[Bug c++/47311] New: [C++0x] ICE in tsubst @cp/pt.c:10502

[Bug c++/47311] New: [C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

           Summary: [C++0x] ICE in tsubst @cp/pt.c:10502
           Product: gcc
           Version: 4.6.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: pluto@agmk.net


current gcc-trunk (r168844) ICEs on my codebase:

10484│     case BOUND_TEMPLATE_TEMPLATE_PARM:
10485│     case TEMPLATE_PARM_INDEX:
10486│       {
10487│         int idx;
10488│         int level;
10489│         int levels;
10490│         tree arg = NULL_TREE;
10491│
10492│         r = NULL_TREE;
10493│
10494│         gcc_assert (TREE_VEC_LENGTH (args) > 0);
10495│         template_parm_level_and_index (t, &level, &idx);
10496│
10497│         levels = TMPL_ARGS_DEPTH (args);
10498│         if (level <= levels)
10499│           {
10500│             arg = TMPL_ARG (args, level, idx);
10501│
10502├>            if (arg && TREE_CODE (arg) == ARGUMENT_PACK_SELECT)
10503│               /* See through ARGUMENT_PACK_SELECT arguments. */
10504│               arg = ARGUMENT_PACK_SELECT_ARG (arg);
10505│           }
10506│
10507│         if (arg == error_mark_node)
10508│           return error_mark_node;
10509│         else if (arg != NULL_TREE)
10510│           {
10511│             if (ARGUMENT_PACK_P (arg))
10512│               /* If ARG is an argument pack, we don't actually want to
10513│                  perform a substitution here, because substitutions
10514│                  for argument packs are only done
10515│                  element-by-element. We can get to this point when
10516│                  substituting the type of a non-type template
10517│                  parameter pack, when that type actually contains
10518│                  template parameter packs from an outer template, e.g.,
10519│
/home/users/pluto/alatek/toolchain/trunk/gcc-trunk/gcc/cp/pt.c

(gdb) r
Starting program:
/local/devel/toolchain46/x86_64-gnu-linux.host64/bin/x86_64-gnu-linux-g++ -c
-DHDL_EXPORTS -D_GNU_SOURCE -D_GLIBCXX_DEBUG -D_DEBUG -DBOOST_EXCEPTION_DISABLE
-pthread -Wall -Wno-uninitialized -Wno-deprecated -Wsign-compa
re -Wtype-limits -Woverloaded-virtual -Werror -mcld -fdwarf2-cfi-asm
-feliminate-unused-debug-types -march=x86-64 -O1 -gdwarf-4 -g2
-fno-strict-aliasing -fno-schedule-insns -fno-schedule-insns2 -std=gnu++0x
-fPIC -O2 -I./h -I./factories
-I./utils -I../VCM/h -I../def/h -I../hescore/h -isystem
../../buildenv/linux/gcc-4.6/64/boost-1.44.0/include -I../debugtools/h
-I../au/h -I../dp/h hdlVhdlArchitecture.cpp -o
obj-debug-x86_64-gnu-linux/hdlVhdlArchitecture.o
[New process 17639]
process 17639 is executing new program:
/local/devel/toolchain46/x86_64-gnu-linux.host64/lib64/gcc/x86_64-gnu-linux/4.6.0/cc1plus

Program received signal SIGSEGV, Segmentation fault.
[Switching to process 17639]
0x0000000000436c63 in tsubst (t=0x7ffff2fbfb28, args=0x7ffff2fbe540,
complain=0, in_decl=0x7ffff2fc18a0) at ../../gcc/cp/pt.c:10502
(gdb) bt
#0  0x0000000000436c63 in tsubst (t=0x7ffff2fbfb28, args=0x7ffff2fbe540,
complain=0, in_decl=0x7ffff2fc18a0) at ../../gcc/cp/pt.c:10502
#1  0x000000000044262c in fixup_template_parm (parm_desc=0x7ffff2fbaac8,
idx=<value optimized out>, num_parms=2, arglist=0x7ffff2fbe540) at
../../gcc/cp/pt.c:3879
#2  0x00000000004428f9 in fixup_template_parms (parms=<value optimized out>) at
../../gcc/cp/pt.c:3918
#3  end_template_parm_list (parms=<value optimized out>) at
../../gcc/cp/pt.c:3617
#4  0x0000000000477c38 in cp_parser_template_parameter_list
(parser=0x7ffff66ed420) at ../../gcc/cp/parser.c:11188
#5  0x0000000000477e0a in cp_parser_type_parameter (parser=0x7ffff66ed420,
is_parameter_pack=0x7fffffffd28f "") at ../../gcc/cp/parser.c:11445
#6  0x0000000000477bfb in cp_parser_template_parameter (parser=0x7ffff66ed420)
at ../../gcc/cp/parser.c:11250
#7  cp_parser_template_parameter_list (parser=0x7ffff66ed420) at
../../gcc/cp/parser.c:11164
#8  0x00000000004794a3 in cp_parser_template_declaration_after_export
(parser=0x7ffff66ed420, member_p=0 '\000') at ../../gcc/cp/parser.c:19932
#9  0x000000000047c84a in cp_parser_declaration (parser=0x7ffff66ed420) at
../../gcc/cp/parser.c:9453
#10 0x000000000047b915 in cp_parser_declaration_seq_opt (parser=0x7ffff66ed420)
at ../../gcc/cp/parser.c:9383
#11 0x000000000047bab9 in cp_parser_namespace_body (parser=0x7ffff66ed420) at
../../gcc/cp/parser.c:13930
#12 cp_parser_namespace_definition (parser=0x7ffff66ed420) at
../../gcc/cp/parser.c:13911
#13 0x000000000047c7f8 in cp_parser_declaration (parser=0x7ffff66ed420) at
../../gcc/cp/parser.c:9485
#14 0x000000000047b915 in cp_parser_declaration_seq_opt (parser=0x7ffff66ed420)
at ../../gcc/cp/parser.c:9383
#15 0x000000000047cb85 in cp_parser_translation_unit () at
../../gcc/cp/parser.c:3463
#16 c_parse_file () at ../../gcc/cp/parser.c:25278
#17 0x00000000004fda75 in c_common_parse_file () at
../../gcc/c-family/c-opts.c:1071
#18 0x0000000000727974 in compile_file (argc=62, argv=0x7fffffffd5f8) at
../../gcc/toplev.c:579
#19 do_compile (argc=62, argv=0x7fffffffd5f8) at ../../gcc/toplev.c:1874
#20 toplev_main (argc=62, argv=0x7fffffffd5f8) at ../../gcc/toplev.c:1937
#21 0x00007ffff7a8fcbd in __libc_start_main (main=0x50bdb0 <main>, argc=62,
ubp_av=0x7fffffffd5f8, init=<value optimized out>, fini=<value optimized out>,
rtld_fini=<value optimized out>, stack_end=0x7fffffffd5e8) at libc-start.c:226
#22 0x0000000000402889 in _start () at ../sysdeps/x86_64/elf/start.S:113


