https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118986
--- Comment #9 from Marek Polacek <mpolacek at gcc dot gnu.org> --- In cp_fold_r we have: TARGET_EXPR <D.2701, <<< Unknown tree: expr_stmt D.2701.__p = TARGET_EXPR <D.2684, <<< Unknown tree: aggr_init_expr 3 f1 D.2684 >>>> >>>> so object=D.2701, and init is the expr_stmt. We unwrap the EXPR_STMT/INIT_EXPR/TARGET_EXPR and end up evaluating the f1 call. f1 returns c2; the type of D.2701 is struct ._anon_0. So then we crash in replace_decl on: 2730 gcc_checking_assert (same_type_ignoring_top_level_qualifiers_p 2731 (TREE_TYPE (decl), TREE_TYPE (replacement)));