https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70245
--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> --- Created attachment 37988 --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=37988&action=edit gcc6-pr70245.patch So, I think the options we have are: 1) the attached patch, use simplify_replace_rtx which uses rtx_equal_p and should most of the time DTRT, though theoretically it is possible it might try to simplify a valid memory address into invalid one (which is why I've added there the conditional FAIL just in case) 2) use the rtl-iter.h iterators and do something like: subrtx_ptr_iterator::array_type array; operands[4] = operands[2]; FOR_EACH_SUBRTX_PTR (iter, array, loc, NONCONST) { rtx *loc = *iter; rtx x = *loc; if (rtx_equal_p (x, operands[0])) *loc = operands[1]; } manually, the problem is that the insn-*.c generated files don't include the rtl-iter.h header, so this would need to be outlined into some helper function in i386.c 3) change replace_rtx, so that it doesn't check for pointer equality, but does rtx_equal_p. I find the 3) change just too risky, at least at this point, as it is unclear if the current other callers of replace_rtx aren't relying on it replacing just exactly what they asked it to.