accidentally, the --save-temps (or -std=gnu++98) removes the ICE,
so how can i produce a preprocessed source for full bug report?

[Bug c++/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> 2011-01-15 22:53:46 UTC ---
(In reply to comment #0)
> current gcc-trunk (r168844) ICEs on my codebase:
> 
> accidentally, the --save-temps (or -std=gnu++98) removes the ICE,
> so how can i produce a preprocessed source for full bug report?

-E and -S.

H.J.

[Bug c++/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #2 from H.J. Lu <hjl.tools at gmail dot com> 2011-01-15 22:55:38 UTC ---
(In reply to comment #1)
> (In reply to comment #0)
> > current gcc-trunk (r168844) ICEs on my codebase:
> > 
> > accidentally, the --save-temps (or -std=gnu++98) removes the ICE,
> > so how can i produce a preprocessed source for full bug report?
> 
> -E and -S.
> 

Also use valgrind.

[Bug c++/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #3 from Pawel Sikora <pluto at agmk dot net> 2011-01-15 23:16:13 UTC ---
Created attachment 22976
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=22976
preprocessed source.

[Bug c++/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #4 from Pawel Sikora <pluto at agmk dot net> 2011-01-15 23:18:07 UTC ---
(In reply to comment #1)
> (In reply to comment #0)
> > current gcc-trunk (r168844) ICEs on my codebase:
> > 
> > accidentally, the --save-temps (or -std=gnu++98) removes the ICE,
> > so how can i produce a preprocessed source for full bug report?
> 
> -E and -S.
> 
> H.J.

ok,
with -E i can produce .ii from .cpp.
with -S i can produce .s from .ii.
the whole compilation (.s from .cpp) ICEs.

[Bug c++/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #5 from Pawel Sikora <pluto at agmk dot net> 2011-01-15 23:20:41 UTC ---
(In reply to comment #2)
> (In reply to comment #1)
> > (In reply to comment #0)
> > > current gcc-trunk (r168844) ICEs on my codebase:
> > > 
> > > accidentally, the --save-temps (or -std=gnu++98) removes the ICE,
> > > so how can i produce a preprocessed source for full bug report?
> > 
> > -E and -S.
> > 
> 
> Also use valgrind.

==28506==
==28507== Memcheck, a memory error detector
==28507== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==28507== Using Valgrind-3.6.0 and LibVEX; rerun with -h for copyright info
==28507== Command:
/local/devel/toolchain46/x86_64-gnu-linux.host64/lib64/gcc/x86_64-gnu-linux/4.6.0/cc1plus
-E -quiet -I ./h -I ./factories -I ./utils -I ../VCM/h -I ../def/h -I
../hescore/h -I ../debugtools/h -I ../au/h -I ../dp/h -D_GNU_SOURCE
-D_REENTRANT -D HDL_EXPORTS -D _GNU_SOURCE -D _GLIBCXX_DEBUG -D _DEBUG -D
BOOST_EXCEPTION_DISABLE -isystem
../../buildenv/linux/gcc-4.6/64/boost-1.44.0/include hdlVhdlArchitecture.cpp
-mcld -march=x86-64 -std=gnu++0x -Wall -Wno-uninitialized -Wno-deprecated
-Wsign-compare -Wtype-limits -Woverloaded-virtual -Werror -fdwarf2-cfi-asm
-feliminate-unused-debug-types -fno-strict-aliasing -fno-schedule-insns
-fno-schedule-insns2 -fPIC -gdwarf-4 -g2 -fworking-directory -O1 -O2
==28507==

parse_type_DIE: confused by:
 <1><1444a3e>: DW_TAG_array_type
     DW_AT_type        : 8 byte signature: 36 56 52 8f ec 5e fc e3
     DW_AT_sibling     : <1444a52>

--28507-- WARNING: Serious error when reading debug info
--28507-- When reading debug info from
/local/devel/toolchain46/x86_64-gnu-linux.host64/lib64/gcc/x86_64-gnu-linux/4.6.0/cc1plus:
--28507-- parse_type_DIE: confused by the above DIE

vex amd64->IR: unhandled instruction bytes: 0x66 0xF 0x3A 0x61 0x7 0x0

==28507== valgrind: Unrecognised instruction at address 0xb43594.
==28507== Your program just tried to execute an instruction that Valgrind
==28507== did not recognise.  There are two possible reasons for this.
==28507== 1. Your program has a bug and erroneously jumped to a non-code
==28507==    location.  If you are running Memcheck and you just saw a
==28507==    warning about a bad jump, it's probably your program's fault.
==28507== 2. The instruction is legitimate but Valgrind doesn't handle it,
==28507==    i.e. it's Valgrind's fault.  If you think this is the case or
==28507==    you are not sure, please let us know and we'll try to fix it.
==28507== Either way, Valgrind will now raise a SIGILL signal which will
==28507== probably kill your program.
hdlVhdlArchitecture.cpp:1:0: internal compiler error: Illegal instruction

