[Bug c++/50858] New: [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[Bug c++/50858] New: [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

             Bug #: 50858
           Summary: [4.7 Regression] segfault at
                    ../../gcc/libiberty/hashtab.c:981
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: markus@trippelsdorf.de


Segfault happened when building chromium.

 % cat test.ii
class String {
   typedef struct ImplicitConversionFromWTFStringToBoolDisallowedA* 
   (String::*UnspecifiedBoolTypeA);
   typedef struct ImplicitConversionFromWTFStringToBoolDisallowedB* 
   (String::*UnspecifiedBoolTypeB);
   operator UnspecifiedBoolTypeA() const;
   operator UnspecifiedBoolTypeB() const;
};
inline bool equalIgnoringCase(const String& a, const String& b) { }
inline bool equalPossiblyIgnoringCase(const String& a, 
                                      const String& b,
                                      bool ignoreCase) {
    return ignoreCase ? equalIgnoringCase(a, b) : (a == b);

 % g++ test.ii
test.ii: In function ‘bool equalPossiblyIgnoringCase(const String&, const
String&, bool)’:
test.ii:9:57: internal compiler error: Segmentation fault
Please submit a full bug report,

 % gdb g++
GNU gdb (Gentoo 7.3.1 p1) 7.3.1
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.gentoo.org/>...
Reading symbols from /usr/bin/g++...(no debugging symbols found)...done.
(gdb) set follow-fork-mode child
(gdb) run test.ii
Starting program: /usr/bin/g++ test.ii
warning: no loadable sections found in added symbol-file system-supplied DSO at
0x7ffff7ffa000
process 17289 is executing new program:
/usr/x86_64-pc-linux-gnu/gcc-bin/4.7.0/g++
[New process 17295]
process 17295 is executing new program:
/usr/libexec/gcc/x86_64-pc-linux-gnu/4.7.0/cc1plus

