+	  {
+	  case 1:
+	    break;
+	  case 0:
+	    return 0;
+	  default:
+	    return 1;
+	  }
+    }
+}
diff --git a/gcc/tree-ssa-sccvn.cc b/gcc/tree-ssa-sccvn.cc
index 3e93685e80a6a2271cf7166cc610e217a045b77c..2587eb1c505279ef49514ec99ffe030ea32554c8 100644
--- a/gcc/tree-ssa-sccvn.cc
+++ b/gcc/tree-ssa-sccvn.cc
@@ -1185,6 +1185,8 @@ copy_reference_ops_from_ref (tree ref, vec<vn_reference_op_s> *result)
 	      else
 		{
 		  gcc_assert (known_ne (op.off, -1)
+			      /* The constant offset can be -1.  */
+			      || op.opcode == MEM_REF
 			      /* Out-of-bound indices can compute to
 				 a known -1 offset.  */
 			      || ((op.opcode == ARRAY_REF