[Bug c++/108998] New: ICE in tsubst, at cp/pt.cc:16037

[Bug c++/108998] New: ICE in tsubst, at cp/pt.cc:16037

[waffl3x at protonmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108998

            Bug ID: 108998
           Summary: ICE in tsubst, at cp/pt.cc:16037
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: waffl3x at protonmail dot com
  Target Milestone: ---

Created attachment 54573
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54573&action=edit
the output of -v on godbolt at the time of posting this report

template<int L, typename T>
inline constexpr bool templ = false;

template<typename T>
void ice(T a)
{
    auto aa = a;
    auto lambda = []<int I>(){
        if constexpr (templ<I, decltype(aa)>) {}
    };
    lambda.template operator()<0>();
}

void go() {
    ice(0);
}

https://godbolt.org/z/4qn9s6cad

The conditions for this were rather complicated, this was as far as I could
reduce it. Some things to note,
it does not trigger when the lambda's template parameter is a type parameter,
it does not trigger with an auto function parameter,
it does not trigger outside of if constexpr,
and it does not trigger when the first argument to templ is not a lambda's
template parameter.
I couldn't find a way to trigger it without a lambda's non type template
parameter.

<source>: In instantiation of 'ice<int>(int)::<lambda()> [with int I = 0]':
<source>:11:34:   required from 'void ice(T) [with T = int]'
<source>:15:8:   required from here
<source>:7:10: internal compiler error: in tsubst, at cp/pt.cc:16037
    7 |     auto aa = a;
      |          ^~
0x247996e internal_error(char const*, ...)
        ???:0
0xae93fe fancy_abort(char const*, int, char const*)
        ???:0
0xd11fdd tsubst(tree_node*, tree_node*, int, tree_node*)
        ???:0
0xd13f4d tsubst_template_args(tree_node*, tree_node*, int, tree_node*)
        ???:0
0xd09c65 instantiate_decl(tree_node*, bool, bool)
        ???:0
0xbdf731 maybe_instantiate_decl(tree_node*)
        ???:0
0xbe11be mark_used(tree_node*, int)
        ???:0
0xb16f0e build_new_method_call(tree_node*, tree_node*, vec<tree_node*, va_gc,
vl_embed>**, tree_node*, int, tree_node**, int)
        ???:0
0xd09c65 instantiate_decl(tree_node*, bool, bool)
        ???:0
0xd35ffb instantiate_pending_templates(int)
        ???:0
0xbe4325 c_parse_final_cleanups()
        ???:0
0xe215f8 c_common_parse_file()
        ???:0

[Bug c++/108998] ICE in tsubst, at cp/pt.cc:16037

[waffl3x at protonmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108998

--- Comment #1 from waffl3x <waffl3x at protonmail dot com> ---
I ran it on my local system, just to get some line numbers, and I accidentally
ran it on an older version (12.1) and found that it has a similar result, I'm
posting the output of -v and the error of both here. As a reminder, gcc 12.2 on
godbolt does not ICE.

[waffl3x@waffl3x-manjaro-desktop gcc]$ /opt/compiler/bin/g++ -v
Using built-in specs.
COLLECT_GCC=/opt/compiler/bin/g++
COLLECT_LTO_WRAPPER=/opt/compiler/libexec/gcc/x86_64-pc-linux-gnu/13.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-13-20230115/configure --enable-languages=c,c++,lto
--enable-bootstrap --prefix=/opt/compiler --mandir=/usr/share/man
--infodir=/usr/share/info --with-linker-hash-style=gnu --enable-__cxa_atexit
--enable-cet=auto --enable-checking=release --enable-default-pie
--enable-default-ssp --enable-gnu-indirect-function --enable-gnu-unique-object
--enable-link-serialization=1 --enable-linker-build-id --enable-lto
--enable-plugin --enable-shared --enable-threads=posix --disable-libssp
--disable-werror --enable-clocale=gnu --enable-libstdcxx-backtrace
--enable-multilib --disable-libstdcxx-pch --with-build-config=bootstrap-lto
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 13.0.0 20230115 (experimental) (GCC) 

