CVS build failure for target sh-elf

[tm]

I'm looking at CVS build failure for --target=sh-elf where
it crashes building _muldi3:

Program received signal SIGSEGV, Segmentation fault.
0x08188182 in gen_mulsi3 (operand0=0x401ab5f0, operand1=0x401ab640,
operand2=0x401ab654) at insn-emit.c:4965
4965	      first = XVECEXP (insns, 0, 0);

The problem occurs in C code for this expander:

(define_expand "mulsi3"
  [(set (reg:SI MACL_REG)
        (mult:SI  (match_operand:SI 1 "arith_reg_operand" "")
                  (match_operand:SI 2 "arith_reg_operand" "")))
   (set (match_operand:SI 0 "arith_reg_operand" "")
        (reg:SI MACL_REG))]
  "TARGET_SH1"
  "
{
  rtx first, last;

  if (!TARGET_SH2)
    {
      /* The address must be set outside the libcall,
         since it goes into a pseudo.  */
      rtx sym = gen_rtx_SYMBOL_REF (SImode, \"__mulsi3\");
      rtx addr = force_reg (SImode, sym);
      rtx insns = gen_mulsi3_call (operands[0], operands[1],
                                   operands[2], addr);

      first = XVECEXP (insns, 0, 0);            <-------------------- here
      last = XVECEXP (insns, 0, XVECLEN (insns, 0) - 1);
      emit_insn (insns);
    }
  else
    {
      rtx macl = gen_rtx_REG (SImode, MACL_REG);

      first = emit_insn (gen_mul_l (operands[1], operands[2]));
      /* consec_sets_giv can only recognize the first insn that sets a
         giv as the giv insn.  So we must tag this also with a REG_EQUAL
         note.  */
      last = emit_insn (gen_movsi_i ((operands[0]), macl));
    }
  /* Wrap the sequence in REG_LIBCALL / REG_RETVAL notes so that loop
     invariant code motion can move it.  */
  REG_NOTES (first) = gen_rtx_INSN_LIST (REG_LIBCALL, last, REG_NOTES
(first));
  REG_NOTES (last) = gen_rtx_INSN_LIST (REG_RETVAL, first, REG_NOTES
(last));
  DONE;
}")

The code generated for the source line is:

0x818817c <gen_mulsi3+162>:     mov    0xffffffc4(%ebp),%eax
0x818817f <gen_mulsi3+165>:     mov    0x4(%eax),%eax
0x8188182 <gen_mulsi3+168>:     mov    0x4(%eax),%eax <- here
0x8188185 <gen_mulsi3+171>:     mov    %eax,0xffffffd4(%ebp)

The compiler seems to be using insns->fld[0].rtvec which is 27 (0x1b):

(gdb) display/i $pc
1: x/i $eip  0x8188182 <gen_mulsi3+168>:	mov    0x4(%eax),%eax
(gdb) print $eax
$11 = 27 
(gdb) print insns->fld[0].rtvec 
$12 = (struct rtvec_def *) 0x1b

Is XVECEXP(insns, 0, 0) supposed to reference insns->fld[0].rtvec, or does
insns->fld[0].rtvec look highly suspect?

BTW, it'd be nice to have separate debugger-callable versions of XVECEXP
and XVECLEN and other critical macros...it's very tough to trace through
the nested RTX access macros on rtl.h

Toshi