https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102560
--- Comment #2 from Aldy Hernandez <aldyh at gcc dot gnu.org> --- Going up the backtrace we see: (gdb) #3 0x0000000001b43aff in irange::intersect (this=0x7fffffffc8e0, other=0x3c7aa40 <alloca_call_type(gimple*, bool)::invalid_range>) at /home/aldyh/src/gcc/gcc/value-range.cc:1514 (gdb) #4 0x0000000001b3e1e8 in irange::intersect (this=0x7fffffffc8e0, r=...) at /home/aldyh/src/gcc/gcc/value-range.h:549 (gdb) #5 0x0000000002a78c33 in alloca_call_type (stmt=<gimple_call 0x7fffea151240>, is_vla=false) at /home/aldyh/src/gcc/gcc/gimple-ssa-warn-alloca.c:229 We're intersecting with invalid_range which is a static member: static int_range<2> invalid_range (build_int_cst (size_type_node, 0), build_int_cst (size_type_node, max_size), VR_ANTI_RANGE); It looks like it has members that have been GC freed: (gdb) print invalid_range $9 = {<irange> = {m_num_ranges = 1 '\001', m_max_ranges = 2 '\002', m_kind = VR_RANGE, m_base = 0x3c7aa50 <alloca_call_type(gimple*, bool)::invalid_range+16>}, m_ranges = { <ggc_freed 0x7fffea157b88>, <integer_cst 0x7fffe9fe2620>, <tree 0x0>, <tree 0x0>}} (gdb) The m_ranges bits are trees in int_range<N>, which live in GC, and trees are inherently GC'ish.