https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560
--- Comment #2 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Going up the backtrace we see:
(gdb)
#3 0x0000000001b43aff in irange::intersect (this=0x7fffffffc8e0,
other=0x3c7aa40 <alloca_call_type(gimple*, bool)::invalid_range>)
at /home/aldyh/src/gcc/gcc/value-range.cc:1514
(gdb)
#4 0x0000000001b3e1e8 in irange::intersect (this=0x7fffffffc8e0, r=...)
at /home/aldyh/src/gcc/gcc/value-range.h:549
(gdb)
#5 0x0000000002a78c33 in alloca_call_type (stmt=<gimple_call 0x7fffea151240>,
is_vla=false)
at /home/aldyh/src/gcc/gcc/gimple-ssa-warn-alloca.c:229
We're intersecting with invalid_range which is a static member:
static int_range<2> invalid_range (build_int_cst (size_type_node, 0),
build_int_cst (size_type_node,
max_size),
VR_ANTI_RANGE);
It looks like it has members that have been GC freed:
(gdb) print invalid_range
$9 = {<irange> = {m_num_ranges = 1 '\001', m_max_ranges = 2 '\002', m_kind =
VR_RANGE,
m_base = 0x3c7aa50 <alloca_call_type(gimple*, bool)::invalid_range+16>},
m_ranges = {
<ggc_freed 0x7fffea157b88>, <integer_cst 0x7fffe9fe2620>, <tree 0x0>, <tree
0x0>}}
(gdb)
The m_ranges bits are trees in int_range<N>, which live in GC, and trees are
inherently GC'ish.
