https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68220
--- Comment #4 from Jan Hubicka <hubicka at gcc dot gnu.org> --- OK, we have: (gdb) p context $4 = {offset = 0, speculative_offset = 96, outer_type = 0x7ffff6c77c78, speculative_outer_type = 0x7ffff6cd5348, maybe_in_construction = 1, maybe_derived_type = 1, speculative_maybe_derived_type = 1, invalid = 0, dynamic = 1} and the code gets lost in analyzing speculative_outer_type, because there is simply no binfo on the address: <record_type 0x7ffff6cd5348 Fragment addressable tree_2 needs-constructing type_4 type_5 type_6 BLK size <integer_cst 0x7ffff6ad7e58 type <integer_type 0x7ffff6adb2a0 bitsizetype> constant 64> unit size <integer_cst 0x7ffff6ad7e70 type <integer_type 0x7ffff6adb1f8 sizetype> constant 8> align 64 symtab 0 alias set 3 canonical type 0x7ffff6cd5348 fields <field_decl 0x7ffff6ccbed8 _vptr.Fragment type <pointer_type 0x7ffff6c34540 type <pointer_type 0x7ffff6c343f0 __vtbl_ptr_type> public unsigned DI size <integer_cst 0x7ffff6ad7e58 64> unit size <integer_cst 0x7ffff6ad7e70 8> align 64 symtab 0 alias set 4 canonical type 0x7ffff6c34540> unsigned virtual DI file /aux/hubicka/t.C line 225 col 8 size <integer_cst 0x7ffff6ad7e58 64> unit size <integer_cst 0x7ffff6ad7e70 8> align 64 offset_align 128 offset <integer_cst 0x7ffff6ad7e88 constant 0> bit offset <integer_cst 0x7ffff6ad7ed0 constant 0> context <record_type 0x7ffff6cd5348 Fragment> chain <type_decl 0x7ffff6ccbe40 Fragment type <record_type 0x7ffff6cd53f0 Fragment> used nonlocal decl_4 VOID file /aux/hubicka/t.C line 225 col 17 align 1 context <record_type 0x7ffff6cd5348 Fragment> result <record_type 0x7ffff6cd5348 Fragment> >> context <translation_unit_decl 0x7ffff7ff81e0 D.1> full-name "struct Fragment" needs-constructor needs-destructor X() X(constX&) this=(X&) n_parents=0 use_template=0 interface-only pointer_to_this <pointer_type 0x7ffff6cd5930> reference_to_this <reference_type 0x7ffff6cd5d20> chain <type_decl 0x7ffff6ccbda8 Fragment>> Well, the type is simply too small. The assert is simply too overactive, but restrict_to_inner_type could probably drop the info when it knows the offset is off the range.