[Bug c++/14448] New: Segfault in Boost indexed_set

[Bug c++/14448] New: Segfault in Boost indexed_set

[giovannibajo at libero dot it]

The preprocessed source attacched segfaults 3.4 and mainline:

../../../boost/indexed_set/seq_index_ops.hpp: In function `void 
boost::indexed_sets::detail::sequenced_index_sort(Node*, Compare) [with Node = 
boost::indexed_sets::detail::sequenced_index_node<boost::indexed_sets::detail::i
ndex_node_base<int> >, Compare = std::less<int>]':
../../../boost/indexed_set/sequenced_index.hpp:416:   instantiated from `void 
boost::indexed_sets::detail::sequenced_index<Super, TagList>::sort() [with 
Super = boost::indexed_sets::detail::index_base<int, 
boost::indexed_sets::index_list<boost::indexed_sets::unique<boost::indexed_sets:
:identity<int>, boost::indexed_sets::detail::null_arg, 
boost::indexed_sets::detail::null_arg>, 
boost::indexed_sets::sequenced<boost::indexed_sets::tag<boost::mpl::void_, 
boost::mpl::void_, boost::mpl::void_, boost::mpl::void_, boost::mpl::void_, 
boost::mpl::void_, boost::mpl::void_, boost::mpl::void_, boost::mpl::void_, 
boost::mpl::void_> >, boost::mpl::void_, boost::mpl::void_, boost::mpl::void_, 
boost::mpl::void_, boost::mpl::void_, boost::mpl::void_, boost::mpl::void_, 
boost::mpl::void_>, std::allocator<int> >, TagList = 
boost::indexed_sets::tag<boost::mpl::void_, boost::mpl::void_, 
boost::mpl::void_, boost::mpl::void_, boost::mpl::void_, boost::mpl::void_, 
boost::mpl::void_, boost::mpl::void_, boost::mpl::void_, boost::mpl::void_>]'
test_list_ops.cpp:127:   instantiated from here
../../../boost/indexed_set/seq_index_ops.hpp:117: internal compiler error: 
Segmentation fault

without any special compilation option.

This is with:
gcc version 3.4.0 20040216 (prerelease)
gcc version 3.5.0 20040219 (experimental)

so they're not super recent, but still. I haven't tried any reduction and I 
won't have time today at least. The code is supposed to be valid.

-- 
           Summary: Segfault in Boost indexed_set
           Product: gcc
           Version: 3.4.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P2
         Component: c++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: giovannibajo at libero dot it
                CC: gcc-bugs at gcc dot gnu dot org


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] Segfault in Boost indexed_set

[giovannibajo at libero dot it]

------- Additional Comments From giovannibajo at libero dot it  2004-03-05 15:23 -------
Created an attachment (id=5870)
 --> (http://gcc.gnu.org/bugzilla/attachment.cgi?id=5870&action=view)
Preprocessed source for G++ 3.4


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] Segfault in Boost indexed_set

[giovannibajo at libero dot it]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |3.4.0 3.5.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] Segfault in Boost indexed_set

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-03-05 15:31 -------
I have not reduced it yet but it is seg faulting in the mangling code when trying to write mangle this 
tree:
<save_expr 0x412bae40
    type <integer_type 0x401919b4 unsigned int unsigned sizetype type_6 SI
        size <integer_cst 0x4004e21c constant 32>
        unit size <integer_cst 0x4004e2a8 constant 4>
        align 32 symtab 0 alias set -1 precision 32 min <integer_cst 0x4004e2e4 0> max <integer_cst 
0x4004e2f8 4294967295>>
    side-effects readonly unsigned asm_written
    arg 0 <mult_expr 0x40f43c48 type <integer_type 0x401919b4 unsigned int>
       
