Bug 16707

Confirmed.
: Search converges between 2004-01-01-trunk (#437) and 2004-01-17-trunk (#438).

I almost think it is this patch:
2004-01-15  Alexandre Oliva  <aoliva@redhat.com>

        PR c++/13659
        * name-lookup.c (validate_nonmember_using_decl): Take scope and
        name by value, instead of computing them.
        (do_local_using_decl, do_toplevel_using_decl): Add scope and name
        arguments.  Pass them to validate_nonmember_using_decl.
        * name-lookup.h (do_local_using_decl): Adjust.
        (do_toplevel_using_decl): Likewise.
        * parser.c (cp_parser_using_declaration): Likewise.
        * pt.c (tsubst_expr): Likewise.

as the backtrace looks like this:
#0  0x4202bb8a in exit () from /lib/i686/libc.so.6
#1  0x0825b843 in diagnostic_report_diagnostic (context=0x85d9a80, diagnostic=0xbffebfd0)
    at /home/gates/pinskia/src/gnu/gcc/src/gcc/diagnostic.c:288
#2  0x0825ba13 in internal_error (msgid=0x83 <Address 0x83 out of bounds>) at /home/gates/
pinskia/src/gnu/gcc/src/gcc/diagnostic.c:548
#3  0x0825ba4f in fancy_abort (file=0x83 <Address 0x83 out of bounds>, line=1108532352, 
function=0x83 <Address 0x83 out of bounds>)
    at /home/gates/pinskia/src/gnu/gcc/src/gcc/diagnostic.c:594
#4  0x0813fbc2 in push_using_decl (scope=0x78d, name=0x855931b) at /home/gates/pinskia/src/
gnu/gcc/src/gcc/cp/name-lookup.c:1934
#5  0x0813fea9 in validate_nonmember_using_decl (decl=0x40104910, scope=0x4004b4a0, 
name=0x40105fc0)
    at /home/gates/pinskia/src/gnu/gcc/src/gcc/cp/name-lookup.c:2156
#6  0x08149c45 in do_toplevel_using_decl (decl=0x40104910, scope=0x4004b4a0, 
name=0x40105fc0)
    at /home/gates/pinskia/src/gnu/gcc/src/gcc/cp/name-lookup.c:3368
#7  0x080ec126 in cp_parser_using_declaration (parser=0x40105f80) at /home/gates/pinskia/src/
gnu/gcc/src/gcc/cp/parser.c:10238
#8  0x080eef9a in cp_parser_block_declaration (parser=0x40105f80, statement_p=0 '\0') at /home/
gates/pinskia/src/gnu/gcc/src/gcc/cp/parser.c:6896
#9  0x080ef9df in cp_parser_declaration (parser=0x40105f80) at /home/gates/pinskia/src/gnu/gcc/
src/gcc/cp/parser.c:6824
#10 0x080efd5d in cp_parser_declaration_seq_opt (parser=0x40105f80) at /home/gates/pinskia/src/
gnu/gcc/src/gcc/cp/parser.c:6718
#11 0x080eff57 in c_parse_file () at /home/gates/pinskia/src/gnu/gcc/src/gcc/cp/parser.c:2641
#12 0x0817d1f5 in c_common_parse_file (set_yydebug=131) at /home/gates/pinskia/src/gnu/gcc/
src/gcc/c-opts.c:1086
#13 0x0845dbde in toplev_main (argc=131, argv=0xbffec2b4) at /home/gates/pinskia/src/gnu/gcc/
src/gcc/toplev.c:981
#14 0x420174d9 in __libc_start_main () from /lib/i686/libc.so.6
#15 0x08049b31 in _start ()

and that name is no longer computed.

Maybe the friendly_assert just needs to changed into a return or something like that.
Oh by the way error-recovery are never critical per <http://gcc.gnu.org/bugs/management.
html#severity>:
Bugs with keyword "ice-on-invalid-code", where GCC emits a sensible error message before issuing an 
ICE (the ICE will be replaced by the message "confused by earlier errors, bailing out" in release 
versions) should get "minor" severity and the additional keyword "error-recovery".

Subject: Bug 16707

CVSROOT:	/cvs/gcc
Module name:	gcc
Changes by:	mmitchel@gcc.gnu.org	2004-08-02 18:49:08

Modified files:
	gcc/cp         : ChangeLog name-lookup.c 
	gcc/testsuite  : ChangeLog 
Added files:
	gcc/testsuite/g++.dg/lookup: using12.C 

Log message:
	PR c++/16707
	* name-lookup.c (validate_nonmember_using_decl): Robustify.
	
	PR c++/16707
	* g++.dg/lookup/using12.C: New test.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/cp/ChangeLog.diff?cvsroot=gcc&r1=1.4258&r2=1.4259
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/cp/name-lookup.c.diff?cvsroot=gcc&r1=1.80&r2=1.81
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/ChangeLog.diff?cvsroot=gcc&r1=1.4085&r2=1.4086
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/g++.dg/lookup/using12.C.diff?cvsroot=gcc&r1=NONE&r2=1.1

Fixed in GCC 3.5, will not be fixed in GCC 3.4.x.