https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90345
--- Comment #4 from Ivan Sorokin <vanyacpp at gmail dot com> --- Making points-to analysis aware of SESE regions will definitely help here and is a nice thing to have. There is one more option. In my reduced test case the body of 'push_back' is unavailable, but when it is it can be analysed and an attribute can be added that 'push_back' only uses the received reference internally and does not escape it. >From my experiments this is what clang does: even when the body of 'push_back' is not inlined it generates different code for 'operator*=' depending on whether push_back escapes the received reference or not: void push_back(uint32_t const&) __attribute__((noinline)); void big_integer::push_back(uint32_t const& a) { __asm__("" : : : "memory"); //__asm__("" : : "g"(&a) : "memory"); } I guess with LTO enabled this type of analysis is quite powerful, as many 'const&' and 'this' parameters in C++ don't really escape.