[Bug c++/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #6 from Pawel Sikora <pluto at agmk dot net> 2011-01-15 23:27:22 UTC ---
(In reply to comment #5)
> (In reply to comment #2)
> > (In reply to comment #1)
> > > (In reply to comment #0)
> > > > current gcc-trunk (r168844) ICEs on my codebase:
> > > > 
> > > > accidentally, the --save-temps (or -std=gnu++98) removes the ICE,
> > > > so how can i produce a preprocessed source for full bug report?
> > > 
> > > -E and -S.
> > > 
> > 
> > Also use valgrind.
> 
> ==28506==
> ==28507== Memcheck, a memory error detector
> ==28507== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
> ==28507== Using Valgrind-3.6.0 and LibVEX; rerun with -h for copyright info
> ==28507== Command:
> /local/devel/toolchain46/x86_64-gnu-linux.host64/lib64/gcc/x86_64-gnu-linux/4.6.0/cc1plus
> -E -quiet -I ./h -I ./factories -I ./utils -I ../VCM/h -I ../def/h -I
> ../hescore/h -I ../debugtools/h -I ../au/h -I ../dp/h -D_GNU_SOURCE
> -D_REENTRANT -D HDL_EXPORTS -D _GNU_SOURCE -D _GLIBCXX_DEBUG -D _DEBUG -D
> BOOST_EXCEPTION_DISABLE -isystem
> ../../buildenv/linux/gcc-4.6/64/boost-1.44.0/include hdlVhdlArchitecture.cpp
> -mcld -march=x86-64 -std=gnu++0x -Wall -Wno-uninitialized -Wno-deprecated
> -Wsign-compare -Wtype-limits -Woverloaded-virtual -Werror -fdwarf2-cfi-asm
> -feliminate-unused-debug-types -fno-strict-aliasing -fno-schedule-insns
> -fno-schedule-insns2 -fPIC -gdwarf-4 -g2 -fworking-directory -O1 -O2
> ==28507==
> 
> parse_type_DIE: confused by:
>  <1><1444a3e>: DW_TAG_array_type
>      DW_AT_type        : 8 byte signature: 36 56 52 8f ec 5e fc e3
>      DW_AT_sibling     : <1444a52>
> 
> --28507-- WARNING: Serious error when reading debug info
> --28507-- When reading debug info from
> /local/devel/toolchain46/x86_64-gnu-linux.host64/lib64/gcc/x86_64-gnu-linux/4.6.0/cc1plus:
> --28507-- parse_type_DIE: confused by the above DIE
> 
> vex amd64->IR: unhandled instruction bytes: 0x66 0xF 0x3A 0x61 0x7 0x0
> 
> ==28507== valgrind: Unrecognised instruction at address 0xb43594.
> ==28507== Your program just tried to execute an instruction that Valgrind
> ==28507== did not recognise.  There are two possible reasons for this.
> ==28507== 1. Your program has a bug and erroneously jumped to a non-code
> ==28507==    location.  If you are running Memcheck and you just saw a
> ==28507==    warning about a bad jump, it's probably your program's fault.
> ==28507== 2. The instruction is legitimate but Valgrind doesn't handle it,
> ==28507==    i.e. it's Valgrind's fault.  If you think this is the case or
> ==28507==    you are not sure, please let us know and we'll try to fix it.
> ==28507== Either way, Valgrind will now raise a SIGILL signal which will
> ==28507== probably kill your program.
> hdlVhdlArchitecture.cpp:1:0: internal compiler error: Illegal instruction

looks like valgrind problem with sse42 opcode:

http://bugs.kde.org/show_bug.cgi?id=262995

[Bug c++/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #7 from H.J. Lu <hjl.tools at gmail dot com> 2011-01-16 00:18:48 UTC ---
(In reply to comment #6)
> 
> looks like valgrind problem with sse42 opcode:
> 

Disable SSE4 code to debug this.

[Bug c++/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #8 from Pawel Sikora <pluto at agmk dot net> 2011-01-16 00:38:34 UTC ---
(In reply to comment #7)
> (In reply to comment #6)
> > 
> > looks like valgrind problem with sse42 opcode:
> > 
> 
> Disable SSE4 code to debug this.

i've removed the HAVE_SSE4 stuff from libcpp configures and now
valgrind reports following log for standard compilation:

