I have only reproducer for this on redhat/gcc-4_4-branch, though I believe the problem is just latent on vanilla 4.4 branch and likely on the trunk too, therefore I want to discuss this here.
namespace std { template <class> struct char_traits; } typedef struct { union { char __wchb[4]; }; } mbstate_t; namespace std { template <typename _StateT> struct fpos { long long _M_off; _StateT _M_state; fpos (long long):_M_off (), _M_state () { } _StateT state () { return _M_state; } }; typedef fpos <mbstate_t> streampos; } namespace std { template <> struct char_traits <char> { typedef streampos pos_type; typedef long long off_type; typedef mbstate_t state_type; }; } struct pthread_mutex_t; namespace { enum _Ios_Openmode { _S_in = 3, _S_out }; enum _Ios_Seekdir { _S_beg }; struct ios_base { typedef _Ios_Openmode openmode; static const openmode in = _S_in; static const openmode out = _S_out; typedef _Ios_Seekdir seekdir; static const seekdir beg = _S_beg; }; template < typename _CharT, typename > struct basic_streambuf { typedef _CharT char_type; char_type * _M_in_beg; char_type *eback () { return _M_in_beg; } char_type *gptr () {} }; } namespace std { typedef struct pthread_mutex_t __c_lock; template <typename> class __basic_file; template <> struct __basic_file <char> { __basic_file (__c_lock * = 0); bool is_open (); }; template <typename _CharT, typename _Traits> struct basic_filebuf : public basic_streambuf <_CharT, _Traits> { typedef _CharT char_type; typedef _Traits traits_type; typedef typename traits_type::pos_type pos_type; typedef typename traits_type::off_type off_type; typedef __basic_file < char >__file_type; typedef typename traits_type::state_type __state_type; __file_type _M_file; char_type *_M_pback_cur_save; bool _M_pback_init; void _M_destroy_pback () throw () { _M_pback_cur_save += this->gptr () != this->eback (); _M_pback_init = false; } bool is_open () throw () { return _M_file.is_open (); } pos_type seekpos (pos_type, ios_base::openmode = ios_base::in | ios_base::out); pos_type _M_seek (off_type, ios_base::seekdir, __state_type); }; template <typename _CharT, typename _Traits> typename basic_filebuf <_CharT, _Traits>::pos_type basic_filebuf <_CharT, _Traits>::seekpos (pos_type __pos, ios_base::openmode) { pos_type __ret = (off_type ()); if (this->is_open ()) { _M_destroy_pback (); __ret = _M_seek (off_type (), ios_base::beg, __pos.state ()); } return __ret; } template class basic_filebuf <char, char_traits <char> >; } ICEs on redhat/gcc-4_4-branch when compiled with -O3 -mavx -fPIC -m32 -mtune=core2 with: snb.ii: In member function âtypename std::basic_filebuf<_CharT, _Traits>::pos_type std::basic_filebuf<_CharT, _Traits>::seekpos(typename _Traits::pos_type, <unnamed>::_Ios_Openmode) [with _CharT = char, _Traits = std::char_traits<char>]â: snb.ii:87: internal compiler error: in dwarf2out_frame_debug_expr, at dwarf2out.c:2492 Vanilla 4.4 branch generates very similar rtl, the only change seems to be slightly different sched2 decition. It compiles seekpos into: .cfi_startproc .cfi_personality 0x9b,DW.ref.__gxx_personality_v0 .cfi_lsda 0x1b,.LLSDA9 # basic block 2 leal 4(%esp), %ecx .cfi_def_cfa 1, 0 andl $-32, %esp pushl -4(%ecx) pushl %ebp movl %esp, %ebp .cfi_escape 0x10,0x5,0x1,0x55 subl $120, %esp movl %ebx, 108(%esp) movl %ecx, 104(%esp) .cfi_escape 0xf,0x3,0x75,0x70,0x6 movl %esi, 112(%esp) movl %edi, 116(%esp) call .L17 .L17: popl %ebx addl $_GLOBAL_OFFSET_TABLE_+[.-.L17], %ebx .cfi_escape 0x10,0x7,0x2,0x75,0x7c .cfi_escape 0x10,0x6,0x2,0x75,0x78 .cfi_escape 0x10,0x3,0x2,0x75,0x74 movl (%ecx), %esi movl %ecx, -60(%ebp) but redhat/gcc-4_4-branch reorders the %ecx stores, so after sp = sp - 120 there is: subl $120, %esp movl %ecx, -60(%ebp) movl %ebx, 108(%esp) movl %esi, 112(%esp) movl %ecx, 104(%esp) movl %edi, 116(%esp) ([ebp-60] = ecx got moved earlier, and [sp+108] = ecx got moved later). Given that both of these ecx stores are frame related, I don't see anything wrong on that scheduling decision. But when processing the frame related insns in dwarf2out, after sp = sp - 120 we have: (gdb) p cfa $1 = {offset = 0, base_offset = 0, reg = 2, indirect = 0, in_use = 0} (gdb) p cfa_temp $2 = {offset = 0, base_offset = 0, reg = 2, indirect = 0, in_use = 0} (gdb) p cfa_store $3 = {offset = 120, base_offset = 0, reg = 7, indirect = 0, in_use = 0} and so ICE, because we don't know what offset to use: 2488 if (cfa_store.reg == (unsigned) regno) 2489 offset -= cfa_store.offset; 2490 else 2491 { 2492 gcc_assert (cfa_temp.reg == (unsigned) regno); 2493 offset -= cfa_temp.offset; 2494 } The store using ebp comes from the code before IRA starting with (set (reg:SI 71) (reg:SI %ecx)) and IRA spilling reg:SI 71 to the stack. This insn has been created by ix86_get_drap_rtx (): 8098 drap_vreg = copy_to_reg (arg_ptr); The second store of %ecx comes from prologue expansion. -- Summary: ICE in dwarf2out_frame_debug_expr Product: gcc Version: 4.4.4 Status: UNCONFIRMED Keywords: ice-on-valid-code Severity: normal Priority: P3 Component: debug AssignedTo: unassigned at gcc dot gnu dot org ReportedBy: jakub at gcc dot gnu dot org http://gcc.gnu.org/bugzilla/show_bug.cgi?id=43290