        arg 0 <non_lvalue_expr 0x41103230 type <integer_type 0x401919b4 unsigned int>
           
            arg 0 <nop_expr 0x4110321c type <integer_type 0x401919b4 unsigned int>
                arg 0 <var_decl 0x412efb64 max_fill>>>
        arg 1 <integer_cst 0x4004e938 constant 8>>
    arg 1 <function_decl 0x412ef948 sequenced_index_sort
        type <function_type 0x412ef8dc type <void_type 0x40191c3c void>
            DI
            size <integer_cst 0x4004e5b4 constant 64> unit size <integer_cst 0x4004e938 8>
            align 64 symtab 0 alias set -1
            arg-types <tree_list 0x410f9ca8 value <pointer_type 0x412ef798>
                chain <tree_list 0x410f9cbc value <template_type_parm 0x412ef6c0 Compare>
                    chain <tree_list 0x40195910 tree_2 value <void_type 0x40191c3c void>>>>>
        public static decl_5 QI file ../../../boost/indexed_set/seq_index_ops.hpp line 94 context 
<namespace_decl 0x407c7d14 detail>
        arguments <parm_decl 0x412ef804 header type <pointer_type 0x412ef798>
            unsigned SI file ../../../boost/indexed_set/seq_index_ops.hpp line 94
            size <integer_cst 0x4004e974 constant 32>
            unit size <integer_cst 0x4004e9c4 constant 4>
            align 32 context <function_decl 0x412ef948 sequenced_index_sort> chain <parm_decl 
0x412ef870 comp>>
        result <result_decl 0x412efa20 type <void_type 0x40191c3c void>
            VOID file ../../../boost/indexed_set/seq_index_ops.hpp line 94
            align 8 context <function_decl 0x412ef948 sequenced_index_sort>> initial <block 
0x412f2960>
        template-info 0x410f9cd0
        saved-insns 0x412f0200>
    rtl 2 (nil)
>

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] Segfault in Boost indexed_set

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-03-05 15:37 -------
This non-tested (I did not bootstrap with it or test it on the testcase either):
Index: mangle.c
===============================================================
====
RCS file: /cvs/gcc/gcc/gcc/cp/mangle.c,v
retrieving revision 1.54.2.20
diff -u -p -r1.54.2.20 mangle.c
--- mangle.c	2 Mar 2004 18:42:47 -0000	1.54.2.20
+++ mangle.c	5 Mar 2004 15:36:28 -0000
@@ -1909,9 +1909,10 @@ write_expression (tree expr)
 
   /* Skip NOP_EXPRs.  They can occur when (say) a pointer argument
      is converted (via qualification conversions) to another
-     type.  */
+     type.  Also skip SAVE_EXPR as they are useless.   */
   while (TREE_CODE (expr) == NOP_EXPR
-	 || TREE_CODE (expr) == NON_LVALUE_EXPR)
+	 || TREE_CODE (expr) == NON_LVALUE_EXPR
+         || TREE_CODE (expr) == SAVE_EXPR)
     {
       expr = TREE_OPERAND (expr, 0);
       code = TREE_CODE (expr);

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] [3.4/3.5 regression] Segfault in Boost indexed_set

[reichelt at gcc dot gnu dot org]

------- Additional Comments From reichelt at gcc dot gnu dot org  2004-03-07 22:33 -------
Reduced testcase:

===================================================================
template <int> struct A
{
    A();
};

template<typename T> void foo(T)
{
    static const int n=1+1;
    A<n+1> a;
}

void bar()
{
    foo(0);
}
===================================================================


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |reichelt at gcc dot gnu dot
                   |                            |org
           Severity|normal                      |critical
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
      Known to work|                            |3.3.3
   Last reconfirmed|0000-00-00 00:00:00         |2004-03-07 22:34:00
               date|                            |
            Summary|Segfault in Boost           |[3.4/3.5 regression]
                   |indexed_set                 |Segfault in Boost
                   |                            |indexed_set
   Target Milestone|---                         |3.4.0


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] [3.4/3.5 regression] Segfault in Boost indexed_set

