[Bug c++/45894] New: ICE: segmentation fault with -Wall

[Bug c++/45894] New: ICE: segmentation fault with -Wall

[gcc at abeckmann dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

           Summary: ICE: segmentation fault with -Wall
           Product: gcc
           Version: 4.5.2
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: gcc@abeckmann.de


I get an "internal compiler error: Segmentation fault" when compiling this code
with 4.5.2/4.6.0 and -Wall. The problem disappears if I remove -Wall.
4.4.5 and 4.3.x report "error: statement cannot resolve address of overloaded
function"

========== 8< ===========
struct FOO
{
        template < typename = void >
        void Bar () ;
} ;
template < typename = void >
struct V
{
        V ( const V &)
        {
                FOO :: Bar < > ;
        }
} ;
struct C
{
        V < > v ;
} ;
struct B
{
        C f () ;
} ;
struct A
{
        C c ;
        B b ;
        A () : c ( b . f () )
        { }
} ;
========== >8 ===========

$ g++-4.5.x -v -std=c++0x -Wall -c segfault-ice.min.cpp
Using built-in specs.
COLLECT_GCC=/opt/software/x86_64/gcc-4.5.x/bin/g++-4.5.x
COLLECT_LTO_WRAPPER=/opt/software/x86_64/gcc-4.5.x/libexec/gcc/x86_64-unknown-linux-gnu/4.5.2/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-4_5-branch/configure
--prefix=/opt/software/x86_64/gcc-4.5.x --program-suffix=-4.5.x
--enable-languages=c,c++ --enable-checking
Thread model: posix
gcc version 4.5.2 20101004 (prerelease) (GCC)
COLLECT_GCC_OPTIONS='-v' '-std=c++0x' '-Wall' '-c' '-shared-libgcc'
'-mtune=generic' '-march=x86-64'

/opt/software/x86_64/gcc-4.5.x/libexec/gcc/x86_64-unknown-linux-gnu/4.5.2/cc1plus
-quiet -v -D_GNU_SOURCE segfault-ice.min.cpp -quiet -dumpbase
segfault-ice.min.cpp -mtune=generic -march=x86-64 -auxbase segfault-ice.min
-Wall -std=c++0x -version -o /tmp/cco6qHiQ.s
GNU C++ (GCC) version 4.5.2 20101004 (prerelease) (x86_64-unknown-linux-gnu)
        compiled by GNU C version 4.5.2 20101004 (prerelease), GMP version
4.3.2, MPFR version 3.0.0-p3, MPC version 0.8.2
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
ignoring nonexistent directory
"/opt/software/x86_64/gcc-4.5.x/lib/gcc/x86_64-unknown-linux-gnu/4.5.2/../../../../x86_64-unknown-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:

/opt/software/x86_64/gcc-4.5.x/lib/gcc/x86_64-unknown-linux-gnu/4.5.2/../../../../include/c++/4.5.2

/opt/software/x86_64/gcc-4.5.x/lib/gcc/x86_64-unknown-linux-gnu/4.5.2/../../../../include/c++/4.5.2/x86_64-unknown-linux-gnu

/opt/software/x86_64/gcc-4.5.x/lib/gcc/x86_64-unknown-linux-gnu/4.5.2/../../../../include/c++/4.5.2/backward
 /usr/local/include
 /opt/software/x86_64/gcc-4.5.x/include
 /opt/software/x86_64/gcc-4.5.x/lib/gcc/x86_64-unknown-linux-gnu/4.5.2/include

/opt/software/x86_64/gcc-4.5.x/lib/gcc/x86_64-unknown-linux-gnu/4.5.2/include-fixed
 /usr/include
End of search list.
GNU C++ (GCC) version 4.5.2 20101004 (prerelease) (x86_64-unknown-linux-gnu)
        compiled by GNU C version 4.5.2 20101004 (prerelease), GMP version
4.3.2, MPFR version 3.0.0-p3, MPC version 0.8.2
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
Compiler executable checksum: 8c3e00fe3cfb9293e6e3b31a6f7f6d80
segfault-ice.min.cpp: In copy constructor ‘V< <template-parameter-1-1>
>::V(const V< <template-parameter-1-1> >&)’:
segfault-ice.min.cpp:11:18: warning: statement is a reference, not call, to
function ‘FOO::Bar [with <template-parameter-1-1> = void]’
segfault-ice.min.cpp: In copy constructor ‘V< <template-parameter-1-1>
>::V(const V< <template-parameter-1-1> >&) [with <template-parameter-1-1> =
void, V< <template-parameter-1-1> > = V<>]’:
segfault-ice.min.cpp:15:1:   instantiated from here
segfault-ice.min.cpp:11:3: internal compiler error: Segmentation fault
Please submit a full bug report,