[waffl3x@waffl3x-manjaro-desktop gcc]$ /opt/compiler/bin/g++ test.cpp
test.cpp: In instantiation of ‘ice<int>(int)::<lambda()> [with int I = 0]’:
test.cpp:11:34:   required from ‘void ice(T) [with T = int]’
test.cpp:15:8:   required from here
test.cpp:7:10: internal compiler error: in tsubst, at cp/pt.cc:16025
    7 |     auto aa = a;
      |          ^~
0x635279 tsubst(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:16025
0x8278de tsubst_decl
        ../../gcc-13-20230115/gcc/cp/pt.cc:15194
0x8302c8 tsubst_copy
        ../../gcc-13-20230115/gcc/cp/pt.cc:17267
0x8200fc tsubst_copy_and_build(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:21530
0x8248c8 tsubst(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:16547
0x829de5 tsubst_template_args(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:13659
0x821322 tsubst_copy_and_build(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:20299
0x80d340 tsubst_expr(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:19764
0x80e512 tsubst_expr(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:18711
0x80e512 tsubst_expr(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:19041
0x80eb23 tsubst_expr(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:18711
0x80eb23 tsubst_expr(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:19105
0x80eb23 tsubst_expr(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:18711
0x80eb23 tsubst_expr(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:19105
0x80d0d9 tsubst_expr(tree_node*, tree_node*, int, tree_node*)
        ../../gcc-13-20230115/gcc/cp/pt.cc:26702
0x80d0d9 instantiate_body
        ../../gcc-13-20230115/gcc/cp/pt.cc:26702
0x81219d instantiate_decl(tree_node*, bool, bool)
        ../../gcc-13-20230115/gcc/cp/pt.cc:26992
0x6ffcb3 maybe_instantiate_decl(tree_node*)
        ../../gcc-13-20230115/gcc/cp/decl2.cc:5448
0x6ffcb3 maybe_instantiate_decl(tree_node*)
        ../../gcc-13-20230115/gcc/cp/decl2.cc:5435
0x718092 mark_used(tree_node*, int)
        ../../gcc-13-20230115/gcc/cp/decl2.cc:5747

[waffl3x@waffl3x-manjaro-desktop gcc]$ g++ -v
Using built-in specs.
COLLECT_GCC=g++
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-pc-linux-gnu/12.2.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /build/gcc/src/gcc/configure
--enable-languages=c,c++,ada,fortran,go,lto,objc,obj-c++,d --enable-bootstrap
--prefix=/usr --libdir=/usr/lib --libexecdir=/usr/lib --mandir=/usr/share/man
--infodir=/usr/share/info --with-bugurl=https://bugs.archlinux.org/
--with-build-config=bootstrap-lto --with-linker-hash-style=gnu
--with-system-zlib --enable-__cxa_atexit --enable-cet=auto
--enable-checking=release --enable-clocale=gnu --enable-default-pie
--enable-default-ssp --enable-gnu-indirect-function --enable-gnu-unique-object
--enable-libstdcxx-backtrace --enable-link-serialization=1
--enable-linker-build-id --enable-lto --enable-multilib --enable-plugin
--enable-shared --enable-threads=posix --disable-libssp --disable-libstdcxx-pch
--disable-werror
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 12.2.1 20230111 (GCC) 

[waffl3x@waffl3x-manjaro-desktop gcc]$ g++ test.cpp
test.cpp: In instantiation of ‘ice<int>(int)::<lambda()> [with int I = 0]’:
test.cpp:11:34:   required from ‘void ice(T) [with T = int]’
test.cpp:15:8:   required from here
test.cpp:7:10: internal compiler error: in tsubst, at cp/pt.cc:15869
    7 |     auto aa = a;
      |          ^~
0x19e2ee8 internal_error(char const*, ...)
        ???:0
0x65443c fancy_abort(char const*, int, char const*)
        ???:0
0x7e0672 tsubst_copy_and_build(tree_node*, tree_node*, int, tree_node*, bool,
bool)
        ???:0
0x7e4429 tsubst(tree_node*, tree_node*, int, tree_node*)
        ???:0
0x7ed512 tsubst_template_args(tree_node*, tree_node*, int, tree_node*)
        ???:0
0x7e1ab6 tsubst_copy_and_build(tree_node*, tree_node*, int, tree_node*, bool,
bool)
        ???:0
0x7db493 instantiate_decl(tree_node*, bool, bool)
        ???:0
0x6eddcb mark_used(tree_node*, int)
        ???:0
0x67f26f build_new_method_call(tree_node*, tree_node*, vec<tree_node*, va_gc,
vl_embed>**, tree_node*, int, tree_node**, int)
        ???:0
0x7e37bd tsubst_copy_and_build(tree_node*, tree_node*, int, tree_node*, bool,
bool)
        ???:0
0x7db493 instantiate_decl(tree_node*, bool, bool)
        ???:0
0x7f9a73 instantiate_pending_templates(int)
        ???:0
0x6fe618 c_parse_final_cleanups()
        ???:0