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2004-03-08 00:08 -------
With the reduced example, I get a different backtrace (so there might be two different bugs here):
#0  htab_find_with_hash (htab=0x0, element=0x0, hash=137308935) at /Users/pinskia/src/gcc-tree-
ssa/gcc/libiberty/hashtab.c:440
#1  0x0006c4e8 in retrieve_local_specialization (tmpl=0x4179583c) at /Users/pinskia/src/gcc-tree-
ssa/gcc/gcc/cp/pt.c:846
#2  0x000955f4 in tsubst_decl (t=0x4179583c, args=0x0, type=0x417957c0, complain=tf_error) at /
Users/pinskia/src/gcc-tree-ssa/gcc/gcc/cp/pt.c:6376
#3  0x000967e0 in tsubst (t=0x4179583c, args=0x0, complain=tf_error, in_decl=0x0) at /Users/
pinskia/src/gcc-tree-ssa/gcc/gcc/cp/pt.c:6645
#4  0x0009d070 in tsubst_copy (t=0x4179583c, args=0x0, complain=tf_error, in_decl=0x0) at /
Users/pinskia/src/gcc-tree-ssa/gcc/gcc/cp/pt.c:7457
#5  0x0009d570 in tsubst_copy (t=0x416ddfc0, args=0x0, complain=tf_error, in_decl=0x0) at /Users/
pinskia/src/gcc-tree-ssa/gcc/gcc/cp/pt.c:7503
#6  0x000a83c4 in tsubst_copy_and_build (t=0x416ddfc0, args=0x0, complain=tf_error, in_decl=0x0, 
function_p=false) at /Users/pinskia/src/gcc-tree-ssa/gcc/gcc/cp/pt.c:8579
#7  0x000a4864 in tsubst_copy_and_build (t=0x416ca5c4, args=0x0, complain=tf_error, in_decl=0x0, 
function_p=false) at /Users/pinskia/src/gcc-tree-ssa/gcc/gcc/cp/pt.c:8269
#8  0x0007d1d4 in fold_non_dependent_expr (expr=0x416ca5c4) at /Users/pinskia/src/gcc-tree-ssa/
gcc/gcc/cp/pt.c:3141
#9  0x0007d238 in convert_nontype_argument (type=0x416cb8b8, expr=0x416ca5c4) at /Users/
pinskia/src/gcc-tree-ssa/gcc/gcc/cp/pt.c:3172
#10 0x000806fc in convert_template_argument (parm=0x41791aa8, arg=0x416ca5c4, 
args=0x4178bae0, complain=3, i=0, in_decl=0x41791d90) at /Users/pinskia/src/gcc-tree-ssa/gcc/
gcc/cp/pt.c:3775
#11 0x00080cb4 in coerce_template_parms (parms=0x4178b6a8, args=0x4178bac8, 
in_decl=0x41791d90, complain=3, require_all_arguments=1) at /Users/pinskia/src/gcc-tree-ssa/gcc/
gcc/cp/pt.c:3856
#12 0x0008533c in lookup_template_class (d1=0x41793f00, arglist=0x4178bac8, in_decl=0x0, 
context=0x0, entering_scope=0, complain=3) at /Users/pinskia/src/gcc-tree-ssa/gcc/gcc/cp/pt.c:
4350
#13 0x001a43cc in finish_template_type (name=0x41791d90, args=0x4178bac8, entering_scope=0) 
at /Users/pinskia/src/gcc-tree-ssa/gcc/gcc/cp/semantics.c:2139

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] [3.4/3.5 regression] Segfault in Boost indexed_set

[giovannibajo at libero dot it]

------- Additional Comments From giovannibajo at libero dot it  2004-03-08 01:29 -------
The bug is the same. The reduced testcase hits just ICEs "earlier" because of 
the simplified context.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|unassigned at gcc dot gnu   |giovannibajo at libero dot
                   |dot org                     |it
             Status|NEW                         |ASSIGNED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] [3.4/3.5 regression] Segfault in Boost indexed_set

[giovannibajo at libero dot it]

------- Additional Comments From giovannibajo at libero dot it  2004-03-08 02:39 -------
Patch posted, waiting for review:
http://gcc.gnu.org/ml/gcc-patches/2004-03/msg00682.html


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] [3.4/3.5 regression] Segfault in Boost indexed_set

[reichelt at igpm dot rwth-aachen dot de]

------- Additional Comments From reichelt at igpm dot rwth-aachen dot de  2004-03-08 08:59 -------
Subject: Re:  [3.4/3.5 regression] Segfault in Boost indexed_set

On  8 Mar, giovannibajo at libero dot it wrote:

Hi Giovanni,

the testcase in your patch is hosed, the assignement of n should read
"n=1+1" instead of just "n=1". BTW, one can reduce it a litte more, so
here's an updated version:

=========================================
template <int> struct A {};

template<typename T> void foo(T)
{
    const int n=1+1;
    A<n+1> a;
}

void bar()
{
    foo(0);
}
=========================================

Regards,
Volker


> ------- Additional Comments From giovannibajo at libero dot it  2004-03-08 02:39 -------
> Patch posted, waiting for review:
> http://gcc.gnu.org/ml/gcc-patches/2004-03/msg00682.html




-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] [3.4/3.5 regression] Segfault in Boost indexed_set

[giovannibajo at libero dot it]

