[Bug c++/103706] New: [11/12 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[Bug c++/103706] New: [11/12 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

            Bug ID: 103706
           Summary: [11/12 Regression] ICE: tree check: accessed elt 1 of
                    'tree_vec' with 0 elts in hash, at
                    cp/constraint.cc:2503
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

g++ 12.0.0 20211212 snapshot (g:0b52083ea2c2dd9897031fdc3802a68fd4aa45ef) ICEs
when compiling the following testcase, extracted from
test/SemaTemplate/concepts.cpp, w/ -std=c++20:

namespace PackInTypeConstraint {
  template<typename T, typename U> concept C = sizeof(T) == sizeof(int);

  template<typename ...T> void g5() {
    ([]() -> C<T> auto{
     return T();
     }(), ...);
  }
  template void g5<int, int, int>();
}

% g++-12.0.0 -std=c++20 -c gpb6lyci.cpp
gpb6lyci.cpp: In instantiation of 'void PackInTypeConstraint::g5() [with T =
{int, int, int}]':
gpb6lyci.cpp:9:35:   required from here
gpb6lyci.cpp:6:15: internal compiler error: tree check: accessed elt 1 of
'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503
    6 |      return T();
      |               ^
0x869dcd tree_vec_elt_check_failed(int, int, char const*, int, char const*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/tree.c:8903
0x996fa5 tree_vec_elt_check(tree_node*, int, char const*, int, char const*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/tree.h:3662
0x996fa5 sat_hasher::hash(sat_entry*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/constraint.cc:2503
0x992c43 hash_table<sat_hasher, false, xcallocator>::find_slot(sat_entry*
const&, insert_option)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/hash-table.h:435
0x992c43 satisfaction_cache::satisfaction_cache(tree_node*, tree_node*,
sat_info)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/constraint.cc:2597
0x995e2e satisfy_atom
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/constraint.cc:2913
0x995e2e satisfy_constraint_r
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/constraint.cc:3022
0x9966d3 satisfy_normalized_constraints
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/constraint.cc:3047
0x99437f satisfy_nondeclaration_constraints
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/constraint.cc:3137
0x99437f constraint_satisfaction_value
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/constraint.cc:3289
0x996794 constraints_satisfied_p(tree_node*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/constraint.cc:3321
0xb10490 do_auto_deduction(tree_node*, tree_node*, tree_node*, int,
auto_deduction_context, tree_node*, int)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/pt.c:30019
0xbbcd18 check_return_expr(tree_node*, bool*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/typeck.c:10423
0xb64f7f finish_return_stmt(tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/semantics.c:1193
0xb2bdd8 tsubst_expr(tree_node*, tree_node*, int, tree_node*, bool)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/pt.c:18235
0xb2bd7b tsubst_expr(tree_node*, tree_node*, int, tree_node*, bool)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/pt.c:18582
0xb419e6 tsubst_expr(tree_node*, tree_node*, int, tree_node*, bool)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/pt.c:18211
0xb419e6 tsubst_lambda_expr(tree_node*, tree_node*, int, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/pt.c:19583
0xb17eb2 tsubst_copy_and_build(tree_node*, tree_node*, int, tree_node*, bool,
bool)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/pt.c:21074
0xb1638a tsubst_copy_and_build(tree_node*, tree_node*, int, tree_node*, bool,
bool)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211212/work/gcc-12-20211212/gcc/cp/pt.c:20412

[Bug c++/103706] [11/12 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-12-14

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Reduced testcase:
template<typename T, typename U> concept C = sizeof(T) == 0;

template<typename T> void g5() {
[]() -> C<T> auto{ return T();  }();
}
template void g5<int>();

[Bug c++/103706] [11/12 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

--- Comment #2 from Arseny Solokha <asolokha at gmx dot com> ---
So it's a duplicate of PR99811.

[Bug c++/103706] [11/12 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Arseny Solokha from comment #2)
> So it's a duplicate of PR99811.

it is a dup of bug 103341.

[Bug c++/103706] [11/12 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |DUPLICATE

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Dup of bug 103341.