==23474== Invalid read of size 8
==23474==    at 0xB43513: search_line_sse2 (lex.c:382)
==23474==    by 0xB4360E: _cpp_clean_line (lex.c:665)
==23474==    by 0xB44027: _cpp_get_fresh_line (lex.c:1884)
==23474==    by 0xB4580D: _cpp_lex_direct (lex.c:1949)
==23474==    by 0xB46686: _cpp_lex_token (lex.c:1823)
==23474==    by 0xB48CF7: cpp_get_token (macro.c:1240)
==23474==    by 0xB48F8F: cpp_get_token_with_location (macro.c:1352)
==23474==    by 0x4F9F82: c_lex_with_flags (c-lex.c:302)
==23474==    by 0x46382F: cp_lexer_get_preprocessor_token (parser.c:548)
==23474==    by 0x47C9AB: c_parse_file (parser.c:25095)
==23474==    by 0x4FDA74: c_common_parse_file (c-opts.c:1071)
==23474==    by 0x727973: toplev_main (toplev.c:579)
==23474==  Address 0x53128b8 is 0 bytes after a block of size 408 alloc'd
==23474==    at 0x4C25322: realloc (vg_replace_malloc.c:525)
==23474==    by 0xB6D49C: xrealloc (xmalloc.c:179)
==23474==    by 0xB37F5F: _cpp_convert_input (charset.c:1734)
==23474==    by 0xB402F2: read_file (files.c:648)
==23474==    by 0xB4150A: _cpp_stack_file (files.c:723)
==23474==    by 0xB38D60: do_include_common (directives.c:792)
==23474==    by 0xB3A260: _cpp_handle_directive (directives.c:491)
==23474==    by 0xB466A4: _cpp_lex_token (lex.c:1835)
==23474==    by 0xB48CF7: cpp_get_token (macro.c:1240)
==23474==    by 0xB48F8F: cpp_get_token_with_location (macro.c:1352)
==23474==    by 0x4F9F82: c_lex_with_flags (c-lex.c:302)
==23474==    by 0x46382F: cp_lexer_get_preprocessor_token (parser.c:548)
==23474== 
==23474== Invalid read of size 8
==23474==    at 0xB43529: search_line_sse2 (lex.c:394)
==23474==    by 0xB4360E: _cpp_clean_line (lex.c:665)
==23474==    by 0xB44027: _cpp_get_fresh_line (lex.c:1884)
==23474==    by 0xB4580D: _cpp_lex_direct (lex.c:1949)
==23474==    by 0xB46686: _cpp_lex_token (lex.c:1823)
==23474==    by 0xB48CF7: cpp_get_token (macro.c:1240)
==23474==    by 0xB48F8F: cpp_get_token_with_location (macro.c:1352)
==23474==    by 0x4F9F82: c_lex_with_flags (c-lex.c:302)
==23474==    by 0x46382F: cp_lexer_get_preprocessor_token (parser.c:548)
==23474==    by 0x47CA22: c_parse_file (parser.c:425)
==23474==    by 0x4FDA74: c_common_parse_file (c-opts.c:1071)
==23474==    by 0x727973: toplev_main (toplev.c:579)
==23474==  Address 0x531cd00 is 160 bytes inside a block of size 163 alloc'd
==23474==    at 0x4C25322: realloc (vg_replace_malloc.c:525)
==23474==    by 0xB6D49C: xrealloc (xmalloc.c:179)
==23474==    by 0xB37F5F: _cpp_convert_input (charset.c:1734)
==23474==    by 0xB402F2: read_file (files.c:648)
==23474==    by 0xB4150A: _cpp_stack_file (files.c:723)
==23474==    by 0xB38D60: do_include_common (directives.c:792)
==23474==    by 0xB3A260: _cpp_handle_directive (directives.c:491)
==23474==    by 0xB466A4: _cpp_lex_token (lex.c:1835)
==23474==    by 0xB48CF7: cpp_get_token (macro.c:1240)
==23474==    by 0xB48F8F: cpp_get_token_with_location (macro.c:1352)
==23474==    by 0x4F9F82: c_lex_with_flags (c-lex.c:302)
==23474==    by 0x46382F: cp_lexer_get_preprocessor_token (parser.c:548)
==23474==
==23474== Invalid read of size 8
==23474==    at 0xB43529: search_line_sse2 (lex.c:394)
==23474==    by 0xB4360E: _cpp_clean_line (lex.c:665)
==23474==    by 0xB43C02: _cpp_skip_block_comment (lex.c:922)
==23474==    by 0xB46319: _cpp_lex_direct (lex.c:2073)
==23474==    by 0xB46686: _cpp_lex_token (lex.c:1823)
==23474==    by 0xB384FA: check_eol (directives.c:222)
==23474==    by 0xB398A7: do_endif (directives.c:1998)
==23474==    by 0xB3A260: _cpp_handle_directive (directives.c:491)
==23474==    by 0xB466A4: _cpp_lex_token (lex.c:1835)
==23474==    by 0xB48CF7: cpp_get_token (macro.c:1240)
==23474==    by 0xB48F8F: cpp_get_token_with_location (macro.c:1352)
==23474==    by 0x4F9F82: c_lex_with_flags (c-lex.c:302)
==23474==  Address 0x555b6e8 is 12,536 bytes inside a block of size 12,543
alloc'd
==23474==    at 0x4C25322: realloc (vg_replace_malloc.c:525)
==23474==    by 0xB6D49C: xrealloc (xmalloc.c:179)
==23474==    by 0xB37F5F: _cpp_convert_input (charset.c:1734)
==23474==    by 0xB402F2: read_file (files.c:648)
==23474==    by 0xB4150A: _cpp_stack_file (files.c:723)
==23474==    by 0xB38D60: do_include_common (directives.c:792)
==23474==    by 0xB3A260: _cpp_handle_directive (directives.c:491)
==23474==    by 0xB466A4: _cpp_lex_token (lex.c:1835)
==23474==    by 0xB48CF7: cpp_get_token (macro.c:1240)
==23474==    by 0xB48F8F: cpp_get_token_with_location (macro.c:1352)
==23474==    by 0x4F9F82: c_lex_with_flags (c-lex.c:302)
==23474==    by 0x46382F: cp_lexer_get_preprocessor_token (parser.c:548)
==23474==
==23474== Invalid read of size 2
==23474==    at 0x436C63: tsubst (pt.c:10502)
==23474==    by 0x44262B: fixup_template_parm (pt.c:3879)
==23474==    by 0x4428F8: end_template_parm_list (pt.c:3918)
==23474==    by 0x477C37: cp_parser_template_parameter_list (parser.c:11188)
==23474==    by 0x477E09: cp_parser_type_parameter (parser.c:11445)
==23474==    by 0x477BFA: cp_parser_template_parameter_list (parser.c:11250)
==23474==    by 0x4794A2: cp_parser_template_declaration_after_export
(parser.c:19932)
==23474==    by 0x47C849: cp_parser_declaration (parser.c:9453)
==23474==    by 0x47B914: cp_parser_declaration_seq_opt (parser.c:9383)
==23474==    by 0x47BAB8: cp_parser_namespace_definition (parser.c:13930)
==23474==    by 0x47C7F7: cp_parser_declaration (parser.c:9485)
==23474==    by 0x47B914: cp_parser_declaration_seq_opt (parser.c:9383)
==23474==  Address 0x400000003 is not stack'd, malloc'd or (recently) free'd
==23474==
In file included from ./h/hdlVhdlArchitecture.hpp:6:0,
                 from hdlVhdlArchitecture.cpp:1:
./h/hdlHolderMapVectorAdapter.hpp:122:118: internal compiler error:
Segmentation fault

[Bug c++/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #9 from Pawel Sikora <pluto at agmk dot net> 2011-01-16 01:10:32 UTC ---
without SSE2 vectorized lexer:

==2012== Invalid read of size 8
==2012==    at 0xB43064: search_line_acc_char (lex.c:263)
==2012==    by 0xB434FE: _cpp_clean_line (lex.c:669)
==2012==    by 0xB43F17: _cpp_get_fresh_line (lex.c:1888)
==2012==    by 0xB456FD: _cpp_lex_direct (lex.c:1953)
==2012==    by 0xB46576: _cpp_lex_token (lex.c:1827)
==2012==    by 0xB48BE7: cpp_get_token (macro.c:1240)
==2012==    by 0xB48E7F: cpp_get_token_with_location (macro.c:1352)
==2012==    by 0x4F9F82: c_lex_with_flags (c-lex.c:302)
==2012==    by 0x46382F: cp_lexer_get_preprocessor_token (parser.c:548)
==2012==    by 0x47CA22: c_parse_file (parser.c:425)
==2012==    by 0x4FDA74: c_common_parse_file (c-opts.c:1071)
==2012==    by 0x727973: toplev_main (toplev.c:579)
==2012==  Address 0x531cd00 is 160 bytes inside a block of size 163 alloc'd
==2012==    at 0x4C25322: realloc (vg_replace_malloc.c:525)
==2012==    by 0xB6D38C: xrealloc (xmalloc.c:179)
==2012==    by 0xB37F5F: _cpp_convert_input (charset.c:1734)
==2012==    by 0xB402F2: read_file (files.c:648)
==2012==    by 0xB4150A: _cpp_stack_file (files.c:723)
==2012==    by 0xB38D60: do_include_common (directives.c:792)
==2012==    by 0xB3A260: _cpp_handle_directive (directives.c:491)
==2012==    by 0xB46594: _cpp_lex_token (lex.c:1839)
==2012==    by 0xB48BE7: cpp_get_token (macro.c:1240)
==2012==    by 0xB48E7F: cpp_get_token_with_location (macro.c:1352)
==2012==    by 0x4F9F82: c_lex_with_flags (c-lex.c:302)
==2012==    by 0x46382F: cp_lexer_get_preprocessor_token (parser.c:548)
==2012==
==2012==
==2012== ---- Attach to debugger ? --- [Return/N/n/Y/y/C/c] ---- y
==2012== starting debugger with cmd: gdb --nw /proc/2013/fd/1014 2013
GNU gdb (GDB) PLD Linux (7.2-1)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pld-linux".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /proc/2013/fd/1014...done.
Attaching to program: /proc/2013/fd/1014, process 2013
Reading symbols from /usr/lib64/valgrind/vgpreload_core-amd64-linux.so...done.
Loaded symbols for /usr/lib64/valgrind/vgpreload_core-amd64-linux.so
Reading symbols from
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so...done.
Loaded symbols for /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so
Reading symbols from /lib64/libc.so.6...Reading symbols from
/usr/lib/debug/lib64/libc-2.12.2.so.debug...done.
done.
Loaded symbols for /lib64/libc.so.6
Reading symbols from /lib64/ld-linux-x86-64.so.2...Reading symbols from
/usr/lib/debug/lib64/ld-2.12.2.so.debug...done.
done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
0x0000000000b43064 in search_line_acc_char (s=<value optimized out>, end=<value
optimized out>) at ../../libcpp/lex.c:263
263           val = *++p;
(gdb) bt
#0  0x0000000000b43064 in search_line_acc_char (s=<value optimized out>,
end=<value optimized out>) at ../../libcpp/lex.c:263
#1  0x0000000000b434ff in _cpp_clean_line (pfile=0x521d260) at
../../libcpp/lex.c:669
#2  0x0000000000b43f18 in _cpp_get_fresh_line (pfile=0x521d260) at
../../libcpp/lex.c:1888
#3  0x0000000000b456fe in _cpp_lex_direct (pfile=0x521d260) at
../../libcpp/lex.c:1953
#4  0x0000000000b46577 in _cpp_lex_token (pfile=0x521d260) at
../../libcpp/lex.c:1827
#5  0x0000000000b48be8 in cpp_get_token (pfile=0x521d260) at
../../libcpp/macro.c:1240
#6  0x0000000000b48e80 in cpp_get_token_with_location (pfile=0x521d260,
loc=0x4141184) at ../../libcpp/macro.c:1352
#7  0x00000000004f9f83 in c_lex_with_flags (value=0x4141188, loc=0x4141184,
cpp_flags=0x4141182 "", lex_flags=2) at ../../gcc/c-family/c-lex.c:302
#8  0x0000000000463830 in cp_lexer_get_preprocessor_token (lexer=<value
optimized out>, token=0x4141180) at ../../gcc/cp/parser.c:548
#9  0x000000000047ca23 in cp_lexer_new_main () at ../../gcc/cp/parser.c:425
#10 cp_parser_new () at ../../gcc/cp/parser.c:3197
#11 c_parse_file () at ../../gcc/cp/parser.c:25275
#12 0x00000000004fda75 in c_common_parse_file () at
../../gcc/c-family/c-opts.c:1071
#13 0x0000000000727974 in compile_file (argc=62, argv=0x7fefff608) at
../../gcc/toplev.c:579
#14 do_compile (argc=62, argv=0x7fefff608) at ../../gcc/toplev.c:1874
#15 toplev_main (argc=62, argv=0x7fefff608) at ../../gcc/toplev.c:1937
#16 0x0000000004e48cbd in __libc_start_main (main=0x50bdb0 <main>, argc=62,
ubp_av=0x7fefff608, init=<value optimized out>, fini=<value optimized out>,
rtld_fini=<value optimized out>, stack_end=0x7fefff5f8) at libc-start.c:226
#17 0x0000000000402889 in _start () at ../sysdeps/x86_64/elf/start.S:113
(gdb) p p
$1 = (const word_type *) 0x531cd00
(gdb) l
258               int i = acc_char_index (t, val);
259               if (i >= 0)
260                 return (const uchar *)p + i;
261             }
262
263           val = *++p;
264         }
265     }

[Bug preprocessor/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #11 from Zdenek Sojka <zsojka at seznam dot cz> 2011-01-16 01:24:19 UTC ---
(In reply to comment #9)
> without SSE2 vectorized lexer:
> 
> ==2012== Invalid read of size 8
> ==2012==    at 0xB43064: search_line_acc_char (lex.c:263)

That is probably not causing the crash.

(In reply to comment #8)
> ==23474== Invalid read of size 2
> ==23474==    at 0x436C63: tsubst (pt.c:10502)

But this is.


