I needed the following change to gcc (courtesy of Nick Clifton) to get cris-gcc to build at all, even without libgcc:

Index: gcc/config.gcc
===================================================================
--- gcc/config.gcc
+++ gcc/config.gcc
@@ -1130,7 +1130,7 @@
 crisv32-*-linux* | cris-*-linux*)
 	tm_file="dbxelf.h elfos.h ${tm_file} gnu-user.h linux.h glibc-stdint.h cris/linux.h"
 	# We need to avoid using t-linux, so override default tmake_file
-	tmake_file="cris/t-cris cris/t-linux t-slibgcc t-linux"
+	tmake_file="${tmake_file} cris/t-cris cris/t-linux t-slibgcc"
 	extra_options="${extra_options} cris/linux.opt"
 	case $target in
 	  cris-*-*)

This behaviour can be produced with the SVNREV 212237 (2014-07-02) gcc-4.9.0 compiler tarball plus one patch and then the following config:

AR_FOR_TARGET=/usr/bin/cris-linux-gnu-ar \
AS_FOR_TARGET=/usr/bin/cris-linux-gnu-as \
DLLTOOL_FOR_TARGET=/usr/bin/cris-linux-gnu-dlltool \
LD_FOR_TARGET=/usr/bin/cris-linux-gnu-ld \
NM_FOR_TARGET=/usr/bin/cris-linux-gnu-nm \
OBJDUMP_FOR_TARGET=/usr/bin/cris-linux-gnu-objdump \
RANLIB_FOR_TARGET=/usr/bin/cris-linux-gnu-ranlib \
STRIP_FOR_TARGET=/usr/bin/cris-linux-gnu-strip \
WINDRES_FOR_TARGET=/usr/bin/cris-linux-gnu-windres \
WINDMC_FOR_TARGET=/usr/bin/cris-linux-gnu-windmc \
LDFLAGS='-Wl,-z,relro ' \
../gcc-4.9.0-20140702/configure --bindir=/usr/bin --build=x86_64-redhat-linux-gnu \
  --datadir=/usr/share --disable-decimal-float --disable-dependency-tracking \
  --disable-gold --disable-libgomp --disable-libmudflap --disable-libquadmath \
  --disable-libssp --disable-nls --disable-plugin --disable-shared \
  --disable-silent-rules --disable-sjlj-exceptions --disable-threads \
  --enable-checking= --enable-gnu-unique-object --enable-initfini-array \
  --enable-languages=c,c++ --enable-linker-build-id --enable-nls --enable-obsolete \
  --enable-targets=all --exec-prefix=/usr --host=x86_64-redhat-linux-gnu \
  --includedir=/usr/include --infodir=/usr/share/info --libexecdir=/usr/libexec \
  --localstatedir=/var --mandir=/usr/share/man --prefix=/usr \
  --program-prefix=cris-linux-gnu- --sbindir=/usr/sbin --sharedstatedir=/var/lib \
  --sysconfdir=/etc --target=cris-linux-gnu \
  --with-bugurl=http://bugzilla.redhat.com/bugzilla/ \
  --with-linker-hash-style=gnu --with-newlib --with-sysroot=/usr/cris-linux-gnu/sys-root \
  --with-system-libunwind --with-system-zlib --without-headers --without-isl \
  --without-cloog

The binutils is:
cris-linux-gnu-as -v
GNU assembler version 2.24.0 (cris-linux-gnu) using BFD version version 2.24.0-4.fc20 20140613

The compiler is built with:
AR_FOR_TARGET=/usr/bin/cris-linux-gnu-ar \
AS_FOR_TARGET=/usr/bin/cris-linux-gnu-as \
DLLTOOL_FOR_TARGET=/usr/bin/cris-linux-gnu-dlltool \
LD_FOR_TARGET=/usr/bin/cris-linux-gnu-ld \
NM_FOR_TARGET=/usr/bin/cris-linux-gnu-nm \
OBJDUMP_FOR_TARGET=/usr/bin/cris-linux-gnu-objdump \
RANLIB_FOR_TARGET=/usr/bin/cris-linux-gnu-ranlib \
STRIP_FOR_TARGET=/usr/bin/cris-linux-gnu-strip \
WINDRES_FOR_TARGET=/usr/bin/cris-linux-gnu-windres \
WINDMC_FOR_TARGET=/usr/bin/cris-linux-gnu-windmc \
make -C cris-linux-gnu tooldir=/usr all-gcc

libgcc is built with:
make -C cris-linux-gnu tooldir=/usr all-target-libgcc

This also appears to occur for --target=sh64-linux on an unpatched gcc tree.

