https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66977
--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> --- This works (can't use unshare_expr here), but I'll try to come up with something nicer... diff --git a/gcc/cp/decl2.c b/gcc/cp/decl2.c index a45755e..f1b6475 100644 --- a/gcc/cp/decl2.c +++ b/gcc/cp/decl2.c @@ -4926,6 +4926,8 @@ build_offset_ref_call_from_tree (tree fn, vec<tree, va_gc> **args, fn = TREE_OPERAND (fn, 1); fn = get_member_function_from_ptrfunc (&object_addr, fn, complain); + if (flag_sanitize & SANITIZE_SHIFT) + walk_tree (&object_addr, copy_tree_r, NULL, NULL); vec_safe_insert (*args, 0, object_addr); }