Attached is a patch for this.

The problem was that, at some point in history, pushes and pops to a 
stack implemented in an obstack were done with a sequence that looked like

    base_ptr = obstack_base(...)
    obstack_grow(...)
    obstack_grow(...)
        .
        .
        .
    obstack_free(..., base_ptr)

You can't do that.  obstack_base() returns a pointer to the current 
allocation, which may change depending on what's stuffed into the 
obstack--by the time the obstack_free is hit, the base may have changed.

This patch fixes this.  Unfortunately, there are at least two other 
identical abuses of obstacks in cp-valprint.c alone, one of which I 
introduced myself in the patch to PR9067 (the down-side of 
cut'n'paste...).  I'll fix that in a separate patch.  Also 
unfortunately, this current patch conflicts with the patch I sent out a 
day or two ago for PR10687--I'll reconcile that before committing anything.