https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70526
--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> --- Looks like a SRA bug to me replacing D.2447 = MEM[(const struct Register &)&D.2394]; D.2404 = D.2447; _5 = D.2404.reg_; with SR.8_3 = MEM[(struct TypedOrValueRegister *)&D.2394]; SR.7_4 = SR.8_3; _5 = SR.7_4; notice how it changes the alias type of the access of D.2394. Will attempt to totally scalarize D.2447 (UID: 2447): ... Created a replacement for D.2447 offset: 0, size: 32: SR.8 Access trees for D.2447 (UID: 2447): access { base = (2447)'D.2447', offset = 0, size = 32, expr = D.2447.reg_, type = uint32_t, non_addressable = 0, reverse = 0, grp_read = 1, grp_write = 1, grp_assignment_read = 1, grp_assignment_write = 1, grp_scalar_read = 1, grp_scalar_write = 0, grp_total_scalarization = 1, grp_hint = 1, grp_covered = 1, grp_unscalarizable_region = 0, grp_unscalarized_data = 0, grp_partial_lhs = 0, grp_to_be_replaced = 1, grp_to_be_debug_replaced = 0, grp_maybe_modified = 0, grp_not_necessarilly_dereferenced = 0 notice the bogus ->expr, possibly created from the D.2404 accesses. Created a replacement for D.2404 offset: 0, size: 32: SR.7 Access trees for D.2404 (UID: 2404): access { base = (2404)'D.2404', offset = 0, size = 32, expr = D.2404.reg_, type = uint32_t, non_addressable = 0, reverse = 0, grp_read = 1, grp_write = 1, grp_assignment_read = 1, grp_assignment_write = 1, grp_scalar_read = 1, grp_scalar_write = 0, grp_total_scalarization = 0, grp_hint = 0, grp_covered = 1, grp_unscalarizable_region = 0, grp_unscalarized_data = 0, grp_partial_lhs = 0, grp_to_be_replaced = 1, grp_to_be_debug_replaced = 0, grp_maybe_modified = 0, grp_not_necessarilly_dereferenced = 0 Indeed the issue seems to be a simple typo and the following fixes it: Index: gcc/tree-sra.c =================================================================== --- gcc/tree-sra.c (revision 234736) +++ gcc/tree-sra.c (working copy) @@ -1673,7 +1673,7 @@ build_ref_for_offset (location_t loc, tr } else { - off = build_int_cst (reference_alias_ptr_type (base), + off = build_int_cst (reference_alias_ptr_type (prev_base), base_offset + offset / BITS_PER_UNIT); base = build_fold_addr_expr (unshare_expr (base)); }