*** This bug has been marked as a duplicate of bug 103341 ***

[Bug c++/103706] [11/12 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

Patrick Palka <ppalka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ppalka at gcc dot gnu.org
      Known to work|                            |10.3.0
         Resolution|DUPLICATE                   |---
             Status|RESOLVED                    |NEW
      Known to fail|                            |11.2.0, 12.0

--- Comment #5 from Patrick Palka <ppalka at gcc dot gnu.org> ---
Reopening since this PR is concerning constrained lambdas and PR103341 is about
constrained variable templates, and we still ICE on the testcase here even
after r12-6919.

Started with r11-7454.

[Bug c++/103706] [11/12 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

Patrick Palka <ppalka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.3

[Bug c++/103706] [11/12 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Patrick Palka <ppalka@gcc.gnu.org>:

https://gcc.gnu.org/g:34ba3d9a2bf72742b1c150a2dd17d10e3e3f0964

commit r12-7101-g34ba3d9a2bf72742b1c150a2dd17d10e3e3f0964
Author: Patrick Palka <ppalka@redhat.com>
Date:   Tue Feb 8 08:46:13 2022 -0500

    c++: constrained auto in lambda using outer tparms [PR103706]

    Here we're crashing during satisfaction of the lambda's placeholder type
    constraints because the constraints depend on the template arguments
    from the enclosing scope, which aren't part of the lambda's DECL_TI_ARGS.

    This patch fixes this by making do_auto_deduction consider the
    "regenerating" template arguments of a lambda for satisfaction,
    mirroring what's done in satisfy_declaration_constraints.

            PR c++/103706

    gcc/cp/ChangeLog:

            * constraint.cc (satisfy_declaration_constraints): Use
            lambda_regenerating_args instead.
            * cp-tree.h (lambda_regenerating_args): Declare.
            * pt.cc (lambda_regenerating_args): Define, split out from
            satisfy_declaration_constraints.
            (do_auto_deduction): Use lambda_regenerating_args to obtain the
            full set of outer template arguments for satisfaction when
            inside a lambda.

    gcc/testsuite/ChangeLog:

            * g++.dg/cpp2a/concepts-lambda18.C: New test.

[Bug c++/103706] [11/12 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Patrick Palka <ppalka@gcc.gnu.org>:

https://gcc.gnu.org/g:db5f1c17031ad8a898d77121f1e0e0141306e22a

commit r12-7102-gdb5f1c17031ad8a898d77121f1e0e0141306e22a
Author: Patrick Palka <ppalka@redhat.com>
Date:   Tue Feb 8 08:46:32 2022 -0500

    c++: lambda in pack expansion using pack in constraint [PR103706]

    Here when expanding the pack expansion pattern containing a constrained
    lambda, the template argument for each Ts is an ARGUMENT_PACK_SELECT,
    which we store inside the lambda's LAMBDA_EXPR_REGEN_INFO.  Then during
    satisfaction of the lambda's constraint C<Ts> the satisfaction cache
    uses this argument as part of the key to the corresponding sat_entry, but
    iterative_hash_template_arg and template_args_equal deliberately don't
    handle ARGUMENT_PACK_SELECT.

    Since it's wrong to preserve ARGUMENT_PACK_SELECT inside a hash table
    due to its instability (as documented in iterative_hash_template_arg),
    this patch helps make sure the satisfaction cache doesn't see such trees
    by resolving ARGUMENT_PACK_SELECT arguments before adding them to
    LAMBDA_EXPR_REGEN_INFO.

            PR c++/103706

    gcc/cp/ChangeLog:

            * pt.cc (preserve_args): New function.
            (tsubst_lambda_expr): Use it when setting LAMBDA_EXPR_REGEN_INFO.

    gcc/testsuite/ChangeLog:

            * g++.dg/cpp2a/concepts-lambda19.C: New test.

