I found this with the rl78-elf port... can't guarantee it's not the rl78 port itself, but the code does have two loops that fill the array.
* caller-save.c (setup_save_areas): Increase call_saved_regs[] size to avoid writing beyond the end of the array. There are two loops that iterate over hard regs and potentially add to this array, so it must hold a max of 2x the hard regs. Index: gcc/caller-save.c =================================================================== --- gcc/caller-save.c (revision 180758) +++ gcc/caller-save.c (working copy) @@ -494,13 +494,13 @@ setup_save_areas (void) { rtx slot; char *saved_reg_conflicts; int next_k; struct saved_hard_reg *saved_reg2, *saved_reg3; int call_saved_regs_num; - struct saved_hard_reg *call_saved_regs[FIRST_PSEUDO_REGISTER]; + struct saved_hard_reg *call_saved_regs[FIRST_PSEUDO_REGISTER*2]; int best_slot_num; int prev_save_slots_num; rtx prev_save_slots[FIRST_PSEUDO_REGISTER]; /* Find saved hard register conflicts. */ saved_reg_conflicts = (char *) xmalloc (saved_regs_num * saved_regs_num);