https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108147
--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> --- The ICE seems to be during #0 0x0000000010ffc2e8 in m2linemap_WarningAtf (location=456515, message=0x11f57210 "In procedure 'RegisterModule': unused parameter 'name' in procedure 'RegisterModule'") at ../../gcc/m2/gm2-gcc/m2linemap.cc:202 #1 0x000000001111bb08 in M2Emit_EmitError (error=<optimized out>, note=<optimized out>, token=<optimized out>, message=<optimized out>) at m2/gm2-compiler-boot/M2Emit.c:85 #2 0x000000001102fb0c in FlushAll (e=0x11f52ee0, FatalStatus=0) at m2/gm2-compiler-boot/M2Error.c:2418 #3 0x000000001102c2c0 in Compile (s=0x11f06160) at m2/gm2-compiler-boot/M2Comp.c:208 #4 M2Comp_compile (filename=<optimized out>) at m2/gm2-compiler-boot/M2Comp.c:760 #5 0x0000000011007048 in init_PerCompilationInit (filename=0x7ffffffff641 "../../../../libgm2/libm2min/../../gcc/m2/gm2-libs-min/M2RTS.mod") at ../../gcc/m2/gm2-gcc/init.cc:195 #6 0x0000000010fd505c in gm2_parse_input_files (filename_count=1, filenames=0x11ef2fd0) at ../../gcc/m2/gm2-lang.cc:451 #7 gm2_langhook_parse_file () at ../../gcc/m2/gm2-lang.cc:458 #8 0x000000001127f54c in compile_file () at ../../gcc/toplev.cc:447 #9 0x0000000010892d0c in do_compile (no_backend=false) at ../../gcc/toplev.cc:2128 #10 toplev::main (this=<optimized out>, argc=<optimized out>, argv=<optimized out>) at ../../gcc/toplev.cc:2282 #11 0x0000000010895c98 in main (argc=49, argv=0x7fffffffee38) at ../../gcc/main.cc:39 in particular in: #0 vec<unsigned int, va_heap, vl_ptr>::using_auto_storage (this=<optimized out>) at ../../gcc/vec.h:2218 #1 vec<unsigned int, va_heap, vl_ptr>::release (this=0x7fffffffe570) at ../../gcc/vec.h:1909 #2 auto_vec<unsigned int, 8ul>::~auto_vec (this=0x7fffffffe570, __in_chrg=<optimized out>) at ../../gcc/vec.h:1574 #3 diagnostic_info::inlining_info::~inlining_info (this=0x7fffffffe570, __in_chrg=<optimized out>) at ../../gcc/diagnostic.h:137 #4 diagnostic_info::~diagnostic_info (this=0x7fffffffe528, __in_chrg=<optimized out>) at ../../gcc/diagnostic.h:111 #5 m2linemap_WarningAtf (location=<optimized out>, message=0x11f57210 "In procedure 'RegisterModule': unused parameter 'name' in procedure 'RegisterModule'") at ../../gcc/m2/gm2-gcc/m2linemap.cc:211 inside of that. Seems the problem is that the return address is clobbered on the stack. M2Emit_EmitError at the start saves the link register to 16(r1): 0x000000001111bab0 <M2Emit_EmitError(unsigned int, unsigned int, unsigned int, DynamicStrings_String)+0>: lis r2,4563 0x000000001111bab4 <M2Emit_EmitError(unsigned int, unsigned int, unsigned int, DynamicStrings_String)+4>: addi r2,r2,29696 => 0x000000001111bab8 <M2Emit_EmitError(unsigned int, unsigned int, unsigned int, DynamicStrings_String)+8>: mflr r0 0x000000001111babc <M2Emit_EmitError(unsigned int, unsigned int, unsigned int, DynamicStrings_String)+12>: std r31,-8(r1) 0x000000001111bac0 <M2Emit_EmitError(unsigned int, unsigned int, unsigned int, DynamicStrings_String)+16>: std r0,16(r1) (0x000000001102fb0c is stored to 0x7fffffffe610 in my case). But then: Dump of assembler code for function m2linemap_WarningAtf(location_t, char const*, ...): 0x0000000010ffc2e0 <+0>: lis r2,4563 0x0000000010ffc2e4 <+4>: addi r2,r2,29696 0x0000000010ffc2e8 <+8>: mflr r0 0x0000000010ffc2ec <+12>: std r30,-16(r1) 0x0000000010ffc2f0 <+16>: std r31,-8(r1) 0x0000000010ffc2f4 <+20>: std r0,16(r1) 0x0000000010ffc2f8 <+24>: stdu r1,-368(r1) 0x0000000010ffc2fc <+28>: vspltisw v0,0 0x0000000010ffc300 <+32>: lis r11,-32768 0x0000000010ffc304 <+36>: mr r30,r4 0x0000000010ffc308 <+40>: ori r11,r11,8 0x0000000010ffc30c <+44>: std r5,416(r1) 0x0000000010ffc310 <+48>: std r6,424(r1) 0x0000000010ffc314 <+52>: xxswapd vs0,vs32 0x0000000010ffc318 <+56>: li r0,0 0x0000000010ffc31c <+60>: clrldi r11,r11,32 0x0000000010ffc320 <+64>: std r7,432(r1) => 0x0000000010ffc324 <+68>: std r8,440(r1) overwrites it. Now the sizes of the automatic variables in m2linemap_WarningAtf are: (gdb) p sizeof (diagnostic) $42 = 136 (gdb) p sizeof (ap) $43 = 8 (gdb) p sizeof (richloc) $44 = 168 sum 312 bytes, the frame is 368 bytes. But where do those std r{5,6,7,8} stores to 4{16,24,32,40}(r1) come from is something I haven't figured out yet, probably register saves, but why does that overwrite the saved link register?