I don't follow here either. purge_addressof is called via toplev.c exactly once per function and it does exactly one scan of insns. Sorry, you are correct: I was thinking of flush_addressof.