https://gcc.gnu.org/bugzilla/show_bug.cgi?id=78324
--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> --- Root cause is that the substring loc code isn't set up to cope with -ftrack-macro-expansion=0, and attempts to handle this location: ../../src/gcc/testsuite/gcc.dg/tree-ssa/builtin-sprintf-2.c:95:1: note: RNG (0, 0, 0, "%hhi", i) ^~~ as the location of the literal, rather than: RNG (0, 0, 0, "%hhi", i) ^~~~ On re-parsing to locate substring locations, it attempts to parse the 'R' as a raw string, and so this code within cpp_interpret_string_1 fires: if (*p == 'R') { const uchar *prefix; /* Skip over 'R"'. */ p += 2; prefix = p; while (*p != '(') p++; and the issue happens in the "while" loop, as it erroneously walks through this memory: (gdb) p strs.m_vec.m_vecdata[0] $20 = {len = 3, text = 0xc9bcca0 "RNG"} trying to find the open parenthesis. It looks like the substring_loc code needs to handle non-default values of -ftrack-macro-expansion; am continuing to investigate.