(In reply to dhowells@redhat.com from comment #1)

Thanks for reporting, I'll take this.  (I don't autotest cris-linux not crisv32-linux; they aren't in general use anymore.)

> I needed the following change to gcc (courtesy of Nick Clifton) to get
> cris-gcc to build at all, even without libgcc:
> 
> Index: gcc/config.gcc
> ===================================================================
> --- gcc/config.gcc
> +++ gcc/config.gcc
> @@ -1130,7 +1130,7 @@
>  crisv32-*-linux* | cris-*-linux*)
>  	tm_file="dbxelf.h elfos.h ${tm_file} gnu-user.h linux.h glibc-stdint.h
> cris/linux.h"
>  	# We need to avoid using t-linux, so override default tmake_file
> -	tmake_file="cris/t-cris cris/t-linux t-slibgcc t-linux"
> +	tmake_file="${tmake_file} cris/t-cris cris/t-linux t-slibgcc"
>  	extra_options="${extra_options} cris/linux.opt"
>  	case $target in
>  	  cris-*-*)

Obvious breakages (for obvious reasons with obvious correct results) is covered by the obviousness rule and thus free to commit for anyone (including you).

In fact, this typo (missing prepending of ${tmake_file}), supposedly introduced at the time of some general config-revision, is shared with several targets.

JFTR:

> This behaviour can be produced with the SVNREV 212237 (2014-07-02) gcc-4.9.0
> compiler tarball plus one patch and then the following config:
[...]

No need for specific options besides --target nor special paths given target binutils in the PATH; you should set that instead.  (Sadly, "no specific options" with the exception of sysroot / build-sysroot options unless hoops are jumped through, but I hope to fix that one day for all cross-targets.)  Also, a multitude of options like this magnitude is a red flag.  (Your cross-build setup is flawed, but I doubt that's the root of the build problem.)

> Anyway, I've added a reduced libgcc2.i that causes the error to occur.

Thanks.

>  I don't think it'll help because you need the intermediate-stage compiler binaries also.

Incorrect.  This is a *cross-compiler*.  Even if it was a native build, failing building the first stage libgcc build makes the stageness issue moot. :)

> libgcc is built with:
> make -C cris-linux-gnu tooldir=/usr all-target-libgcc

I'd expect "make all-target-libgcc" to Just Work.

(In reply to Hans-Peter Nilsson from comment #3)
> (In reply to dhowells@redhat.com from comment #1)

> > Index: gcc/config.gcc
> > ===================================================================
> > --- gcc/config.gcc
> > +++ gcc/config.gcc
> > @@ -1130,7 +1130,7 @@
> >  crisv32-*-linux* | cris-*-linux*)
> >  	tm_file="dbxelf.h elfos.h ${tm_file} gnu-user.h linux.h glibc-stdint.h
> > cris/linux.h"
> >  	# We need to avoid using t-linux, so override default tmake_file
> > -	tmake_file="cris/t-cris cris/t-linux t-slibgcc t-linux"
> > +	tmake_file="${tmake_file} cris/t-cris cris/t-linux t-slibgcc"

> Obvious breakages (for obvious reasons with obvious correct results) is
> covered by the obviousness rule and thus free to commit for anyone
> (including you).

Except it's only obvious in the absence of a comment "explaining" the exception.  Doh!  So, there's another issue and that patch is incorrect (do *not* apply it).  Also, I don't remember what aspects of t-linux needs avoiding.  Looking into it...

Confirmed the observation at r212508, with the patch in the attachment in the next comment.