Program received signal SIGSEGV, Segmentation fault.
[Switching to process 17295]
iterative_hash (k_in=<optimized out>, length=<optimized out>,
initval=<optimized out>) at ../../gcc/libiberty/hashtab.c:981
981         case 4 : a+=((hashval_t)k[3]<<24);
(gdb) bt
#0  iterative_hash (k_in=<optimized out>, length=<optimized out>,
initval=<optimized out>) at ../../gcc/libiberty/hashtab.c:981
#1  0x000000000093ca7b in build_offset_type (basetype=0x7ffff71c2348,
type=0x6e6f6c20676e6f6c) at ../../gcc/gcc/tree.c:7850
#2  0x000000000093cadb in build_offset_type (basetype=0x7ffff71c2348,
type=0x7ffff706dd68) at ../../gcc/gcc/tree.c:7864
#3  0x0000000000523085 in composite_pointer_type_r (t1=0x7ffff71c2930,
t2=0x7ffff71c2690, operation=CPO_CONVERSION, complain=<optimized out>)
    at ../../gcc/gcc/cp/typeck.c:538
#4  0x0000000000498b73 in add_builtin_candidate (candidates=0x7fffffffd1b8,
code=<optimized out>, code2=<optimized out>, fnname=0x7ffff7079cb8,
    type1=<optimized out>, type2=<optimized out>, args=0x7fffffffd1c0,
argtypes=0x7fffffffd0e0, flags=3) at ../../gcc/gcc/cp/call.c:2587
#5  0x00000000004990dc in add_builtin_candidates (candidates=0x7fffffffd1b8,
code=EQ_EXPR, code2=NOP_EXPR, fnname=0x7ffff7079cb8,
    args=0x7fffffffd1c0, flags=3) at ../../gcc/gcc/cp/call.c:2790
#6  0x000000000049e441 in build_new_op_1 (code=EQ_EXPR, flags=3,
arg1=0x7ffff71b3f78, arg2=0x7ffff71b3fa0, arg3=0x0, overload=0x7fffffffd318,
    complain=3) at ../../gcc/gcc/cp/call.c:4991
#7  0x000000000049eb6f in build_new_op (code=EQ_EXPR, flags=3,
arg1=0x7ffff71b3f78, arg2=0x7ffff71b3fa0, arg3=<optimized out>,
    overload=<optimized out>, complain=3) at ../../gcc/gcc/cp/call.c:5256
#8  0x000000000051ff45 in build_x_binary_op (code=EQ_EXPR, arg1=0x7ffff71b3f78,
arg1_code=ERROR_MARK, arg2=0x7ffff71b3fa0, arg2_code=ERROR_MARK,
    overload=<optimized out>, complain=3) at ../../gcc/gcc/cp/typeck.c:3540
#9  0x0000000000508b2c in cp_parser_binary_expression (parser=0x7ffff71bf688,
cast_p=<optimized out>, no_toplevel_fold_p=0 '\000',
    prec=PREC_NOT_OPERATOR, pidk=<optimized out>) at
../../gcc/gcc/cp/parser.c:7009
#10 0x0000000000508e23 in cp_parser_assignment_expression
(parser=0x7ffff71bf688, cast_p=0 '\000', pidk=0x7fffffffd664)
    at ../../gcc/gcc/cp/parser.c:7114
#11 0x000000000050ecac in cp_parser_expression (parser=0x7ffff71bf688,
cast_p=<optimized out>, pidk=0x7fffffffd664)
    at ../../gcc/gcc/cp/parser.c:7260
#12 0x0000000000503087 in cp_parser_primary_expression (parser=0x7ffff71bf688,
address_p=<optimized out>, cast_p=0 '\000', template_arg_p=0 '\000',
    idk=0x7fffffffd664) at ../../gcc/gcc/cp/parser.c:3701
#13 0x00000000005048a6 in cp_parser_postfix_expression (parser=0x7ffff71bf688,
address_p=0 '\000', cast_p=0 '\000', member_access_only_p=0 '\000',
    pidk_return=0x0) at ../../gcc/gcc/cp/parser.c:5228
#14 0x00000000005017c3 in cp_parser_unary_expression (parser=0x7ffff71bf688,
address_p=0 '\000', cast_p=0 '\000', pidk=0x0)
    at ../../gcc/gcc/cp/parser.c:6224
#15 0x000000000050892b in cp_parser_binary_expression (parser=0x7ffff71bf688,
cast_p=<optimized out>, no_toplevel_fold_p=0 '\000',
    prec=PREC_NOT_OPERATOR, pidk=<optimized out>) at
../../gcc/gcc/cp/parser.c:6895
#16 0x0000000000508e23 in cp_parser_assignment_expression
(parser=0x7ffff71bf688, cast_p=0 '\000', pidk=0x0) at
../../gcc/gcc/cp/parser.c:7114
#17 0x0000000000508f79 in cp_parser_question_colon_clause
(logical_or_expr=0x7ffff706e990, parser=0x7ffff71bf688) at
../../gcc/gcc/cp/parser.c:7078
#18 cp_parser_assignment_expression (parser=0x7ffff71bf688, cast_p=0 '\000',
pidk=<optimized out>) at ../../gcc/gcc/cp/parser.c:7119
#19 0x000000000050ecac in cp_parser_expression (parser=0x7ffff71bf688,
cast_p=<optimized out>, pidk=0x0) at ../../gcc/gcc/cp/parser.c:7260
#20 0x00000000004fc520 in cp_parser_jump_statement (parser=0x7ffff71bf688) at
../../gcc/gcc/cp/parser.c:9495
#21 cp_parser_statement (parser=0x7ffff71bf688, in_statement_expr=0x0,
in_compound=<optimized out>, if_p=0x0) at ../../gcc/gcc/cp/parser.c:8261
#22 0x00000000004fca76 in cp_parser_statement_seq_opt (parser=0x7ffff71bf688,
in_statement_expr=0x0) at ../../gcc/gcc/cp/parser.c:8599
#23 0x00000000004fcbd0 in cp_parser_compound_statement (parser=0x7ffff71bf688,
in_statement_expr=0x0, in_try=<optimized out>,
    function_body=<optimized out>) at ../../gcc/gcc/cp/parser.c:8553
#24 0x000000000050e111 in cp_parser_function_body (parser=0x7ffff71bf688) at
../../gcc/gcc/cp/parser.c:16881
#25 cp_parser_ctor_initializer_opt_and_function_body (parser=0x7ffff71bf688) at
../../gcc/gcc/cp/parser.c:16918
#26 0x000000000050ea9b in cp_parser_function_definition_after_declarator
(parser=0x7ffff71bf688, inline_p=0 '\000')
    at ../../gcc/gcc/cp/parser.c:20451
#27 0x000000000051109f in
cp_parser_function_definition_from_specifiers_and_declarator
(declarator=0x121f1f0, attributes=0x0,
    decl_specifiers=<optimized out>, parser=0x7ffff71bf688) at
../../gcc/gcc/cp/parser.c:20378
#28 cp_parser_init_declarator (parser=0x7ffff71bf688,
decl_specifiers=<optimized out>, checks=0x0, function_definition_allowed_p=1
'\001',
    member_p=0 '\000', declares_class_or_enum=0,
function_definition_p=0x7fffffffdbfb "\001", maybe_range_for_decl=0x0)
    at ../../gcc/gcc/cp/parser.c:14906
#29 0x000000000051157e in cp_parser_simple_declaration (parser=0x7ffff71bf688,
function_definition_allowed_p=1 '\001', maybe_range_for_decl=0x0)
    at ../../gcc/gcc/cp/parser.c:10008
#30 0x00000000005168a9 in cp_parser_block_declaration (statement_p=0 '\000',
parser=0x7ffff71bf688) at ../../gcc/gcc/cp/parser.c:9894
#31 cp_parser_block_declaration (parser=0x7ffff71bf688, statement_p=0 '\000')
at ../../gcc/gcc/cp/parser.c:9828
#32 0x000000000051ac28 in cp_parser_declaration (parser=0x7ffff71bf688) at
../../gcc/gcc/cp/parser.c:9799
#33 0x0000000000519416 in cp_parser_declaration_seq_opt (parser=0x7ffff71bf688)
at ../../gcc/gcc/cp/parser.c:9685
#34 0x000000000051b2a2 in cp_parser_translation_unit (parser=0x7ffff71bf688) at
../../gcc/gcc/cp/parser.c:3469
#35 c_parse_file () at ../../gcc/gcc/cp/parser.c:26342
#36 0x00000000005a1ff5 in c_common_parse_file () at
../../gcc/gcc/c-family/c-opts.c:1110
#37 0x0000000000803e6c in compile_file () at ../../gcc/gcc/toplev.c:565
#38 do_compile () at ../../gcc/gcc/toplev.c:1930
#39 toplev_main (argc=12, argv=0x7fffffffdef8) at ../../gcc/gcc/toplev.c:2006
#40 0x00007ffff767e405 in __libc_start_main (main=0x5b0580 <main>, argc=12,
ubp_av=0x7fffffffdef8, init=<optimized out>, fini=<optimized out>,
    rtld_fini=<optimized out>, stack_end=0x7fffffffdee8) at libc-start.c:226
#41 0x00000000004901c9 in _start () at ../sysdeps/x86_64/elf/start.S:113
(gdb)

