http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59779
--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> --- The following fixes this for me: --- gcc/tree-dfa.c.jj 2014-01-03 11:40:57.000000000 +0100 +++ gcc/tree-dfa.c 2014-03-13 11:22:20.727848114 +0100 @@ -615,6 +615,15 @@ get_ref_base_and_extent (tree exp, HOST_ maxsize = -1; done: + if (bitsize < 0) + { + *poffset = 0; + *psize = -1; + *pmax_size = -1; + + return exp; + } + if (!bit_offset.fits_shwi ()) { *poffset = 0; @@ -645,6 +654,9 @@ get_ref_base_and_extent (tree exp, HOST_ maxsize = tree_to_uhwi (TYPE_SIZE (TREE_TYPE (exp))) - hbit_offset; } + if (maxsize < 0) + maxsize = -1; + /* ??? Due to negative offsets in ARRAY_REF we can end up with negative bit_offset here. We might want to store a zero offset in this case. */ The problem is that the array is 0xbebc2000 bits long, and most of the places in get_ref_base_and_extent work with maxsize (and bitsize) as uhwi, so we can easily end up with negative, but not -1, maxsize (or bitsize), but callers obviously expect sizes to be positive or -1 (special magic value for unknown).