This happens in the test-gen-support branch when trying to simplify an index-expression with a pointer-offset expression in the index operand. The cause is a misunderstanding of pointer_offset_exprt here (https://github.com/diffblue/cbmc/blob/test-gen-support/src/goto-programs/json_goto_trace.cpp#L26)-- the transformation simply discarding pointer_offset_exprt(constant) is not correct. Fix coming up.