[Bug c++/45894] [4.5/4.6 Regression] [C++0x] ICE: segmentation fault with -Wall

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |error-recovery,
                   |                            |ice-on-invalid-code
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2010.10.05 13:08:41
            Summary|ICE: segmentation fault     |[4.5/4.6 Regression]
                   |with -Wall                  |[C++0x] ICE: segmentation
                   |                            |fault with -Wall
     Ever Confirmed|0                           |1

[Bug c++/45894] [4.5/4.6 Regression] [C++0x] ICE: segmentation fault with -Wall

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |paolo.carlini at oracle dot
                   |                            |com

--- Comment #1 from Paolo Carlini <paolo.carlini at oracle dot com> 2010-10-05 13:33:51 UTC ---
What about the no -Wall case? Is it also an accepts invalid?

[Bug c++/45894] [4.5/4.6 Regression] [C++0x] ICE: segmentation fault with -Wall

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|error-recovery,             |
                   |ice-on-invalid-code         |

--- Comment #2 from Jonathan Wakely <redi at gcc dot gnu.org> 2010-10-05 13:41:38 UTC ---
Good point, I'm not sure this is invalid, thanks Paolo.
I got confused by the fact it's rejected in 4.4, but I guess the change from an
error to a warning is probably intentional.  I've removed the keywords.

[Bug c++/45894] [4.5/4.6 Regression] [C++0x] ICE: segmentation fault with -Wall

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |manu at gcc dot gnu.org

--- Comment #3 from H.J. Lu <hjl.tools at gmail dot com> 2010-10-06 02:05:14 UTC ---
It is caused by revision 146472:

http://gcc.gnu.org/ml/gcc-cvs/2009-04/msg01112.html

[Bug c++/45894] [4.5/4.6 Regression] [C++0x] ICE: segmentation fault with -Wall

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.5.2

[Bug c++/45894] [4.5/4.6 Regression] [C++0x] ICE: segmentation fault with -Wall

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug c++/45894] [4.5/4.6 Regression] [C++0x] ICE: segmentation fault with -Wall

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dodji at gcc dot gnu.org,
                   |                            |jakub at gcc dot gnu.org,
                   |                            |jason at gcc dot gnu.org

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> 2010-11-05 12:50:15 UTC ---
Apparently lvalue_p is called on
 <baselink 0x7ffff1af4bd0
    type <lang_type 0x7ffff1accc78 unknown type type <lang_type 0x7ffff1accc78
unknown type>
        VOID
        align 1 symtab 0 alias set -1 canonical type 0x7ffff1accc78
        pointer_to_this <lang_type 0x7ffff1accc78 unknown type>
reference_to_this <lang_type 0x7ffff1accc78 unknown type>>

    functions <template_id_expr 0x7ffff7ffc188
        arg 0 <overload 0x7ffff1ae8720 type <lang_type 0x7ffff1accc78 unknown
type>
            function <template_decl 0x7ffff1aed228 bar>>>
    binfo <tree_binfo 0x7ffff1ae5360
        type <record_type 0x7ffff1add0a8 F type_5 type_6 QI
            size <integer_cst 0x7ffff1bdb4b0 constant 8>
            unit size <integer_cst 0x7ffff1bdb4d8 constant 1>
            align 8 symtab 0 alias set -1 canonical type 0x7ffff1add0a8 fields
<type_decl 0x7ffff1aed0b8 F> context <translation_unit_decl 0x7ffff1be7958 D.1>
            full-name "struct F"
            X() X(constX&) this=(X&) n_parents=0 use_template=0
interface-unknown
            pointer_to_this <pointer_type 0x7ffff1add498> chain <type_decl
0x7ffff1aed000 F>>
       > access_binfo <tree_binfo 0x7ffff1ae5360>>

which leads to lvalue_kind being called on the template_id_expr
(0x7ffff7ffc188 above) which has no type.