Created attachment 33121 [details]
Patch to config.gcc

Correct patch to config.gcc required to actually build the compiler proper.

(In reply to dhowells@redhat.com from comment #0)

BTW,

> Please submit a full bug report,
> with preprocessed source if appropriate.
> Please include the complete backtrace with any bug report.
> See <http://bugzilla.redhat.com/bugzilla/> for instructions.
> The bug is not reproducible, so it is likely a hardware or OS problem.
> 
> 
> I'm also very intrigued by that last line - I can reproduce it quite easily.

This is a RH local patch in your host gcc (by Jakub, IIRC) to help users re-running the actual ICEing command adding -save-temps.  I'm guessing it has a bug and accidentally drops some option required to reproduce the ICE...

(In reply to dhowells@redhat.com from comment #0)
> ../../../gcc-4.9.0-20140702/libgcc/libgcc2.c: In function ‘__subvsi3’:
> ../../../gcc-4.9.0-20140702/libgcc/libgcc2.c:122:1: error: unrecognizable
> insn:
>  }
>  ^
> (call_insn 27 26 28 7 (parallel [
>             (call (mem:QI (symbol_ref:SI ("abort") [flags 0x41]
> <function_decl 0x7f5784e05d00 abort>) [0 __builtin_abort S1 A8])


This symbol_ref must be wrapped inside a CONST by the middle-end.
Something changed such that that doesn't happen anymore; that's the bug.
Unless this was a deliberate general change in representation, which I doubt.
Still investigating...

(In reply to Hans-Peter Nilsson from comment #8)
> This symbol_ref must be wrapped inside a CONST by the middle-end.

Uh, strike that, I'm hallucinating.

(In reply to Hans-Peter Nilsson from comment #7)
> (In reply to dhowells@redhat.com from comment #0)
> > I'm also very intrigued by that last line - I can reproduce it quite easily.
> 
> This is a RH local patch in your host gcc (by Jakub, IIRC) to help users
> re-running the actual ICEing command adding -save-temps.  I'm guessing it
> has a bug and accidentally drops some option required to reproduce the ICE...

It's in the gcc-4.9.0-20140702 tarball.

(In reply to Hans-Peter Nilsson from comment #3)
> > libgcc is built with:
> > make -C cris-linux-gnu tooldir=/usr all-target-libgcc
> 
> I'd expect "make all-target-libgcc" to Just Work.

So would I.  However, it doesn't work for all arches that the SRPM builds a cross-compiler for.  I need the compiler to build the kernel, but not normally libgcc, however, I've been asked to build libgcc if I can.  The arches for which I can't build libgcc include: cris, sh, sh64 and tile.

(In reply to Hans-Peter Nilsson from comment #6)
> Created attachment 33121 [details]
> Patch to config.gcc
> 
> Correct patch to config.gcc required to actually build the compiler proper.

Okay, I've tried that.  I can't see that it makes any obvious difference.  Is there something I should look for?

(In reply to dhowells@redhat.com from comment #12)
> (In reply to Hans-Peter Nilsson from comment #6)
> > Created attachment 33121 [details]
> > Patch to config.gcc
> > 
> > Correct patch to config.gcc required to actually build the compiler proper.
> 
> Okay, I've tried that.  I can't see that it makes any obvious difference. 
> Is there something I should look for?

Oh, it wasn't meant as a fix to the problem at hand, just a replacement for the prerequisite patch.  The differences to *that* one is that the duplicate t-slibgcc t-linux are removed and the comment too, after checking why I had it; likely a libgcc-related issue with headers (and so moot after the libgcc split years ago).

(In reply to dhowells@redhat.com from comment #10)
> (In reply to Hans-Peter Nilsson from comment #7)
> > (In reply to dhowells@redhat.com from comment #0)
> > > I'm also very intrigued by that last line - I can reproduce it quite easily.
> > 
> > This is a RH local patch in your host gcc (by Jakub, IIRC) to help users
> > re-running the actual ICEing command adding -save-temps.  I'm guessing it
> > has a bug and accidentally drops some option required to reproduce the ICE...
> 
> It's in the gcc-4.9.0-20140702 tarball.

