The gccas program segfaults on the following input.  It is distilled from abs.cc
from kimwitu++:

; GNU C++ version 3.4-llvm 20030827 (experimental) (i686-pc-linux-gnu)
;	compiled by GNU C version 3.3.
; GGC heuristics: --param ggc-min-expand=64 --param ggc-min-heapsize=64209
; options passed:  -iprefix -D_GNU_SOURCE -mtune=pentiumpro -auxbase-strip
; options enabled:  -feliminate-unused-debug-types -fpeephole
; -ffunction-cse -fkeep-static-consts -fpcc-struct-return -fgcse-lm
; -fgcse-sm -fsched-interblock -fsched-spec -fbranch-count-reg -fcommon
; -fgnu-linker -fargument-alias -fzero-initialized-in-bss -fident
; -fmath-errno -ftrapping-math -m80387 -mhard-float -mno-soft-float
; -mieee-fp -mfp-ret-in-387 -maccumulate-outgoing-args -mno-red-zone
; -mtls-direct-seg-refs -mtune=pentiumpro -march=i386

target pointersize = 32
target endian = little

%struct.impl_casestring__Str = type opaque

%.str_1 = internal constant [1 x sbyte] c"\00"
%.str_2 = internal constant [1 x sbyte] c"\00"

%_ZTVN10__cxxabiv120__si_class_type_infoE = external constant [0 x int (...)*] 
;; int
(*__cxxabiv1::__si_class_type_info::_ZTVN10__cxxabiv120__si_class_type_infoE[])(...)

declare %struct.impl_casestring__Str* %_ZN2kc12mkcasestringEPKci(sbyte*,int)  ;;
kc::impl_casestring__Str* kc::mkcasestring(const kc_char*, int)

void
%_ZN2kc22impl_fileline_FileLineC2EPNS_20impl_casestring__StrEi("struct.kc::impl_fileline_FileLine"*
%this.1, "struct.kc::impl_casestring__Str"* %_file.1, int %_line.1)
{ 
;; kc::impl_fileline_FileLine::impl_fileline_FileLine(kc::impl_casestring__Str*, in)
entry:
	%mem_tmp = alloca "struct.kc::impl_casestring__Str"*		 ;
ty="struct.kc::impl_casestring__Str"**
	%tmp.11 = invoke "struct.kc::impl_casestring__Str"* (sbyte*, int)* cast
(%struct.impl_casestring__Str* (sbyte*, int)* %_ZN2kc12mkcasestringEPKci to
"struct.kc::impl_casestring__Str"* (sbyte*, int)*)(sbyte* getelementptr ([1 x
sbyte]* %.str_1, long 0, long 0), int -1)
			to label %invoke_cont except label %return		 ;
ty="struct.kc::impl_casestring__Str"*
invoke_cont:
	store "struct.kc::impl_casestring__Str"* %tmp.11,
"struct.kc::impl_casestring__Str"** %mem_tmp
	ret void
return:
	ret void
}

Bugpoint trivially reduced this to a crash the instcombine pass.  Here's a
slightly simplified version:

declare int* %bar(sbyte*, int)

void %foo() {
        %tmp.11 = invoke float* cast (int* (sbyte*, int)* %bar to float*
(sbyte*, int)*)( sbyte* null, int -1 )
                        to label %invoke_cont except label %return

invoke_cont:
        store float* %tmp.11, float** null
        ret void

return:         ; preds = %entry
        ret void
}

Testcase here:
http://mail.cs.uiuc.edu/pipermail/llvm-commits/Week-of-Mon-20031027/008966.html

Bug fix here:
http://mail.cs.uiuc.edu/pipermail/llvm-commits/Week-of-Mon-20031027/008967.html

-Chris