Can be fixed by making lvalue_kind more robust:
--- gcc/cp/tree.c.jj    2010-11-03 16:58:26.000000000 +0100
+++ gcc/cp/tree.c       2010-11-05 13:45:53.000000000 +0100
@@ -67,7 +67,8 @@ lvalue_kind (const_tree ref)
          == REFERENCE_TYPE)
     return lvalue_kind (TREE_OPERAND (ref, 0));

-  if (TREE_CODE (TREE_TYPE (ref)) == REFERENCE_TYPE)
+  if (TREE_TYPE (ref)
+      && TREE_CODE (TREE_TYPE (ref)) == REFERENCE_TYPE)
     {
       /* unnamed rvalue references are rvalues */
       if (TYPE_REF_IS_RVALUE (TREE_TYPE (ref))

but no idea whether that is the right thing to do.

[Bug c++/45894] [4.5/4.6 Regression] [C++0x] ICE: segmentation fault with -Wall

[dodji at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

--- Comment #5 from Dodji Seketeli <dodji at gcc dot gnu.org> 2010-11-08 14:27:46 UTC ---
I think the example is invalid in c++ 2003 as [temp.param/9] says that
a function template shall not have any default template argument. It's
valid in c++0x though as that rule has been relaxed.

FWIW, Trying the code with without -Wall and with c++0x is accepted by
current trunk. -Wall with -std=c++0x crashes it too. Without -Wall and
without -std=c++0x the code is rejected by trunk.

The crash happens while looking at the expression FOO::BAR<> because
we want to emit warnings about variables access in undefined
sequencing conditions. For that finish_expr_stmt passes the expression
FOO::Bar<> (represented as the BASELINK Jakub referred to), to
verify_sequence_points which at some point tries to see if the
TEMPLATE_ID_EXPR representing FOO::BAR<> is an lvalue. Then
lvalue_kind crashes because it doesn't expect a tree without a TYPE
[TEMPLATE_ID_EXPR doesn't have a type] as Jakub noted.

I think the fix looks correct (assuming it passes regtests), as it

1/robustifies lvalue_kind

2/makes it return clk_none and IMHO rightfully so as we can't say at
this point if the TEMPLATE_ID_EXPR (which is just a syntactic
representation) is an lvalue or not. To be able to decide on the
lvalueness we'd need something more typed at this point, I suppose.

[Bug c++/45894] [4.5/4.6 Regression] [C++0x] ICE: segmentation fault with -Wall

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> 2010-11-08 17:40:15 UTC ---
Created attachment 22331
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=22331
gcc46-pr45894.patch

Ok, I'll bootstrapp/regtest this then.

[Bug c++/45894] [4.5/4.6 Regression] [C++0x] ICE: segmentation fault with -Wall

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> 2010-11-09 11:53:05 UTC ---
Author: jakub
Date: Tue Nov  9 11:52:59 2010
New Revision: 166481

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=166481
Log:
    PR c++/45894
    * tree.c (lvalue_kind): Don't crash if ref has NULL type.

    * g++.dg/warn/Wsequence-point-2.C: New test.

Added:
    trunk/gcc/testsuite/g++.dg/warn/Wsequence-point-2.C
Modified:
    trunk/gcc/cp/ChangeLog
    trunk/gcc/cp/tree.c
    trunk/gcc/testsuite/ChangeLog

[Bug c++/45894] [4.5 Regression] [C++0x] ICE: segmentation fault with -Wall

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.6.0
            Summary|[4.5/4.6 Regression]        |[4.5 Regression] [C++0x]
                   |[C++0x] ICE: segmentation   |ICE: segmentation fault
                   |fault with -Wall            |with -Wall
      Known to fail|4.6.0                       |

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> 2010-11-09 11:56:21 UTC ---
Fixed on the trunk so far.

[Bug c++/45894] [4.5 Regression] [C++0x] ICE: segmentation fault with -Wall

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |jakub at gcc dot gnu.org
                   |gnu.org                     |

[Bug c++/45894] [4.5 Regression] [C++0x] ICE: segmentation fault with -Wall

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> 2010-11-11 20:41:36 UTC ---
Author: jakub
Date: Thu Nov 11 20:41:34 2010
New Revision: 166621

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=166621
Log:
    Backport from mainline
    2010-11-09  Jakub Jelinek  <jakub@redhat.com>

    PR c++/45894
    * tree.c (lvalue_p_1): Don't crash if ref has NULL type.

    * g++.dg/warn/Wsequence-point-2.C: New test.

