Sigh, I cleaned out my local patches and now I'm tripping over this again:
if ((code == MINUS_EXPR || code == PLUS_EXPR || code == MULT_EXPR) && arg0 && arg1 && tt && POINTER_TYPE_P (tt)) gcc_assert (TREE_CODE (arg0) == INTEGER_CST && TREE_CODE (arg1) == INTEGER_CST); I had locally made that assert use || instead of && as in one case it's passed a pointer type and an integer type for PLUS_EXPR. Also, convert_to_integer already knows to expand pointers to the maybe-next-size-bigger integer before converting them.[ gdb ] up [ gdb ] call debug_tree(arg0) <indirect_ref 0xb710a440 type <pointer_type 0xb7f23708 type <pointer_type 0xb7f23640 __vtbl_ptr_type type <function_type 0xb7f235dc> unsigned PSI size <integer_cst 0xb7e97498 constant invariant 32> unit size <integer_cst 0xb7e97214 constant invariant 4> align 8 symtab 0 alias set 32 canonical type 0xb7f23640 pointer_to_this <pointer_type 0xb7f23708>> public unsigned PSI size <integer_cst 0xb7e97498 32> unit size <integer_cst 0xb7e97214 4> align 8 symtab 0 alias set 4 canonical type 0xb7f23708 pointer_to_this <pointer_type 0xb79208fc>> arg 0 <nop_expr 0xb710a420 type <pointer_type 0xb79208fc type <pointer_type 0xb7f23708> unsigned PSI size <integer_cst 0xb7e97498 32> unit size <integer_cst 0xb7e97214 4> align 8 symtab 0 alias set -1 canonical type 0xb79208fc> readonly arg 0 <non_lvalue_expr 0xb710a400 type <pointer_type 0xb7cf10c8> readonly arg 0 <parm_decl 0xb71b1b40 this>>>> [ gdb ] call debug_tree(arg1) <integer_cst 0xb7917f34 type <integer_type 0xb7e9f898> constant invariant -12> [ gdb ] where #0 fancy_abort (file=0x896d90c "../../gcc/gcc/tree.c", line=3107, function=0x896e57f "build2_stat") at ../../gcc/gcc/diagnostic.c:654 #1 0x087204f7 in build2_stat (code=PLUS_EXPR, tt=0xb7f23708, arg0=0xb710a440, arg1=0xb7917f34) at ../../gcc/gcc/tree.c:3107 #2 0x08173836 in thunk_adjust (ptr=0xb710a400, this_adjusting=1 '\001', fixed_offset=0, virtual_offset=0xb7917f34) at ../../gcc/gcc/cp/method.c:241 #3 0x08175894 in use_thunk (thunk_fndecl=0xb7438a10, emit_p=1 '\001') at ../../gcc/gcc/cp/method.c:473 #4 0x0818636d in emit_associated_thunks (fn=0xb7438850) at ../../gcc/gcc/cp/semantics.c:3157 #5 0x08781830 in cgraph_expand_function (node=0xb744cc80) at ../../gcc/gcc/cgraphunit.c:1156 #6 0x087845a7 in cgraph_optimize () at ../../gcc/gcc/cgraphunit.c:1220 #7 0x0810a85d in cp_write_global_declarations () at ../../gcc/gcc/cp/decl2.c:3471 #8 0x0853fc3b in toplev_main (argc=23, argv=0xbf8ecf54) at ../../gcc/gcc/toplev.c:971 #9 0x08228ce2 in main (argc=Cannot access memory at address 0x2d ) at ../../gcc/gcc/main.c:35