https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97609
--- Comment #3 from Aldy Hernandez <aldyh at gcc dot gnu.org> --- And the reason this was working before is two-fold. First, value_of_expr() in legacy evrp won't look at broken gimple, so the request for __keep_12(D) in the following statement actually succeeds: __to_destroy._M_head._M_next = __keep_12(D); Well... returns NULL. Second, after replace_uses_in() succeeds, the gimple folder fixes the crappy IL by transforming: __to_destroy._M_head._M_next = __keep_12(D); into: MEM[(struct _Fwd_list_node_base *)&__to_destroy]._M_next = __keep_12(D); So basically this worked before because even though substitute_and_fold_engine::replace_uses_in() created invalid gimple, it depended on the gimple folder to clean-up the nonsense after the fact. How stupid is that? :)