https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88308
--- Comment #5 from acsawdey at gcc dot gnu.org --- After some more digging, it appears that the problem is move_insn_for_shrink_wrap() is deleting and re-creating insns to move them from one BB to another. The label reference count gets decremented in delete_insn() but does not get re-incremented when the new insn is created in a different BB. If you add -fno-shrink-wrap, the ICE does not occur.
