diff --git a/cpp/ql/src/experimental/semmle/code/cpp/rangeanalysis/ArrayLengthAnalysis.qll b/cpp/ql/src/experimental/semmle/code/cpp/rangeanalysis/ArrayLengthAnalysis.qll
index d0558259c3e..395890f9f76 100644
--- a/cpp/ql/src/experimental/semmle/code/cpp/rangeanalysis/ArrayLengthAnalysis.qll
+++ b/cpp/ql/src/experimental/semmle/code/cpp/rangeanalysis/ArrayLengthAnalysis.qll
@@ -128,7 +128,7 @@ private int getBaseSizeForPointerType(PointerType type) { result = type.getBaseT
  * steps to `array` that points to `offset + offsetDelta` in one step.
  * This predicate does not contain any recursive steps.
  */
-bindingset[prevOffsetDelta]
+bindingset[prevOffset,prevOffsetDelta]
 predicate simpleArrayLengthStep(
   Instruction array, Offset offset, int offsetDelta, Instruction prev, Offset prevOffset,
   int prevOffsetDelta