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

Markus Trippelsdorf <markus at trippelsdorf dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |paolo.carlini at oracle dot
                   |                            |com

--- Comment #1 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2011-10-24 19:03:29 UTC ---
Probably caused by:

commit 71c209820f6749e12b27155ac827adf9944d3941
Author: paolo <paolo@138bc75d-0d04-0410-961f-82ee72b054a4>
Date:   Fri Oct 14 14:43:03 2011 +0000

    /cp
    2011-10-14  Paolo Carlini  <paolo.carlini@oracle.com>

        PR c++/38174
        * call.c (add_builtin_candidate): If two pointers have a composite
        pointer type, generate a single candidate with that type.

    /testsuite
    2011-10-14  Paolo Carlini  <paolo.carlini@oracle.com>

        PR c++/38174
        * g++.dg/overload/operator4.C: New.


    git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@179984
138bc75d-0d04-0410-961f-82ee72b054a4

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

--- Comment #2 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-10-24 20:57:27 UTC ---
What do you mean by 'probably'? Did you bisect this? Anyway, if it's really my
patch, please confirm, no problem reverting it and reopening, didn't fix a
regression, can wait.

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jason at gcc dot gnu.org

--- Comment #3 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-10-24 21:11:39 UTC ---
Jason, if something is going wrong with the composite pointer type thing, I
guess I would just revert it for now, I don't know how much progress I can make
debugging this one and I hate having regression open around. Is that ok with
you?

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

--- Comment #4 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2011-10-24 21:23:35 UTC ---
(In reply to comment #2)
> What do you mean by 'probably'? Did you bisect this?

By probably I mean looking at the backtrace and running 
git-blame starting from the top entry. Then one finally arrives at:
/../gcc/gcc/cp/call.c:2587 which points to your commit:

71c20982 (paolo        2011-10-14 14:43:03 +0000 2587)    tree cptype =
composite_pointer_type (type1, type2,

I did revert the commit later and this "solves" the issue.

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

--- Comment #5 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-10-24 21:31:39 UTC ---
I see, at the moment I don't have my machines at hand, sorry for not noticing.
Anyway, let me double check isn't something trivial and then we'll resolve  the
issue.