------- Additional Comments From giovannibajo at libero dot it  2004-03-08 13:55 -------
Yes, I posted a little followup. So that everything is clear, my patch *does* 
fix both the original preprocessed source *and* Volker's testcase, I just 
posted the wrong file for some reason.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] [3.4/3.5 regression] Segfault in Boost indexed_set

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2004-03-09 15:35 -------
Subject: Bug 14448

CVSROOT:	/cvs/gcc
Module name:	gcc
Changes by:	giovannibajo@gcc.gnu.org	2004-03-09 15:35:03

Modified files:
	gcc/cp         : ChangeLog parser.c pt.c 
	gcc/testsuite  : ChangeLog 
Added files:
	gcc/testsuite/g++.dg/template: spec12.C 
	gcc/testsuite/g++.dg/parse: crash14.C 

Log message:
	PR c++/14409
	* pt.c (determine_specialization): For member templates, match also
	constness.
	
	PR c++/14448
	* parser.c (cp_parser_initializer_clause): Fold initializer if it is
	non-dependent.
	* pt.c (tsubst_copy_and_build): Handle NOP_EXPRs.
	
	PR c++/14409
	* g++.dg/template/spec12.C: New test.
	
	PR c++/14448
	* g++.dg/parse/crash14.C: New test.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/cp/ChangeLog.diff?cvsroot=gcc&r1=1.3990&r2=1.3991
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/cp/parser.c.diff?cvsroot=gcc&r1=1.180&r2=1.181
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/cp/pt.c.diff?cvsroot=gcc&r1=1.836&r2=1.837
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/ChangeLog.diff?cvsroot=gcc&r1=1.3586&r2=1.3587
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/g++.dg/template/spec12.C.diff?cvsroot=gcc&r1=NONE&r2=1.1
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/g++.dg/parse/crash14.C.diff?cvsroot=gcc&r1=NONE&r2=1.1



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] [3.4/3.5 regression] Segfault in Boost indexed_set

[cvs-commit at gcc dot gnu dot org]

------- Additional Comments From cvs-commit at gcc dot gnu dot org  2004-03-09 15:41 -------
Subject: Bug 14448

CVSROOT:	/cvs/gcc
Module name:	gcc
Branch: 	gcc-3_4-branch
Changes by:	giovannibajo@gcc.gnu.org	2004-03-09 15:41:38

Modified files:
	gcc/cp         : ChangeLog parser.c pt.c 
	gcc/testsuite  : ChangeLog 
Added files:
	gcc/testsuite/g++.dg/template: spec12.C 
	gcc/testsuite/g++.dg/parse: crash14.C 

Log message:
	PR c++/14409
	* pt.c (determine_specialization): For member templates, match also
	constness.
	
	PR c++/14448
	* parser.c (cp_parser_initializer_clause): Fold initializer if it is
	non-dependent.
	* pt.c (tsubst_copy_and_build): Handle NOP_EXPRs.
	
	PR c++/14409
	* g++.dg/template/spec12.C: New test.
	
	PR c++/14448
	* g++.dg/parse/crash14.C: New test.

Patches:
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/cp/ChangeLog.diff?cvsroot=gcc&only_with_tag=gcc-3_4-branch&r1=1.3892.2.75&r2=1.3892.2.76
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/cp/parser.c.diff?cvsroot=gcc&only_with_tag=gcc-3_4-branch&r1=1.157.2.19&r2=1.157.2.20
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/cp/pt.c.diff?cvsroot=gcc&only_with_tag=gcc-3_4-branch&r1=1.816.2.17&r2=1.816.2.18
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/ChangeLog.diff?cvsroot=gcc&only_with_tag=gcc-3_4-branch&r1=1.3389.2.134&r2=1.3389.2.135
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/g++.dg/template/spec12.C.diff?cvsroot=gcc&only_with_tag=gcc-3_4-branch&r1=NONE&r2=1.1.2.1
http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/testsuite/g++.dg/parse/crash14.C.diff?cvsroot=gcc&only_with_tag=gcc-3_4-branch&r1=NONE&r2=1.1.2.1



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448

[Bug c++/14448] [3.4/3.5 regression] Segfault in Boost indexed_set

[giovannibajo at libero dot it]

------- Additional Comments From giovannibajo at libero dot it  2004-03-09 15:42 -------
Fixed in GCC 3.4.0 and GCC 3.5.0.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14448