https://gcc.gnu.org/bugzilla/show_bug.cgi?id=78867
--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> --- The issue is that at read-in cfun is unexpectedly NULL. We're here: static void input_function (tree fn_decl, struct data_in *data_in, struct lto_input_block *ib, struct lto_input_block *ib_cfg) { ... /* Read the tree of lexical scopes for the function. */ DECL_INITIAL (fn_decl) = stream_read_tree (ib, data_in); unsigned block_leaf_count = streamer_read_uhwi (ib); while (block_leaf_count--) stream_read_tree (ib, data_in); ^^^^ and only later we do: if (!streamer_read_uhwi (ib)) return; push_struct_function (fn_decl); fn = DECL_STRUCT_FUNCTION (fn_decl); init_tree_ssa (fn); this means that the BLOCK tree (and its VAR_DECLs) have references to SSA names. Which I think boils down to another instance of a missing DECL_EXPR and thus not properly gimplified sizes: test () { static void bar (character(kind=1)[1:] &, integer(kind=4), integer(kind=8) & restrict); { static integer(kind=8) C.3454 = 2; integer(kind=8) * D.3455; integer(kind=8) D.3456; character(kind=1)[1:MAX_EXPR <(integer(kind=4)) D.3456, 0>] * pstr.0; ^^^ void * restrict D.3458; integer(kind=4) D.3459; D.3455 = &C.3454; D.3456 = *D.3455; D.3458 = (void * restrict) __builtin_malloc (MAX_EXPR <(unsigned long) MAX_EXPR <(integer(kind=4)) D.3456, 0>, 1>); pstr.0 = (character(kind=1)[1:MAX_EXPR <(integer(kind=4)) D.3456, 0>] *) D.3458; bar (pstr.0, MAX_EXPR <(integer(kind=4)) D.3456, 0>, D.3455); D.3459 = MAX_EXPR <(integer(kind=4)) D.3456, 0>;