crtstuff computes __CTOR_END__ - 1, and this ICEd while testing -fcompare-debug. It's normally compiled with -g0, but I introduced -gtoggle for -fcompare-debug, so it ended up compiled for comparison with -g2, and the assignment p = __CTOR_END__ - 1; generated a debug stmt with the expression &__CTOR_END__[-1], which exposed the failure of expand_debug_expr() to handle negative bitpos. Fixed as follows.