For your preprocessed source from comment #3 I get:
$ g++ hdlVhdlArchitecture.ii -std=c++0x
In file included from ./h/hdlVhdlArchitecture.hpp:6:0,
                 from hdlVhdlArchitecture.cpp:1:
./h/hdlHolderMapVectorAdapter.hpp:122:118: internal compiler error: tree check:
accessed elt 2 of tree_vec with 1 elts in tsubst, at cp/pt.c:10500
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

(r168843, x86_64-linux, yes,rtl,df checking)

[Bug preprocessor/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |andi-gcc at firstfloor dot
                   |                            |org, davem at davemloft dot
                   |                            |net, rth at gcc dot gnu.org

--- Comment #10 from H.J. Lu <hjl.tools at gmail dot com> 2011-01-16 01:18:58 UTC ---
We have

static const uchar *
search_line_acc_char (const uchar *s, const uchar *end ATTRIBUTE_UNUSED)
{

But it never checks the buffer end. It looks bogus to me.

[Bug preprocessor/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #12 from Pawel Sikora <pluto at agmk dot net> 2011-01-16 01:36:29 UTC ---
(In reply to comment #11)
> (In reply to comment #9)
> > without SSE2 vectorized lexer:
> > 
> > ==2012== Invalid read of size 8
> > ==2012==    at 0xB43064: search_line_acc_char (lex.c:263)
> 
> That is probably not causing the crash.

0x0000000000b43064 in search_line_acc_char (s=<value optimized out>, end=<value
optimized out>) at ../../libcpp/lex.c:263
263           val = *++p;
(gdb) p p
$1 = (const word_type *) 0x531cd00

(gdb) up
#1  0x0000000000b434ff in _cpp_clean_line (pfile=0x521d260) at
../../libcpp/lex.c:669
669               s = search_line_fast (s, buffer->rlimit);

(gdb) p buffer->rlimit
$2 = (const unsigned char *) 0x531cd02 "\n"

(gdb) down
#0  0x0000000000b43064 in search_line_acc_char (s=<value optimized out>,
end=<value optimized out>) at ../../libcpp/lex.c:263
263           val = *++p;

(gdb) disassemble $rip,+16
Dump of assembler code from 0xb43064 to 0xb43074:
=> 0x0000000000b43064 <search_line_acc_char+100>:       mov    (%rsi),%rax

this is 6-bytes past-the-end access.

> For your preprocessed source from comment #3 I get:
> $ g++ hdlVhdlArchitecture.ii -std=c++0x
> In file included from ./h/hdlVhdlArchitecture.hpp:6:0,
>                  from hdlVhdlArchitecture.cpp:1:
> ./h/hdlHolderMapVectorAdapter.hpp:122:118: internal compiler error: tree check:
> accessed elt 2 of tree_vec with 1 elts in tsubst, at cp/pt.c:10500
> Please submit a full bug report,
> with preprocessed source if appropriate.
> See <http://gcc.gnu.org/bugs.html> for instructions.
> 
> (r168843, x86_64-linux, yes,rtl,df checking)

hmm, i must increase the checking level in my build...

[Bug preprocessor/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #13 from Zdenek Sojka <zsojka at seznam dot cz> 2011-01-16 01:39:57 UTC ---
Created attachment 22977
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=22977
reduced testcase

Doesn't need C++0x mode.

Compiler output:
$ gcc testcase2.C 
testcase2.C:3:56: internal compiler error: tree check: accessed elt 2 of
tree_vec with 1 elts in tsubst, at cp/pt.c:10500
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.

Tested revisions:
r168843 - crash
4.5 r168785 - OK

[Bug preprocessor/47311] [C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

Pawel Sikora <pluto at agmk dot net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dodji at gcc dot gnu.org

--- Comment #14 from Pawel Sikora <pluto at agmk dot net> 2011-01-16 02:16:59 UTC ---
0d432ee0d0d07e9c17b69e06afc1be9d65f57546 is the first bad commit:

commit 0d432ee0d0d07e9c17b69e06afc1be9d65f57546
Author: dodji <dodji@138bc75d-0d04-0410-961f-82ee72b054a4>
Date:   Tue Nov 2 12:44:19 2010 +0000

    Restore canonical type comparison for dependent type(def)s

    This patch restores canonical type comparison for dependent types and
    then dependent typedefs. After this patch, two template type
    parameters T are equal if they have the same index, level, *and*
    number of sibling parameters. The novelty is to take in account the
    number of sibling parameters.

    To do this we first build the template parameters w/o taking in
    account their number of siblings. When we know the number of template
    parameters we fix up each template parameter with the number of
    slibling parameters and we build the appropriate canonical types
    accordingly. The patch fixes the fallouts deemed necessary.

    This fixes PR c++/45606 but actually fixes all the previous bugs
    related to dependent typedef comparison we had since we started to
    properly representing dependent typedefs.

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[rth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #15 from Richard Henderson <rth at gcc dot gnu.org> 2011-01-17 16:03:09 UTC ---
(In reply to comment #10)
> But it never checks the buffer end. It looks bogus to me.

Read the comment at the beginning of the section.  This is an aligned
read before END, and thus will never fault.  We are guaranteed to find
an end-of-line character at the end of the buffer, so we will never 
search past END.

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #16 from Pawel Sikora <pluto at agmk dot net> 2011-01-17 18:05:15 UTC ---
(In reply to comment #15)
> (In reply to comment #10)
> > But it never checks the buffer end. It looks bogus to me.
> 
> Read the comment at the beginning of the section.  This is an aligned
> read before END, and thus will never fault.  We are guaranteed to find
> an end-of-line character at the end of the buffer, so we will never 
> search past END.

on valgrind-3.6.0 patched with https://bugs.kde.org/show_bug.cgi?id=262995#c3
with its emulated cpu i got an invalid access in search_line_sse42:

