https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63476
--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> --- Ah, #5 0x0000000000c263c2 in ipa_polymorphic_call_context::get_dynamic_type ( this=0x7fffffffd790, instance=<ssa_name 0x7ffff687b678>, otr_object=<ssa_name 0x7ffff687b678>, otr_type=<record_type 0x7ffff6867b28 D>, call=<gimple_call 0x7ffff6895498>) at /space/rguenther/src/svn/trunk/gcc/ipa-polymorphic-call.c:1606 (gdb) l 1601 tci.multiple_types_encountered = false; 1602 tci.speculative = false; 1603 tci.seen_unanalyzed_store = false; 1604 1605 walk_aliased_vdefs (&ao, gimple_vuse (stmt), check_stmt_for_type_change, 1606 &tci, NULL, &function_entry_reached); this walks on gimple_vuse! (gdb) p debug_gimple_stmt (stmt) # VUSE <.MEM> pretmp_5 = this_10(D)->D.2797._vptr.A; VUSEs are not kept renamed by load PRE insertion phase so this will not work. The function is called on the call # .MEM_45 = VDEF <.MEM_6(D)> OBJ_TYPE_REF(pretmp_1;(struct D)this_10(D)->0) (this_10(D), p1_11(D), p2_14(D), 0); Of course it would be nice to keep virtual SSA form up-to-date during PRE insertion, but as of now that was not necessary (and we can't simply rename VOPs as that will break the SSA value-numbering lattice which includes virtuals). Keeping virtual SSA form up-to-date requires computing the life virtual operand on edges (which means BB exit). I'm going to try that.