Oh it finally made into the FSF repo, good!
Could you please consider open a separate PR for the "is not reproducible" misdisagnosis?

(In reply to Hans-Peter Nilsson from comment #14)
> Could you please consider open a separate PR for the "is not reproducible"
> misdisagnosis?

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61812

Author: hp
Date: Thu Jul 17 02:03:52 2014
New Revision: 212708

URL: https://gcc.gnu.org/viewcvs?rev=212708&root=gcc&view=rev
Log:
	PR target/61737.
	* config/cris/cris.c (TARGET_LEGITIMATE_CONSTANT_P)
	(TARGET_CANNOT_FORCE_CONST_MEM): Define.
	(cris_cannot_force_const_mem, cris_legitimate_constant_p): New
	functions.
	(cris_print_index, cris_print_operand, cris_constant_index_p)
	(cris_side_effect_mode_ok): Replace CONSTANT_P with CRIS_CONSTANT_P.
	(cris_address_cost): Ditto last CONSTANT_P.
	(cris_symbol_type_of): Rename from cris_pic_symbol_type_of.  All
        callers changed.  Yield cris_offsettable_symbol for non-PIC
        constant symbolic expressions including labels.  Yield cris_unspec
	for all unspecs.
	(cris_expand_pic_call_address): New parameter MARKERP.  Set its
        target to pic_offset_table_rtx for calls that will likely go
        through PLT, const0_rtx when they can't.  All callers changed.
	Assert flag_pic.  Use CONSTANT_P, not CONSTANT_ADDRESS_P, for
	symbolic expressions to be PICified.  Remove second, redundant,
	assert on can_create_pseudo_p returning non-zero.  Use
	replace_equiv_address_nv, not replace_equiv_address, for final
	operand update.
	* config/cris/cris.md ("movsi"): Move variable t to pattern
	toplevel. Adjust assert for new cris_symbol_type member.  Use
	CONSTANT_P instead of CONSTANT_ADDRESS_P.
	("*movsi_internal") <case 9>: Make check for valid unspec operands
	for lapc stricter.
	<case CRIS_UNSPEC_PCREL, CRIS_UNSPEC_PLT_PCREL>: Clear condition
	codes.
	("call", "call_value"): Use second incoming operand as a marker
	for pic-offset-table-register being used.
	("*expanded_call_non_v32", "*expanded_call_v32")
        ("*expanded_call_value_non_v32", "*expanded_call_value_v32"): For
	second incoming operand to CALL, match cris_call_type_marker.
	("*expanded_call_value_side"): Ditto.  Disable before
	reload_completed.
	("*expanded_call_side"): Ditto.  Fix typo in comment.
	(moverside, movemside peepholes): Check for CRIS_CONSTANT_P, not
	CONSTANT_P.
	* config/cris/predicates.md ("cris_call_type_marker"): New predicate.
	* config/cris/cris.h (CRIS_CONSTANT_P): New macro.
	(enum cris_symbol_type): Rename from cris_pic_symbol_type.  All
        users changed.  Add members cris_offsettable_symbol and
	cris_unspec.
	(cris_symbol_type): Rename from cris_pic_symbol_type.
	* config/cris/constraints.md ("T"): Use CRIS_CONSTANT_P, not
        just CONSTANT_P.
	* config/cris/cris-protos.h (cris_symbol_type_of,
	cris_expand_pic_call_address): Adjust prototypes.
	(cris_legitimate_constant_p): New prototype.

Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/config/cris/constraints.md
    trunk/gcc/config/cris/cris-protos.h
    trunk/gcc/config/cris/cris.c
    trunk/gcc/config/cris/cris.h
    trunk/gcc/config/cris/cris.md
    trunk/gcc/config/cris/predicates.md

Author: hp
Date: Thu Jul 17 03:53:23 2014
New Revision: 212713

URL: https://gcc.gnu.org/viewcvs?rev=212713&root=gcc&view=rev
Log:
	Backport from trunk.
	PR target/61737.
	* config/cris/cris.c (TARGET_LEGITIMATE_CONSTANT_P)
	(TARGET_CANNOT_FORCE_CONST_MEM): Define.
	(cris_cannot_force_const_mem, cris_legitimate_constant_p): New
	functions.
	(cris_print_index, cris_print_operand, cris_constant_index_p)
	(cris_side_effect_mode_ok): Replace CONSTANT_P with CRIS_CONSTANT_P.
	(cris_address_cost): Ditto last CONSTANT_P.
	(cris_symbol_type_of): Rename from cris_pic_symbol_type_of.  All
        callers changed.  Yield cris_offsettable_symbol for non-PIC
        constant symbolic expressions including labels.  Yield cris_unspec
	for all unspecs.
	(cris_expand_pic_call_address): New parameter MARKERP.  Set its
        target to pic_offset_table_rtx for calls that will likely go
        through PLT, const0_rtx when they can't.  All callers changed.
	Assert flag_pic.  Use CONSTANT_P, not CONSTANT_ADDRESS_P, for
	symbolic expressions to be PICified.  Remove second, redundant,
	assert on can_create_pseudo_p returning non-zero.  Use
	replace_equiv_address_nv, not replace_equiv_address, for final
	operand update.
	* config/cris/cris.md ("movsi"): Move variable t to pattern
	toplevel. Adjust assert for new cris_symbol_type member.  Use
	CONSTANT_P instead of CONSTANT_ADDRESS_P.
	("*movsi_internal") <case 9>: Make check for valid unspec operands
	for lapc stricter.
	<case CRIS_UNSPEC_PCREL, CRIS_UNSPEC_PLT_PCREL>: Clear condition
	codes.
	("call", "call_value"): Use second incoming operand as a marker
	for pic-offset-table-register being used.
	("*expanded_call_non_v32", "*expanded_call_v32")
        ("*expanded_call_value_non_v32", "*expanded_call_value_v32"): For
	second incoming operand to CALL, match cris_call_type_marker.
	("*expanded_call_value_side"): Ditto.  Disable before
	reload_completed.
	("*expanded_call_side"): Ditto.  Fix typo in comment.
	(moverside, movemside peepholes): Check for CRIS_CONSTANT_P, not
	CONSTANT_P.
	* config/cris/predicates.md ("cris_call_type_marker"): New predicate.
	* config/cris/cris.h (CRIS_CONSTANT_P): New macro.
	(enum cris_symbol_type): Rename from cris_pic_symbol_type.  All
        users changed.  Add members cris_offsettable_symbol and
	cris_unspec.
	(cris_symbol_type): Rename from cris_pic_symbol_type.
	* config/cris/constraints.md ("T"): Use CRIS_CONSTANT_P, not
        just CONSTANT_P.
	* config/cris/cris-protos.h (cris_symbol_type_of,
	cris_expand_pic_call_address): Adjust prototypes.
	(cris_legitimate_constant_p): New prototype.

Modified:
    branches/gcc-4_9-branch/gcc/ChangeLog
    branches/gcc-4_9-branch/gcc/config/cris/constraints.md
    branches/gcc-4_9-branch/gcc/config/cris/cris-protos.h
    branches/gcc-4_9-branch/gcc/config/cris/cris.c
    branches/gcc-4_9-branch/gcc/config/cris/cris.h
    branches/gcc-4_9-branch/gcc/config/cris/cris.md
    branches/gcc-4_9-branch/gcc/config/cris/predicates.md

Prerequisite config.gcc patch committed separately.

This seems to have done the trick, thanks!

Unfortunately, at the face of it, I think the only factors common with PR61844 are "rot at the RTL level" and "building libgcc".  (My own involvement with SH64 is too far in the past and then only peripheral to the GCC port.)

(In reply to Hans-Peter Nilsson from comment #20)
> Unfortunately, at the face of it, I think the only factors common with
> PR61844 are "rot at the RTL level" and "building libgcc".

Apparently also "when handling PIC" (register 12 on SH says grep).
Unfortunately that's unlikely to help anyone not involved with SH64.

That's a shame.  It's just that the error messages look very similar.