https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100111
--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> --- The ICE is during ((struct j *) this)->e = 0 evaluation and the problem seems to be that *valp, which is CONSTRUCTOR for the a variable initializer, is {.h={}} where the type of the inner {} is b rather than j. That invalid CONSTRUCTOR elt seems to have been inserted when cxx_eval_store_expression *(struct b *) this = *(const struct b &) (const struct b *) &k; I wonder if the bug isn't in: /* Don't share a CONSTRUCTOR that might be changed later. */ init = unshare_constructor (init); if (*valp && TREE_CODE (*valp) == CONSTRUCTOR && TREE_CODE (init) == CONSTRUCTOR) { /* An outer ctx->ctor might be pointing to *valp, so replace its contents. */ if (!same_type_ignoring_top_level_qualifiers_p (TREE_TYPE (init), TREE_TYPE (*valp))) { /* For initialization of an empty base, the original target will be *(base*)this, evaluation of which resolves to the object argument, which has the derived type rather than the base type. In this situation, just evaluate the initializer and return, since there's no actual data to store. */ gcc_assert (is_empty_class (TREE_TYPE (init)) && !lval); return init; } CONSTRUCTOR_ELTS (*valp) = CONSTRUCTOR_ELTS (init); TREE_CONSTANT (*valp) = TREE_CONSTANT (init); TREE_SIDE_EFFECTS (*valp) = TREE_SIDE_EFFECTS (init); CONSTRUCTOR_NO_CLEARING (*valp) = CONSTRUCTOR_NO_CLEARING (init); } else *valp = init; where we do that if (!same_type_ignoring... check and early out only if *valp, but in this case *valp is NULL and so we do the *valp = init; , except that it is still empty class store with !lval. While TREE_TYPE (*valp) can't be checked obviously, type can.