diff --git a/0390-struct-reorg-Check-ADDR_EXPR-in-pointer-plus-assign.patch b/0390-struct-reorg-Check-ADDR_EXPR-in-pointer-plus-assign.patch
new file mode 100644
index 0000000000000000000000000000000000000000..7adca8fbf99b9b2220ddc817be8668808d0a069c
--- /dev/null
+++ b/0390-struct-reorg-Check-ADDR_EXPR-in-pointer-plus-assign.patch
@@ -0,0 +1,60 @@
+From d8fe597607a6df62180d95d27105de746bf27842 Mon Sep 17 00:00:00 2001
+From: huzife <634763349@qq.com>
+Date: Tue, 3 Jun 2025 12:31:07 +0800
+Subject: [PATCH] [struct-reorg] Check ADDR_EXPR in pointer plus assign
+
+---
+ gcc/ipa-struct-reorg/ipa-struct-reorg.cc         |  2 +-
+ .../gcc.dg/struct/rf_defined_by_addr_expr.c      | 16 ++++++++++++++++
+ gcc/testsuite/gcc.dg/struct/sr_early_void_ptr.c  |  2 +-
+ 3 files changed, 18 insertions(+), 2 deletions(-)
+ create mode 100644 gcc/testsuite/gcc.dg/struct/rf_defined_by_addr_expr.c
+
+diff --git a/gcc/ipa-struct-reorg/ipa-struct-reorg.cc b/gcc/ipa-struct-reorg/ipa-struct-reorg.cc
+index 1140edd1d..f5be8de76 100644
+--- a/gcc/ipa-struct-reorg/ipa-struct-reorg.cc
++++ b/gcc/ipa-struct-reorg/ipa-struct-reorg.cc
+@@ -5566,7 +5566,7 @@ ipa_struct_reorg::check_definition_assign (srdecl *decl,
+ 					  : TYPE_SIZE_UNIT (type->type)))
+ 	type->mark_escape (escape_non_multiply_size, stmt);
+ 
+-      if (TREE_CODE (rhs) == SSA_NAME)
++      if (TREE_CODE (rhs) == SSA_NAME || TREE_CODE (rhs) == ADDR_EXPR)
+ 	check_type_and_push (rhs, decl, worklist, stmt);
+       return;
+     }
+diff --git a/gcc/testsuite/gcc.dg/struct/rf_defined_by_addr_expr.c b/gcc/testsuite/gcc.dg/struct/rf_defined_by_addr_expr.c
+new file mode 100644
+index 000000000..65922be8e
+--- /dev/null
++++ b/gcc/testsuite/gcc.dg/struct/rf_defined_by_addr_expr.c
+@@ -0,0 +1,16 @@
++/* { dg-do compile } */
++
++struct A {
++    int a;
++};
++
++extern unsigned long long offset();
++
++int main() {
++    unsigned char num[16];
++    ((struct A*)(num + offset() * 4))->a = 10;
++
++    return num[0];
++}
++
++/* { dg-final { scan-ipa-dump "struct A(\\\(\[0-9\]*\\\))? has escaped: \"Type escapes a cast to a different pointer\"" "struct_reorg" } } */
+diff --git a/gcc/testsuite/gcc.dg/struct/sr_early_void_ptr.c b/gcc/testsuite/gcc.dg/struct/sr_early_void_ptr.c
+index 5ff166f08..c52636925 100644
+--- a/gcc/testsuite/gcc.dg/struct/sr_early_void_ptr.c
++++ b/gcc/testsuite/gcc.dg/struct/sr_early_void_ptr.c
+@@ -25,4 +25,4 @@ int main() {
+     return 0;
+ }
+ 
+-/* { dg-final { scan-ipa-dump "struct S(\[0-9\]*) has escaped" "struct_reorg" } } */
++/* { dg-final { scan-ipa-dump "struct S(\\\(\[0-9\]*\\\))? has escaped" "struct_reorg" } } */
+-- 
+2.33.0
+
diff --git a/gcc.spec b/gcc.spec
index 72a5d5426bb9ab79ad696cd2f06b7c852e1f141b..9f1fe44bc6b57cb404f08d27887e26ceca2c4bc3 100644
--- a/gcc.spec
+++ b/gcc.spec
@@ -2,7 +2,7 @@
 %global gcc_major 12
 # Note, gcc_release must be integer, if you want to add suffixes to
 # %%{release}, append them after %%{gcc_release} on Release: line.
-%global gcc_release 90
+%global gcc_release 91
 
 %global _unpackaged_files_terminate_build 0
 %global _performance_build 1
@@ -499,6 +499,7 @@ Patch386: 0386-x86-Disable-stack-protector-for-naked-functions.patch
 Patch387: 0387-x86-Correct-ASM_OUTPUT_SYMBOL_REF.patch
 Patch388: 0388-struct-reorg-Escapes-some-void-pointers.patch
 Patch389: 0389-deja-Correct-pass-number-in-options.patch
+Patch390: 0390-struct-reorg-Check-ADDR_EXPR-in-pointer-plus-assign.patch
 
 # Part 1001-1999
 %ifarch sw_64
@@ -1674,6 +1675,7 @@ not stable, so plugins must be rebuilt any time GCC is updated.
 %patch -P387 -p1
 %patch -P388 -p1
 %patch -P389 -p1
+%patch -P390 -p1
 
 %ifarch sw_64
 %patch -P1001 -p1
@@ -4301,6 +4303,10 @@ end
 %doc rpm.doc/changelogs/libcc1/ChangeLog*
 
 %changelog
+* Tue Jun 3 2025 huzife <634763349@qq.com> - 12.3.1-91
+- Type: Sync
+- DESC: Sync patches from openeuler/gcc.
+
 * Fri May 30 2025 huzife <634763349@qq.com> - 12.3.1-90
 - Type: Sync
 - DESC: Sync patches from openeuler/gcc.