https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90501
Richard Biener <rguenth at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |ASSIGNED Last reconfirmed| |2019-05-16 Assignee|unassigned at gcc dot gnu.org |rguenth at gcc dot gnu.org Ever confirmed|0 |1 --- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> --- OK, so the early inliner inlines result = fun (); [return slot optimization] which results in result becoming address-taken after inlining: static tree declare_return_variable (copy_body_data *id, tree return_slot, tree modify_dest, basic_block entry_bb) { ... /* If there was a return slot, then the return value is the dereferenced address of that object. */ if (return_slot) { /* The front end shouldn't have used both return_slot and a modify expression. */ gcc_assert (!modify_dest); if (DECL_BY_REFERENCE (result)) { tree return_slot_addr = build_fold_addr_expr (return_slot); STRIP_USELESS_TYPE_CONVERSION (return_slot_addr); /* We are going to construct *&return_slot and we can't do that for variables believed to be not addressable. FIXME: This check possibly can match, because values returned via return slot optimization are not believed to have address taken by alias analysis. */ gcc_assert (TREE_CODE (return_slot) != SSA_NAME); var = return_slot_addr; note this bug was present before my changes with -fno-early-inlining. Interesting we never hit this for other languages. I guess most of the time the addresses end up in places we do not require TREE_ADDRESSABLE to be set (in dereferences).