[Bug c++/52043] New: [4.7 Regression] [C++0x] ICE: SIGSEGV in tsubst_copy (pt.c:12081) with -Wreturn-type

[Bug c++/52043] New: [4.7 Regression] [C++0x] ICE: SIGSEGV in tsubst_copy (pt.c:12081) with -Wreturn-type

[zsojka at seznam dot cz]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52043

             Bug #: 52043
           Summary: [4.7 Regression] [C++0x] ICE: SIGSEGV in tsubst_copy
                    (pt.c:12081) with -Wreturn-type
    Classification: Unclassified
           Product: gcc
           Version: 4.7.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: zsojka@seznam.cz
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu


Created attachment 26506
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=26506
reduced testcase (from g++.dg/cpp0x/variadic101.C)

Compiler output:
$ gcc -std=c++0x testcase.C -Wreturn-type
==14033== Invalid read of size 2
==14033==    at 0x5F48D5: tsubst_copy(tree_node*, tree_node*, int, tree_node*)
(pt.c:12081)
==14033==    by 0x5F5EB7: tsubst_copy_and_build(tree_node*, tree_node*, int,
tree_node*, bool, bool) (pt.c:14260)
==14033==    by 0x5E7A5D: tsubst_expr(tree_node*, tree_node*, int, tree_node*,
bool) (pt.c:13312)
==14033==    by 0x609AA5: tsubst_pack_expansion(tree_node*, tree_node*, int,
tree_node*) (pt.c:9478)
==14033==    by 0x5F7915: tsubst_copy_and_build(tree_node*, tree_node*, int,
tree_node*, bool, bool) (pt.c:13817)
==14033==    by 0x5E7A5D: tsubst_expr(tree_node*, tree_node*, int, tree_node*,
bool) (pt.c:13312)
==14033==    by 0x5FBFEC: tsubst(tree_node*, tree_node*, int, tree_node*)
(pt.c:11777)
==14033==    by 0x66C342: dump_template_bindings(tree_node*, tree_node*,
VEC_tree_gc*) (error.c:325)
==14033==    by 0x66DB4A: dump_function_decl(tree_node*, int) (error.c:1434)
==14033==    by 0x66FC6A: cp_printer(pretty_print_info*, text_info*, char
const*, int, bool, bool, bool) (error.c:2641)
==14033==    by 0x13534E0: pp_base_format(pretty_print_info*, text_info*)
(pretty-print.c:509)
==14033==    by 0x13541DF: pp_base_format_verbatim(pretty_print_info*,
text_info*) (pretty-print.c:565)
==14033==    by 0x13542CD: pp_verbatim(pretty_print_info*, char const*, ...)
(pretty-print.c:751)
==14033==    by 0x66243A:
maybe_print_instantiation_context(diagnostic_context*) (error.c:3006)
==14033==    by 0x66E8B1: cp_diagnostic_starter(diagnostic_context*,
diagnostic_info*) (error.c:2834)
==14033==    by 0x13510F4: diagnostic_report_diagnostic(diagnostic_context*,
diagnostic_info*) (diagnostic.c:548)
==14033==    by 0x1351A2E: warning(int, char const*, ...) (diagnostic.c:682)
==14033==    by 0x5C3338: finish_function(int) (decl.c:13501)
==14033==    by 0x621902: instantiate_decl(tree_node*, int, bool) (pt.c:18753)
==14033==    by 0x62973B: instantiate_pending_templates(int) (pt.c:18839)
==14033==    by 0x660D93: cp_write_global_declarations() (decl2.c:3770)
==14033==    by 0xB813DB: toplev_main(int, char**) (toplev.c:573)
==14033==    by 0x66E009C: (below main) (in /lib64/libc-2.13.so)
==14033==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==14033== 
'
Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.