[Bug c++/103706] [11 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

Patrick Palka <ppalka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[11/12 Regression] ICE:     |[11 Regression] ICE: tree
                   |tree check: accessed elt 1  |check: accessed elt 1 of
                   |of 'tree_vec' with 0 elts   |'tree_vec' with 0 elts in
                   |in hash, at                 |hash, at
                   |cp/constraint.cc:2503       |cp/constraint.cc:2503

--- Comment #8 from Patrick Palka <ppalka at gcc dot gnu.org> ---
Fixed for GCC 12 so far.

[Bug c++/103706] [11 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

Patrick Palka <ppalka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |ppalka at gcc dot gnu.org

[Bug c++/103706] [11 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Patrick Palka
<ppalka@gcc.gnu.org>:

https://gcc.gnu.org/g:d3950a70da6814206eef1946c289b5652ecc9986

commit r11-9838-gd3950a70da6814206eef1946c289b5652ecc9986
Author: Patrick Palka <ppalka@redhat.com>
Date:   Tue Feb 8 08:46:32 2022 -0500

    c++: lambda in pack expansion using pack in constraint [PR103706]

    Here when expanding the pack expansion pattern containing a constrained
    lambda, the template argument for each Ts is an ARGUMENT_PACK_SELECT,
    which we store inside the lambda's LAMBDA_EXPR_REGEN_INFO.  Then during
    satisfaction of the lambda's constraint C<Ts> the satisfaction cache
    uses this argument as part of the key to the corresponding sat_entry, but
    iterative_hash_template_arg and template_args_equal deliberately don't
    handle ARGUMENT_PACK_SELECT.

    Since it's wrong to preserve ARGUMENT_PACK_SELECT inside a hash table
    due to its instability (as documented in iterative_hash_template_arg),
    this patch helps make sure the satisfaction cache doesn't see such trees
    by resolving ARGUMENT_PACK_SELECT arguments before adding them to
    LAMBDA_EXPR_REGEN_INFO.

            PR c++/103706

    gcc/cp/ChangeLog:

            * pt.c (preserve_args): New function.
            (tsubst_lambda_expr): Use it when setting LAMBDA_EXPR_REGEN_INFO.

    gcc/testsuite/ChangeLog:

            * g++.dg/cpp2a/concepts-lambda19.C: New test.

    (cherry picked from commit db5f1c17031ad8a898d77121f1e0e0141306e22a)

[Bug c++/103706] [11 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Patrick Palka
<ppalka@gcc.gnu.org>:

https://gcc.gnu.org/g:6eb8eb51a827a349cd6acce5f16ffef31d8934b1

commit r11-9842-g6eb8eb51a827a349cd6acce5f16ffef31d8934b1
Author: Patrick Palka <ppalka@redhat.com>
Date:   Tue Feb 8 08:46:13 2022 -0500

    c++: constrained auto in lambda using outer tparms [PR103706]

    Here we're crashing during satisfaction of the lambda's placeholder type
    constraints because the constraints depend on the template arguments
    from the enclosing scope, which aren't part of the lambda's DECL_TI_ARGS.

    This patch fixes this by making do_auto_deduction consider the
    "regenerating" template arguments of a lambda for satisfaction,
    mirroring what's done in satisfy_declaration_constraints.

            PR c++/103706

    gcc/cp/ChangeLog:

            * constraint.cc (satisfy_declaration_constraints): Use
            lambda_regenerating_args instead.
            * cp-tree.h (lambda_regenerating_args): Declare.
            * pt.c (lambda_regenerating_args): Define, split out from
            satisfy_declaration_constraints.
            (do_auto_deduction): Use lambda_regenerating_args to obtain the
            full set of outer template arguments for satisfaction when
            inside a lambda.

    gcc/testsuite/ChangeLog:

            * g++.dg/cpp2a/concepts-lambda18.C: New test.

    (cherry picked from commit 34ba3d9a2bf72742b1c150a2dd17d10e3e3f0964)

[Bug c++/103706] [11 Regression] ICE: tree check: accessed elt 1 of 'tree_vec' with 0 elts in hash, at cp/constraint.cc:2503

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103706

Patrick Palka <ppalka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #11 from Patrick Palka <ppalka at gcc dot gnu.org> ---
Fixed for GCC 11.3/12.