https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103404
--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> --- Program received signal SIGSEGV, Segmentation fault. 0x00000000028071dc in insert_with_costs (x=0x7ffff6739090, classp=0x0, hash=13, mode=E_SImode, cost=0, reg_cost=1) at /home/rguenther/src/gcc3/gcc/cse.c:1569 1569 if (CHEAPER (elt, classp)) where classp is NULL. The passed in class is #2 0x00000000028079e7 in merge_equiv_classes (class1=0x40b8700, class2=0x3f0a950) at /home/rguenther/src/gcc3/gcc/cse.c:1756 1756 new_elt = insert (exp, class1, hash, mode); (gdb) p *class1 $4 = {exp = 0x7ffff6739090, canon_exp = 0x0, next_same_hash = 0x40b85e0, prev_same_hash = 0x0, next_same_value = 0x0, prev_same_value = 0x0, first_same_value = 0x0, related_value = 0x0, cost = 0, regcost = 1, mode = E_SImode, in_memory = 0 '\000', is_const = 0 '\000', flag = 0 '\000'} It seems we remove class1 from the table while processing the merge: #0 remove_from_table (elt=0x40b8700, hash=11) at /home/rguenther/src/gcc3/gcc/cse.c:1354 #1 0x0000000002806cc5 in remove_pseudo_from_table (x=0x7ffff6739090, hash=11) at /home/rguenther/src/gcc3/gcc/cse.c:1426 #2 0x000000000280792d in merge_equiv_classes (class1=0x40b8700, class2=0x3f0a950) at /home/rguenther/src/gcc3/gcc/cse.c:1747 and note it may even get re-used via the free_element_chain so it might stay in the table but have a different purpose. Somebody more familiar with the equivalence code needs to look at this. I'd try postponing remove_pseudo_from_table until after the merge for example.