[Bug c++/108998] [13 Regression] ICE in tsubst, at cp/pt.cc:16037

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108998

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0
                 CC|                            |mpolacek at gcc dot gnu.org,
                   |                            |ppalka at gcc dot gnu.org
           Priority|P3                          |P1
     Ever confirmed|0                           |1
            Summary|ICE in tsubst, at           |[13 Regression] ICE in
                   |cp/pt.cc:16037              |tsubst, at cp/pt.cc:16037
             Status|UNCONFIRMED                 |NEW
           Keywords|                            |ice-on-valid-code
   Last reconfirmed|                            |2023-03-03

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Started with r13-4730:

commit 18499b9f848707aee42d810e99ac0a4c9788433c
Author: Patrick Palka <ppalka@redhat.com>
Date:   Thu Dec 15 16:02:05 2022 -0500

    c++: extract_local_specs and unevaluated contexts [PR100295]

[Bug c++/108998] [13 Regression] ICE in tsubst, at cp/pt.cc:16037

[waffl3x at protonmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108998

--- Comment #3 from waffl3x <waffl3x at protonmail dot com> ---
I made a mistake in my previous comment, the version on my system that fails is
12.2.1, sorry for any possible confusion.

[Bug c++/108998] [13 Regression] ICE in tsubst, at cp/pt.cc:16037

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108998

Patrick Palka <ppalka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |ppalka at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

[Bug c++/108998] [12/13 Regression] ICE in tsubst, at cp/pt.cc:16037

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108998

Patrick Palka <ppalka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13 Regression] ICE in      |[12/13 Regression] ICE in
                   |tsubst, at cp/pt.cc:16037   |tsubst, at cp/pt.cc:16037
      Known to work|                            |12.2.0
      Known to fail|                            |12.2.1, 13.0
   Target Milestone|13.0                        |12.3

--- Comment #4 from Patrick Palka <ppalka at gcc dot gnu.org> ---
(In reply to waffl3x from comment #3)
> I made a mistake in my previous comment, the version on my system that fails
> is 12.2.1, sorry for any possible confusion.
Thus marking this a regression on the 12 branch as well

[Bug c++/108998] [12/13 Regression] ICE in tsubst, at cp/pt.cc:16037

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108998

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Patrick Palka <ppalka@gcc.gnu.org>:

https://gcc.gnu.org/g:341e6cd8d603a334fd34657a6b454176be1c6437

commit r13-6452-g341e6cd8d603a334fd34657a6b454176be1c6437
Author: Patrick Palka <ppalka@redhat.com>
Date:   Fri Mar 3 11:37:02 2023 -0500

    c++: thinko in extract_local_specs [PR108998]

    In order to fix PR100295, r13-4730-g18499b9f848707 attempted to make
    extract_local_specs walk the given pattern twice, ignoring unevaluated
    operands the first time around so that we prefer to process a local
    specialization in an evaluated context if it appears in one (we process
    each local specialization once even if it appears multiple times in the
    pattern).

    But there's a thinko in the patch, namely that we don't actually walk
    the pattern twice since we don't clear the visited set for the second
    walk (to avoid processing a local specialization twice) and so the root
    node (and any node leading up to an unevaluated operand) is considered
    visited already.  So the patch effectively made extract_local_specs
    ignore unevaluated operands altogether, which this testcase demonstrates
    isn't quite safe (extract_local_specs never sees 'aa' and we don't record
    its local specialization, so later we try to specialize 'aa' on the spot
    with the args {{int},{17}} which causes us to nonsensically substitute
    its auto with 17.)

    This patch fixes this by refining the second walk to start from the
    trees we skipped over during the first walk.

            PR c++/108998

    gcc/cp/ChangeLog:

            * pt.cc (el_data::skipped_trees): New data member.
            (extract_locals_r): Push to skipped_trees any unevaluated
            contexts that we skipped over.
            (extract_local_specs): For the second walk, start from each
            tree in skipped_trees.

    gcc/testsuite/ChangeLog:

            * g++.dg/cpp2a/lambda-generic11.C: New test.

