As I mention in the PR... What's happening here is that the ipa_polymorphic_call_context constructor is calling walk_ssa_copies on a PHI node that has no arguments. This happens because finalize_jump_threads eventually removes some PHI arguments as it's redirecting some edges, leaving a PHI with no arguments: SR.33_23 = PHI <> This should get cleaned up later, but the IPA polymorphic code gets called during the actual CFG clean-up, and walk_ssa_copies cannot handle an empty PHI. Approved by Honza. Fully tested on x86-64 Linux and verified that the patch fixes the ICE on an x86-64 Linux cross aarch64-linux-gnu cc1plus. Committed to mainline.