https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115033
--- Comment #18 from Jan Hubicka <hubicka at gcc dot gnu.org> --- modref_eaf_analysis::analyze_ssa_name misinterprets EAF flags. If dereferenced parameter is passed (to map_iterator in the testcase) it can be returned indirectly which in turn makes it to escape into the next function call. I am testing: diff --git a/gcc/ipa-modref.cc b/gcc/ipa-modref.cc index a5adce8ea39..a4e3cc34b4d 100644 --- a/gcc/ipa-modref.cc +++ b/gcc/ipa-modref.cc @@ -2571,8 +2571,7 @@ modref_eaf_analysis::analyze_ssa_name (tree name, bool deferred) int call_flags = deref_flags (gimple_call_arg_flags (call, i), ignore_stores); if (!ignore_retval && !(call_flags & EAF_UNUSED) - && !(call_flags & EAF_NOT_RETURNED_DIRECTLY) - && !(call_flags & EAF_NOT_RETURNED_INDIRECTLY)) + && !(call_flags & (EAF_NOT_RETURNED_DIRECTLY || EAF_NOT_RETURNED_INDIRECTLY))) merge_call_lhs_flags (call, i, name, false, true); if (ecf_flags & (ECF_CONST | ECF_NOVOPS)) m_lattice[index].merge_direct_load ();