https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107769
--- Comment #6 from Martin Jambor <jamborm at gcc dot gnu.org> --- Yes, you identified the correct commit. The same jump function is double counted (once during iPA-CP and then again during inlining) when we drop references and so an address reference is replaced with a read one. I will make this bug a priority next week.