https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111444
--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> --- (In reply to Richard Biener from comment #2) > Hmm, so we look for a *(int **) here, reach the toplevel vop, skipping *j = > &e? > That should have conflicted. Seems we actually saw that. walk_non_aliased_vuses calls walker (vn_reference_lookup_2) on .MEM_8 vuse, that still returns NULL, then 3909 if (stmt_may_clobber_ref_p_1 (def_stmt, ref, tbaa_p)) 3910 { 3911 if (!translate) 3912 break; 3913 translate_flags disambiguate_only = TR_TRANSLATE; 3914 res = (*translate) (ref, vuse, data, &disambiguate_only); on the def_stmt: # .MEM_8 = VDEF <.MEM_7(D)> *j_1(D) = &e; returns true from stmt_may_clobber_ref_p_1, correctly saying that *j_1(D) store can clobber *i_1(D). But then walk_non_aliased_vuses calls 3914 res = (*translate) (ref, vuse, data, &disambiguate_only); a few lines later, translate is vn_reference_lookup_3. And vn_reference_lookup_3 calls vn_reference_lookup_2 here in: tree *saved_last_vuse_ptr = data->last_vuse_ptr; /* Do not update last_vuse_ptr in vn_reference_lookup_2. */ data->last_vuse_ptr = NULL; tree saved_vuse = vr->vuse; hashval_t saved_hashcode = vr->hashcode; void *res = vn_reference_lookup_2 (ref, gimple_vuse (def_stmt), data); /* Need to restore vr->vuse and vr->hashcode. */ vr->vuse = saved_vuse; vr->hashcode = saved_hashcode; data->last_vuse_ptr = saved_last_vuse_ptr; and def_stmt here is still the *j_1(D) = &e; statement, the problem is that gimple_vuse (def_stmt) in that case is .MEM_7(D), so it triggers the r14-3226 if (SSA_NAME_IS_DEFAULT_DEF (vuse)) stuff at that point. So, do we need to somehow arrange for the if (SSA_NAME_IS_DEFAULT_DEF (vuse)) code to be done solely when vn_reference_lookup_2 is called directly from walk_non_aliased_vuses and not when called from vn_reference_lookup_3?