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2011-10-24
         AssignedTo|unassigned at gcc dot       |paolo.carlini at oracle dot
                   |gnu.org                     |com
   Target Milestone|---                         |4.7.0
     Ever Confirmed|0                           |1

--- Comment #6 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-10-24 23:22:41 UTC ---
On it.

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-invalid-code
                 CC|paolo.carlini at oracle dot |
                   |com                         |

--- Comment #7 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-10-24 23:48:00 UTC ---
Note however that this an ice on *invalid*, ie, if I revert my patch for
PR38174 the testcase is just smoothly rejected because the overload is
ambiguous, is not accepted. In other terms, if chromium at the moment doesn't
build for you, it will still not build after this PR is fixed.

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

--- Comment #8 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-10-25 00:55:26 UTC ---
This patchlet avoids the ICE and passes the testsuite:

Index: typeck.c
===================================================================
--- typeck.c    (revision 180413)
+++ typeck.c    (working copy)
@@ -510,8 +510,12 @@ composite_pointer_type_r (tree t1, tree t2,
            && TREE_CODE (pointee2) == POINTER_TYPE)
           || (TYPE_PTR_TO_MEMBER_P (pointee1)
               && TYPE_PTR_TO_MEMBER_P (pointee2)))
-    result_type = composite_pointer_type_r (pointee1, pointee2, operation,
-                                           complain);
+    {
+      result_type = composite_pointer_type_r (pointee1, pointee2, operation,
+                                             complain);
+      if (result_type == error_mark_node)
+       return error_mark_node;
+    }
   else
     {
       if (complain & tf_error)

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

--- Comment #9 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2011-10-25 09:19:16 UTC ---
Thanks Paolo.
The strange thing is, that I cannot reproduce the chromium build problem
anymore with the latest gcc.
So some commit must have "fixed" the build issue in the last few days.

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

--- Comment #10 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-10-25 09:22:19 UTC ---
Well, good ;) This one cannot be it, but the fix is essentially ready.

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

--- Comment #11 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2011-10-25 09:48:54 UTC ---
I spoke too soon. Unfortunately I've tested a wrong compiler.
I get this new ICE with your patch applied:

chrome/browser/sync/internal_api/sync_manager.cc: In member function ‘void
sync_api::SyncManager::SyncInternal::SetPassphrase(const string&, bool)’:
chrome/browser/sync/internal_api/sync_manager.cc:1009:6: internal compiler
error: in verify_gimple_stmt, at tree-cfg.c:4175

Don't know if this related to this bug. I'm delta reducing right now.

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

--- Comment #12 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-10-25 09:50:51 UTC ---
verify_gimple_stmt? Unlikely..

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[markus at trippelsdorf dot de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

--- Comment #13 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2011-10-25 10:06:24 UTC ---
(In reply to comment #12)
> verify_gimple_stmt? Unlikely..

Yeah, it's unrelated. It's a dup of Bug 49996.

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

--- Comment #14 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-10-25 10:10:09 UTC ---
Thanks Markus, you are being helpful.

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[paolo at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

--- Comment #15 from paolo at gcc dot gnu.org <paolo at gcc dot gnu.org> 2011-10-25 13:48:17 UTC ---
Author: paolo
Date: Tue Oct 25 13:48:10 2011
New Revision: 180430

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=180430
Log:
/cp
2011-10-25  Paolo Carlini  <paolo.carlini@oracle.com>

    PR c++/50858
    * typeck.c (composite_pointer_type_r): Check return value of
    composite_pointer_type_r for error_mark_node.

/testsuite
2011-10-25  Paolo Carlini  <paolo.carlini@oracle.com>

    PR c++/50858
    * g++.dg/overload/operator5.C: New.

/cp
2011-10-25  Paolo Carlini  <paolo.carlini@oracle.com>

    PR c++/50861
    * pt.c (tsubst_copy_and_build): Check return value of
    tsubst_copy_and_build for error_mark_node.

/testsuite
2011-10-25  Paolo Carlini  <paolo.carlini@oracle.com>

    PR c++/50861
    * g++.dg/template/crash108.C: New.

Added:
    trunk/gcc/testsuite/g++.dg/overload/operator5.C
    trunk/gcc/testsuite/g++.dg/template/crash108.C
Modified:
    trunk/gcc/cp/ChangeLog
    trunk/gcc/cp/pt.c
    trunk/gcc/cp/typeck.c
    trunk/gcc/testsuite/ChangeLog

[Bug c++/50858] [4.7 Regression] segfault at ../../gcc/libiberty/hashtab.c:981

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50858

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #16 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-10-25 13:49:28 UTC ---
Fixed.