[Bug c++/108998] [12 Regression] ICE in tsubst, at cp/pt.cc:16037

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108998

Patrick Palka <ppalka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13 Regression] ICE in   |[12 Regression] ICE in
                   |tsubst, at cp/pt.cc:16037   |tsubst, at cp/pt.cc:16037

--- Comment #6 from Patrick Palka <ppalka at gcc dot gnu.org> ---
Fixed for GCC 13 so far

[Bug c++/108998] [12 Regression] ICE in tsubst, at cp/pt.cc:16037

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108998

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Patrick Palka
<ppalka@gcc.gnu.org>:

https://gcc.gnu.org/g:c0edd2060dbc5aad0bae3ef4d68c8e85f26d0062

commit r12-9231-gc0edd2060dbc5aad0bae3ef4d68c8e85f26d0062
Author: Patrick Palka <ppalka@redhat.com>
Date:   Fri Mar 3 11:37:02 2023 -0500

    c++: thinko in extract_local_specs [PR108998]

    In order to fix PR100295, r13-4730-g18499b9f848707 attempted to make
    extract_local_specs walk the given pattern twice, ignoring unevaluated
    operands the first time around so that we prefer to process a local
    specialization in an evaluated context if it appears in one (we process
    each local specialization once even if it appears multiple times in the
    pattern).

    But there's a thinko in the patch, namely that we don't actually walk
    the pattern twice since we don't clear the visited set for the second
    walk (to avoid processing a local specialization twice) and so the root
    node (and any node leading up to an unevaluated operand) is considered
    visited already.  So the patch effectively made extract_local_specs
    ignore unevaluated operands altogether, which this testcase demonstrates
    isn't quite safe (extract_local_specs never sees 'aa' and we don't record
    its local specialization, so later we try to specialize 'aa' on the spot
    with the args {{int},{17}} which causes us to nonsensically substitute
    its auto with 17.)

    This patch fixes this by refining the second walk to start from the
    trees we skipped over during the first walk.

            PR c++/108998

    gcc/cp/ChangeLog:

            * pt.cc (el_data::skipped_trees): New data member.
            (extract_locals_r): Push to skipped_trees any unevaluated
            contexts that we skipped over.
            (extract_local_specs): For the second walk, start from each
            tree in skipped_trees.

    gcc/testsuite/ChangeLog:

            * g++.dg/cpp2a/lambda-generic11.C: New test.

    (cherry picked from commit 341e6cd8d603a334fd34657a6b454176be1c6437)

[Bug c++/108998] [12 Regression] ICE in tsubst, at cp/pt.cc:16037

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108998

Patrick Palka <ppalka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Patrick Palka <ppalka at gcc dot gnu.org> ---
Fixed on trunk and the 12 branch, thanks for the detailed bug report and
reproducer.

[Bug c++/108998] [12 Regression] ICE in tsubst, at cp/pt.cc:16037

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108998

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Patrick Palka
<ppalka@gcc.gnu.org>:

https://gcc.gnu.org/g:143179f27ebe6707d833802aaf4efb5d30a55001

commit r11-10805-g143179f27ebe6707d833802aaf4efb5d30a55001
Author: Patrick Palka <ppalka@redhat.com>
Date:   Fri Mar 3 11:37:02 2023 -0500

    c++: thinko in extract_local_specs [PR108998]

    In order to fix PR100295, r13-4730-g18499b9f848707 attempted to make
    extract_local_specs walk the given pattern twice, ignoring unevaluated
    operands the first time around so that we prefer to process a local
    specialization in an evaluated context if it appears in one (we process
    each local specialization once even if it appears multiple times in the
    pattern).

    But there's a thinko in the patch, namely that we don't actually walk
    the pattern twice since we don't clear the visited set for the second
    walk (to avoid processing a local specialization twice) and so the root
    node (and any node leading up to an unevaluated operand) is considered
    visited already.  So the patch effectively made extract_local_specs
    ignore unevaluated operands altogether, which this testcase demonstrates
    isn't quite safe (extract_local_specs never sees 'aa' and we don't record
    its local specialization, so later we try to specialize 'aa' on the spot
    with the args {{int},{17}} which causes us to nonsensically substitute
    its auto with 17.)

    This patch fixes this by refining the second walk to start from the
    trees we skipped over during the first walk.

            PR c++/108998

    gcc/cp/ChangeLog:

            * pt.c (el_data::skipped_trees): New data member.
            (extract_locals_r): Push to skipped_trees any unevaluated
            contexts that we skipped over.
            (extract_local_specs): For the second walk, start from each
            tree in skipped_trees.

    gcc/testsuite/ChangeLog:

            * g++.dg/cpp2a/lambda-generic11.C: New test.

    (cherry picked from commit 341e6cd8d603a334fd34657a6b454176be1c6437)