Reported first here: <http://gcc.gnu.org/ml/gcc/2006-11/msg00572.html>.
Also, see <http://gcc.gnu.org/ml/gcc/2006-11/msg00596.html>.

(gdb) bt
#0  rewrite_use_compare (data=0x7eff0e18, use=0x4007f928, cand=0x4008f450)
    at ../../gcc/gcc/tree-ssa-loop-ivopts.c:5625
#1  0x00320390 in rewrite_uses (data=0x7eff0e18)
    at ../../gcc/gcc/tree-ssa-loop-ivopts.c:5678
#2  0x003246a0 in tree_ssa_iv_optimize_loop (data=0x7eff0e18, loop=0x7eff0ea0)
    at ../../gcc/gcc/tree-ssa-loop-ivopts.c:5868
#3  0x00324c20 in tree_ssa_iv_optimize (loops=0x40076360)
    at ../../gcc/gcc/tree-ssa-loop-ivopts.c:5905
#4  0x0030638c in tree_ssa_loop_ivopts () at ../../gcc/gcc/tree-ssa-loop.c:451
#5  0x00266b44 in execute_one_pass (pass=0x400123a0)
    at ../../gcc/gcc/passes.c:871
#6  0x00266ce4 in execute_pass_list (pass=0x400123a0)
    at ../../gcc/gcc/passes.c:918
#7  0x00266cf8 in execute_pass_list (pass=0x40012130)
    at ../../gcc/gcc/passes.c:919
#8  0x00266cf8 in execute_pass_list (pass=0x40008608)
    at ../../gcc/gcc/passes.c:919
#9  0x000c64a4 in tree_rest_of_compilation (fndecl=0x7acfbf50)
    at ../../gcc/gcc/tree-optimize.c:463
#10 0x00039490 in c_expand_body (fndecl=0x7acfbf50)
    at ../../gcc/gcc/c-decl.c:6847
#11 0x00293814 in cgraph_expand_function (node=0x7ad61c40)
    at ../../gcc/gcc/cgraphunit.c:1241

As noted by Steve, the return value from the call to
get_use_iv_cost is null:

(gdb) disass 0x31fc6c 0x31fc8c
Dump of assembler code from 0x31fc6c to 0x31fc8c:
0x0031fc6c <rewrite_use_compare+68>:    copy r3,r26
0x0031fc70 <rewrite_use_compare+72>:    copy r5,r25
0x0031fc74 <rewrite_use_compare+76>:    b,l 0x315bb0 <get_use_iv_cost>,rp
0x0031fc78 <rewrite_use_compare+80>:    copy r4,r24
0x0031fc7c <rewrite_use_compare+84>:    ldw c(ret0),r6
0x0031fc80 <rewrite_use_compare+88>:    cmpib,= 0,r6,0x31fe9c <rewrite_use_compare+628>
0x0031fc84 <rewrite_use_compare+92>:    copy r4,r25
0x0031fc88 <rewrite_use_compare+96>:    ldw 0(r3),r26
End of assembler dump.
(gdb) p/x $ret0
$2 = 0x0

(gdb) p *data
$10 = {current_loop = 0x4007f1c0, regs_used = 0, niters = 0x4007f430,
  version_info_size = 70, version_info = 0x400901b8, relevant = 0x400747dc,
  max_inv_id = 3, iv_uses = 0x4007f558, iv_candidates = 0x4008f540,
  important_candidates = 0x40074560, consider_all_candidates = 1 '\001'}
(gdb) p *use
$11 = {id = 0, type = USE_COMPARE, iv = 0x4007f828, stmt = 0x7aded208,
  op_p = 0x7aded224, related_cands = 0x0, n_map_members = 23,
  cost_map = 0x4008f618, selected = 0x4008f450}
(gdb) p *cand
$14 = {id = 19, important = 0 '\0', pos = IP_NORMAL, incremented_at = 0x0,
  var_before = 0x7ad712d0, var_after = 0x7ad719f0, iv = 0x4008f480, cost = 8,
  depends_on = 0x0}

(gdb) step
get_use_iv_cost (data=0x7eff0e18, use=0x4007f928, cand=0x4008f450)
    at ../../gcc/gcc/tree-ssa-loop-ivopts.c:2397
2397      s = cand->id & (use->n_map_members - 1);
(gdb)
2389          ret = use->cost_map + cand->id;
(gdb)
2390          if (!ret->cand)
(gdb)
2407    }
(gdb)
rewrite_use_compare (data=0x7eff0e18, use=0x4007f928, cand=0x4008f450)
    at ../../gcc/gcc/tree-ssa-loop-ivopts.c:5625
5625      bound = cp->value;