http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59185
--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> --- Reduced testcase: #include <stdarg.h> void zlog (const char *format, ...) { va_list args[5]; int index; for (index = 0; index < 5; index++) va_start(args[index], format); for (index = 0; index < 5; index++) va_end(args[index]); } fails with -O1 #0 internal_error (gmsgid=0x1674417 "in %s, at %s:%d") at /space/rguenther/src/svn/gcc-4_7-branch/gcc/diagnostic.c:843 #1 0x000000000132f27e in fancy_abort ( file=0x146a590 "/space/rguenther/src/svn/gcc-4_7-branch/gcc/tree.c", line=3963, function=0x146e570 <__FUNCTION__.48689> "build_simple_mem_ref_loc") at /space/rguenther/src/svn/gcc-4_7-branch/gcc/diagnostic.c:899 #2 0x0000000000e0bac5 in build_simple_mem_ref_loc (loc=0, ptr=0x0) at /space/rguenther/src/svn/gcc-4_7-branch/gcc/tree.c:3963 #3 0x0000000000e8f87f in ix86_va_start (valist=0x7ffff5be1668, nextarg=0x7ffff5be2c80) at /space/rguenther/src/svn/gcc-4_7-branch/gcc/config/i386/i386.c:7798 #4 0x000000000060033e in expand_builtin_va_start (exp=0x7ffff5c03240) at /space/rguenther/src/svn/gcc-4_7-branch/gcc/builtins.c:4254 #5 0x000000000060c449 in expand_builtin (exp=0x7ffff5c03240, target=0x7ffff5ac8470, subtarget=0x0, mode=VOIDmode, ignore=1) at /space/rguenther/src/svn/gcc-4_7-branch/gcc/builtins.c:6355 #3 0x0000000000e8f87f in ix86_va_start (valist=0x7ffff5be1668, nextarg=0x7ffff5be2c80) at /space/rguenther/src/svn/gcc-4_7-branch/gcc/config/i386/i386.c:7798 7798 valist = build_simple_mem_ref (valist); (gdb) call debug_generic_expr (valist) &args[index_22] It's TER and the way it works in 4.7, -fno-tree-ter fixes it.