https://gcc.gnu.org/bugzilla/show_bug.cgi?id=112709
--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> --- This isn't specific to asan, -fsanitize=undefined ICEs on it the same. In both cases, we want to add instrumentation for the store of the call lhs. So, either we move the instrumentation on the non-abnormal predecessor edge of the calls, but then we actually don't perform the checking when reaching the call through the abnormal edge (i.e. returning for second and following time from the call, in the caller perhaps the pointer might have changed). Or we stop doing such instrumentations on the call lhs and instead do such instrumentation in the callee (on <retval> = whatever; stores).