https://gcc.gnu.org/bugzilla/show_bug.cgi?id=121685
Richard Biener <rguenth at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jwakely at redhat dot com --- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> --- So even though m_mcowner cannot possibly be bound to nullptr it might still bind to a released object? Likewise may it bind to an object of insufficient size? So, consider int *p = new int; int &q = *p; delete p; fun (q, 0); with int fun(int &q, int released) { if (!released) return q; return 0; } or char c; int &q = *(char *)&c; alternatively int *p = (int *)malloc (1); int &q = *p; or char c[1]; int &q = new int (&c);