$ valgrind --leak-check=no --trace-children=yes g++46 testcase2.cpp
-std=gnu++0x -Wall -c
==5266== Memcheck, a memory error detector
==5266== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==5266== Using Valgrind-3.6.0 and LibVEX; rerun with -h for copyright info
==5266== Command: g++46 testcase2.cpp -std=gnu++0x -Wall -c
==5266==
==5267== Memcheck, a memory error detector
==5267== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==5267== Using Valgrind-3.6.0 and LibVEX; rerun with -h for copyright info
==5267== Command: /opt/gcc46/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0/cc1plus
-quiet -D_GNU_SOURCE testcase2.cpp -quiet -dumpbase testcase2.cpp
-mtune=generic -march=core2 -auxbase testcase2 -Wall -std=gnu++0x -o
/home/users/pluto/tmp/cc1d2Wcp.s
==5267==
==5267== Invalid read of size 8
==5267==    at 0x11E4E24: search_line_sse42(unsigned char const*, unsigned char
const*) (lex.c:462)
==5267==    by 0x11E4F4E: _cpp_clean_line (lex.c:665)
==5267==    by 0x11E5957: _cpp_get_fresh_line (lex.c:1884)
==5267==    by 0x11E713D: _cpp_lex_direct (lex.c:1949)
==5267==    by 0x11E7FF6: _cpp_lex_token (lex.c:1823)
==5267==    by 0x11EA6A7: cpp_get_token(cpp_reader*) (macro.c:1240)
==5267==    by 0x11EA93F: cpp_get_token_with_location(cpp_reader*, unsigned
int*) (macro.c:1352)
==5267==    by 0x6799B2: c_lex_with_flags(tree_node**, unsigned int*, unsigned
char*, int) (c-lex.c:302)
==5267==    by 0x57DA7F: cp_lexer_get_preprocessor_token(cp_lexer*, cp_token*)
(parser.c:549)
==5267==    by 0x5A571A: c_parse_file() (parser.c:425)
==5267==    by 0x67F4E4: c_common_parse_file() (c-opts.c:1071)
==5267==    by 0xA07F57: toplev_main(int, char**) (toplev.c:579)
==5267==  Address 0x629b7e0 is 112 bytes inside a block of size 114 alloc'd
==5267==    at 0x4C25322: realloc (vg_replace_malloc.c:525)
==5267==    by 0x120EDAC: xrealloc (xmalloc.c:179)
==5267==    by 0x11D975F: _cpp_convert_input (charset.c:1734)
==5267==    by 0x11E1AF2: read_file(cpp_reader*, _cpp_file*) (files.c:652)
==5267==    by 0x11E2D5A: _cpp_stack_file (files.c:723)
==5267==    by 0x11E4690: cpp_read_main_file(cpp_reader*, char const*)
(init.c:570)
==5267==    by 0x67EBE6: c_common_post_options(char const**) (c-opts.c:1010)
==5267==    by 0xA0732A: toplev_main(int, char**) (toplev.c:1283)
==5267==    by 0x5EBDCBC: (below main) (libc-start.c:226)

 454│   /* Main loop, processing 16 bytes at a time.  By doing the whole loop
 455│      in inline assembly, we can make proper use of the flags set.  */
 456│   __asm (      "sub $16, %1\n"
 457│         "       .balign 16\n"
 458│         "0:     add $16, %1\n"
 459│         "       %vpcmpestri $0, (%1), %2\n"
 460│         "       jnc 0b"
 461│         : "=&c"(index), "+r"(s)
 462├>        : "x"(search), "a"(4), "d"(16));

(gdb) p/x s
$1 = 0x629b7e0
(gdb) p/x end
$2 = 0x629b7e1
(gdb) p/x search
$4 =   {0xa,
  0xd,
  0x3f,
  0x5c,
  0x0 <repeats 12 times>}

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[rth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #17 from Richard Henderson <rth at gcc dot gnu.org> 2011-01-17 18:40:05 UTC ---
(In reply to comment #16)
> ==5267== Invalid read of size 8
> ==5267==    at 0x11E4E24: search_line_sse42(unsigned char const*, unsigned 

It's fine.  (1) Note that we've already verified above that the address is
aligned and (2) that we will in fact find the end-of-line marker that we
expect before we examine data beyond END.

I suppose valgrind expects us to update EDX in

>  454│   /* Main loop, processing 16 bytes at a time.  By doing the whole loop
>  455│      in inline assembly, we can make proper use of the flags set.  */
>  456│   __asm (      "sub $16, %1\n"
>  457│         "       .balign 16\n"
>  458│         "0:     add $16, %1\n"
>  459│         "       %vpcmpestri $0, (%1), %2\n"
>  460│         "       jnc 0b"
>  461│         : "=&c"(index), "+r"(s)
>  462├>        : "x"(search), "a"(4), "d"(16));

so that it can tell that we're examining only the first EDX bytes of the
value read, but that would require a bit of useless arithmetic here.

If there's some easy way we can add a valgrind exception for these
functions to the gcc source tree, I'd be open to do so.  But I also don't
want to figure out how to do that myself.

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #18 from Pawel Sikora <pluto at agmk dot net> 2011-01-17 19:37:54 UTC ---
(In reply to comment #17)

> If there's some easy way we can add a valgrind exception for these
> functions to the gcc source tree, I'd be open to do so.  But I also don't
> want to figure out how to do that myself.

following file passed to valgrind's --suppressions option works for me.

{
        gcc_search_line_sse2_is_correct
        Memcheck:Addr8
        fun:search_line_sse2
}
{
        gcc_search_line_sse2_is_correct
        Memcheck:Addr8
        fun:_ZL16search_line_sse2PKhS0_
}
{
        gcc_search_line_sse42_is_correct
        Memcheck:Addr8
        fun:search_line_sse42
}
{
        gcc_search_line_sse42_is_correct
        Memcheck:Addr8
        fun:_ZL17search_line_sse42PKhS0_
}

mangled variants are dedicated for --enable-build-with-cxx build.

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[andi-gcc at firstfloor dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #19 from Andi Kleen <andi-gcc at firstfloor dot org> 2011-01-17 19:59:23 UTC ---
Sounds like a valgrind bug to me. It should know that the string instruction
does not examine the values after the terminator character and  the length.

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #20 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-17 20:02:11 UTC ---
I think what valgrind complains is that it is reading past end of malloced
buffer, it doesn't figure out that eventhough some bits are set based on those
bytes past end of malloced buffer, it doesn't make a difference on the program
behavior.
I think the easiest workaround would be if we could make the allocations of
buffers on which the SSE4.2/SSE2 fast lexing is called are 16 bytes larger than
actually needed, either always, or just if (RUNNING_ON_VALGRIND) (after
#include <valgrind.h>).

