https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111274
--- Comment #9 from sandra at gcc dot gnu.org --- The problem is that it's tripping over a BIND_EXPR with a null BIND_EXPR_BLOCK. The attached patch stops the testcase from ICE'ing but hasn't been otherwise tested yet. I'm not sure what a null BIND_EXPR_BLOCK actually means, or if it might be a bug elsewhere that such a thing is being created? The comments on BIND_EXPR in tree.def seem to imply that there is always an associated block. If it's permissible, maybe the fix ought to pass through the superblock pointer in the recursive call instead of the null block pointer.