Added:
    branches/gcc-4_5-branch/gcc/testsuite/g++.dg/warn/Wsequence-point-2.C
Modified:
    branches/gcc-4_5-branch/gcc/cp/ChangeLog
    branches/gcc-4_5-branch/gcc/cp/tree.c
    branches/gcc-4_5-branch/gcc/testsuite/ChangeLog

[Bug c++/45894] [4.5 Regression] [C++0x] ICE: segmentation fault with -Wall

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> 2010-11-11 22:13:52 UTC ---
Fixed.

[Bug c++/45894] [4.5 Regression] [C++0x] ICE: segmentation fault with -Wall

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

Jonathan Wakely <redi at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |maxim.yegorushkin at gmail
                   |                            |dot com

--- Comment #11 from Jonathan Wakely <redi at gcc dot gnu.org> 2011-02-02 16:08:14 UTC ---
*** Bug 47589 has been marked as a duplicate of this bug. ***

[Bug c++/45894] [4.5 Regression] [C++0x] ICE: segmentation fault with -Wall

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

--- Comment #12 from Jonathan Wakely <redi at gcc dot gnu.org> 2011-02-02 16:27:46 UTC ---
Although this bug has 4.4.5 in the "Known to work" field, the bug in cp/tree.c
is present on the 4.4 branch, and the testcase in PR 47589 causes an ICE with
4.4.5, without -Wall or -std=c++0x

The fix for cp/tree.c looks safe to backport to 4.4 - any objections to doing
so?

--- gcc/cp/tree.c.jj    2010-11-03 16:58:26.000000000 +0100
+++ gcc/cp/tree.c       2010-11-05 13:45:53.000000000 +0100
@@ -67,7 +67,8 @@ lvalue_kind (const_tree ref)
          == REFERENCE_TYPE)
     return lvalue_kind (TREE_OPERAND (ref, 0));

-  if (TREE_CODE (TREE_TYPE (ref)) == REFERENCE_TYPE)
+  if (TREE_TYPE (ref)
+      && TREE_CODE (TREE_TYPE (ref)) == REFERENCE_TYPE)
     {
       /* unnamed rvalue references are rvalues */
       if (TYPE_REF_IS_RVALUE (TREE_TYPE (ref))

[Bug c++/45894] [4.5 Regression] [C++0x] ICE: segmentation fault with -Wall

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

--- Comment #13 from Jonathan Wakely <redi at gcc dot gnu.org> 2011-02-02 17:08:14 UTC ---
... alternatively, I'll re-open PR 47589 as a separate non-C++0x bug on the 4.4
branch

here's a reduced testcase which makes 4.4.5 ICE, a regression since (at least)
4.1

typedef unsigned long long nsec_t;

class Engine { };

struct Fd
{
    typedef void(*Cb)(Engine*, Fd*, nsec_t);

    Fd(Cb cb);
};


namespace detail {

struct Cb
{
    template<class EventTag, class Derived> static void fd(Engine*, Fd*,
nsec_t);
};

}

template<class EventTag, class Derived>
struct TaggedFd : Fd
{
    TaggedFd()
        : Fd(detail::Cb::fd<EventTag, Derived>)
    {}
};


struct FdTag {};

struct DemuxTestClient
    : TaggedFd<FdTag, DemuxTestClient>
{
    DemuxTestClient() { }
};

$ ~/tools/Linux-x86_64/44/bin/g++ max.cc
max.cc: In constructor 'TaggedFd<EventTag, Derived>::TaggedFd() [with EventTag
= FdTag, Derived = DemuxTestClient]':
max.cc:37:   instantiated from here
max.cc:27: internal compiler error: Segmentation fault

[Bug c++/45894] [4.5 Regression] [C++0x] ICE: segmentation fault with -Wall

[redi at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45894

--- Comment #14 from Jonathan Wakely <redi at gcc dot gnu.org> 2011-02-03 22:34:58 UTC ---
Author: redi
Date: Thu Feb  3 22:34:51 2011
New Revision: 169813

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=169813
Log:
2011-02-03  Jonathan Wakely  <jwakely.gcc@gmail.com>

    PR c++/47589
    Backport from mainline
    2010-11-09  Jakub Jelinek  <jakub@redhat.com>

    PR c++/45894
    * tree.c (lvalue_kind): Don't crash if ref has NULL type.


Added:
    branches/gcc-4_4-branch/gcc/testsuite/g++.dg/pr47589.C
Modified:
    branches/gcc-4_4-branch/gcc/cp/ChangeLog
    branches/gcc-4_4-branch/gcc/cp/tree.c
    branches/gcc-4_4-branch/gcc/testsuite/ChangeLog