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[hjl.tools at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #21 from H.J. Lu <hjl.tools at gmail dot com> 2011-01-18 14:20:40 UTC ---
Please note that valgrind also complaints search_line_acc_char
which doesn't use SSE2/SSE4.

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #22 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-01-18 14:23:32 UTC ---
That's because even that routines operates on (aligned) word_type sized chunks.

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[dodji at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #23 from Dodji Seketeli <dodji at gcc dot gnu.org> 2011-01-20 10:41:07 UTC ---
Here is what I understand from this issue.

In this example:

template < typename > class A;
template <class Key, class T, template < typename TF = T> class TC = A> class
B;

1/ During the fixup of the default argument T of the parameter TF of the
template template parm TC, we need to build the full list of implicit
arguments we have so far which {[Key, T], TF}. [Key, T] are made from the
template parameters of B. Note that [Key, T] are not fixed up yet
because they will be fixed up when we have fully parsed all the
parameters of B.

2/ That list {[Key, T], TF} is to be substituted into the default
argument of TF, that happens to be T.

The problem is at that point in fixup_template_parms, we don't have
access to [KEY, T]. current_template_args returns {[NULL], TF}. Hence
the crash in the substituting of 2/

I think no fixup should happen in 1/ as we should probably wait until
the end of parsing the parms of B to fixup all it template parms at
once.

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[dodji at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

Dodji Seketeli <dodji at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2011.01.20 10:43:11
                 CC|dodji at gcc dot gnu.org    |
         AssignedTo|unassigned at gcc dot       |dodji at gcc dot gnu.org
                   |gnu.org                     |
     Ever Confirmed|0                           |1

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[dodji at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #24 from Dodji Seketeli <dodji at gcc dot gnu.org> 2011-01-20 15:42:17 UTC ---
A candidate fix was posted to
http://gcc.gnu.org/ml/gcc-patches/2011-01/msg01381.html

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #25 from Pawel Sikora <pluto at agmk dot net> 2011-01-22 11:14:41 UTC ---
(In reply to comment #24)
> A candidate fix was posted to
> http://gcc.gnu.org/ml/gcc-patches/2011-01/msg01381.html

with this patch the *current* gcc-trunk (with fixed PR47317)
ICEs in fixed_type_or_null.

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[dodji at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #26 from Dodji Seketeli <dodji at gcc dot gnu.org> 2011-01-25 22:32:34 UTC ---
"pluto at agmk dot net" <gcc-bugzilla@gcc.gnu.org> writes:

> with this patch the *current* gcc-trunk (with fixed PR47317)
> ICEs in fixed_type_or_null.

Thank you for testing so early. I posted a second (hopefully better)
patch in the same thread.

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[pluto at agmk dot net]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #27 from Pawel Sikora <pluto at agmk dot net> 2011-01-28 22:05:01 UTC ---
(In reply to comment #26)
> "pluto at agmk dot net" <gcc-bugzilla@gcc.gnu.org> writes:
> 
> > with this patch the *current* gcc-trunk (with fixed PR47317)
> > ICEs in fixed_type_or_null.
> 
> Thank you for testing so early. I posted a second (hopefully better)
> patch in the same thread.

with these patches:

http://gcc.gnu.org/ml/gcc-patches/2011-01/msg01646.html
http://gcc.gnu.org/ml/gcc-patches/2011-01/msg02056.html
https://svn.boost.org/trac/boost/changeset/68445

i'm able to build my code base (various runtime tests in progress).
please apply the gcc part before 4.6 release.

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[dodji at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #28 from Dodji Seketeli <dodji at gcc dot gnu.org> 2011-01-28 23:36:02 UTC ---
Author: dodji
Date: Fri Jan 28 23:35:59 2011
New Revision: 169377

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=169377
Log:
Fix PR c++/47311

gcc/cp/

    PR c++/47311
    * cp-tree.h (fixup_template_parms): Declare.
    * pt.c (end_template_parm_list): Do not fixup template parms here.
    (fixup_template_parms): Remove static. Fix typo in the
    comments. Remove useless code statement.
    (fixup_template_parm): For a template template parameter, fixup
    its attributes before fixing up its type.
    * parser.c
    (cp_parser_template_declaration_after_export): After parsing
    template parameters fixup their types.

gcc/testsuite/

    PR c++/47311
    * g++.dg/template/param2.C: New test.

Added:
    trunk/gcc/testsuite/g++.dg/template/param2.C
Modified:
    trunk/gcc/cp/ChangeLog
    trunk/gcc/cp/cp-tree.h
    trunk/gcc/cp/parser.c
    trunk/gcc/cp/pt.c
    trunk/gcc/testsuite/ChangeLog

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[dodji at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

Dodji Seketeli <dodji at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #29 from Dodji Seketeli <dodji at gcc dot gnu.org> 2011-01-28 23:40:45 UTC ---
Fixed in trunk (4.6).

[Bug preprocessor/47311] [4.6 Regression][C++0x] ICE in tsubst @cp/pt.c:10502

[dnovillo at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=47311

--- Comment #30 from Diego Novillo <dnovillo at gcc dot gnu.org> 2011-02-02 18:01:21 UTC ---
Author: dnovillo
Date: Wed Feb  2 18:01:17 2011
New Revision: 169677

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=169677
Log:
Fix PR c++/47311

gcc/cp/

    PR c++/47311
    * cp-tree.h (fixup_template_parms): Declare.
    * pt.c (end_template_parm_list): Do not fixup template parms here.
    (fixup_template_parms): Remove static. Fix typo in the
    comments. Remove useless code statement.
    (fixup_template_parm): For a template template parameter, fixup
    its attributes before fixing up its type.
    * parser.c
    (cp_parser_template_declaration_after_export): After parsing
    template parameters fixup their types.

gcc/testsuite/

    PR c++/47311
    * g++.dg/template/param2.C: New test.

Added:
    branches/google/integration/gcc/testsuite/g++.dg/template/param2.C
Modified:
    branches/google/integration/gcc/cp/ChangeLog
    branches/google/integration/gcc/cp/cp-tree.h
    branches/google/integration/gcc/cp/parser.c
    branches/google/integration/gcc/cp/pt.c
    branches/google/integration/gcc/testsuite/ChangeLog