The original testcase (g++.dg/cpp0x/variadic101.C) ICEs with:
gcc -std=c++0x -ftoplevel-reorder -fcompare-debug variadic101.ii -wrapper
valgrind,-q,--num-callers=40
==21191== Invalid read of size 2
==21191==    at 0x5F48D5: tsubst_copy(tree_node*, tree_node*, int, tree_node*)
(pt.c:12081)
==21191==    by 0x5F5EB7: tsubst_copy_and_build(tree_node*, tree_node*, int,
tree_node*, bool, bool) (pt.c:14260)
==21191==    by 0x5E7A5D: tsubst_expr(tree_node*, tree_node*, int, tree_node*,
bool) (pt.c:13312)
==21191==    by 0x609AA5: tsubst_pack_expansion(tree_node*, tree_node*, int,
tree_node*) (pt.c:9478)
==21191==    by 0x5F7915: tsubst_copy_and_build(tree_node*, tree_node*, int,
tree_node*, bool, bool) (pt.c:13817)
==21191==    by 0x5E7A5D: tsubst_expr(tree_node*, tree_node*, int, tree_node*,
bool) (pt.c:13312)
==21191==    by 0x5FBFEC: tsubst(tree_node*, tree_node*, int, tree_node*)
(pt.c:11777)
==21191==    by 0x66C342: dump_template_bindings(tree_node*, tree_node*,
VEC_tree_gc*) (error.c:325)
==21191==    by 0x66DB4A: dump_function_decl(tree_node*, int) (error.c:1434)
==21191==    by 0x66F5D8: decl_as_string(tree_node*, int) (error.c:2560)
==21191==    by 0x70FD00: cxx_printable_name_internal(tree_node*, int, bool)
(tree.c:1605)
==21191==    by 0xC61BC9: dump_enumerated_decls(_IO_FILE*, int)
(tree-ssa-live.c:1314)
==21191==    by 0xBEE238: execute_cleanup_cfg_post_optimizing()
(tree-optimize.c:182)
==21191==    by 0xA8C4A4: execute_one_pass(opt_pass*) (passes.c:2081)
==21191==    by 0xA8C864: execute_pass_list(opt_pass*) (passes.c:2136)
==21191==    by 0xBEEBBD: tree_rest_of_compilation(tree_node*)
(tree-optimize.c:420)
==21191==    by 0x841419: cgraph_expand_function(cgraph_node*)
(cgraphunit.c:1819)
==21191==    by 0x8432EB: cgraph_optimize() (cgraphunit.c:1886)
==21191==    by 0x843949: cgraph_finalize_compilation_unit()
(cgraphunit.c:1328)
==21191==    by 0x6618EA: cp_write_global_declarations() (decl2.c:4057)
==21191==    by 0xB813DB: toplev_main(int, char**) (toplev.c:573)
==21191==    by 0x66E009C: (below main) (in /lib64/libc-2.13.so)
==21191==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
...

gcc: internal compiler error: Segmentation fault (program valgrind)
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.


Compiler output - 4.6:
$ gcc -std=c++0x testcase.C -Wreturn-type -c
testcase.C: In function 'decltype (deref(u.f(), deref::args ...)) deref(T, int,
Args ...) [with T = Container<Container<int> >, Args = {}, decltype
(deref(u.f(), deref::args ...)) = Container<int>]':
testcase.C:19:14:   instantiated from here
testcase.C:13:1: warning: no return statement in function returning non-void
[-Wreturn-type]
testcase.C: In function 'T deref(T) [with T = Container<int>]':
testcase.C:13:1:   instantiated from 'decltype (T deref(u.f(), deref::args
...)) deref(T, int, Args ...) [with T = Container<Container<int> >, Args = {},
decltype (deref(u.f(), deref::args ...)) = Container<int>]'
testcase.C:19:14:   instantiated from here
testcase.C:8:2: warning: no return statement in function returning non-void
[-Wreturn-type]


Tested revisions:
r183666 - crash
r182547 - OK
r180540 - OK
4.6 r180325 - OK

[Bug c++/52043] [4.7 Regression] [C++0x] ICE: SIGSEGV in tsubst_copy (pt.c:12081) with -Wreturn-type

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52043

Richard Guenther <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |4.7.0

[Bug c++/52043] [4.7 Regression] [C++0x] ICE: SIGSEGV in tsubst_copy (pt.c:12081) with -Wreturn-type

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52043

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2012-01-30
                 CC|                            |jakub at gcc dot gnu.org,
                   |                            |jason at gcc dot gnu.org
     Ever Confirmed|0                           |1

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-01-30 10:50:16 UTC ---
Started with http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=183637 , but I'm
afraid I need to give up on this, I really have no idea whether it is correct
that the local_specializations is expected to be used and contain the
specializations from it even after tsubst_pack_expansion returns (but strangely
only when the saved local_specializations was NULL), or not.  And thus whether
the bug is somewhere else, or whether the freeing of local_specializations for
packs should be postponed to some later spot (which one)?

[Bug c++/52043] [4.7 Regression] [C++0x] ICE: SIGSEGV in tsubst_copy (pt.c:12081) with -Wreturn-type

[jason at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52043

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at gcc dot       |jason at gcc dot gnu.org
                   |gnu.org                     |

[Bug c++/52043] [4.7 Regression] [C++0x] ICE: SIGSEGV in tsubst_copy (pt.c:12081) with -Wreturn-type

[jason at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52043

--- Comment #2 from Jason Merrill <jason at gcc dot gnu.org> 2012-01-31 17:41:32 UTC ---
Author: jason
Date: Tue Jan 31 17:41:24 2012
New Revision: 183768

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=183768
Log:
    PR c++/52043
    * cp-tree.h (PACK_EXPANSION_LOCAL_P): New.
    * pt.c (make_pack_expansion, tsubst_initializer_list): Set it.
    (tsubst_pack_expansion): Check it.

Added:
    trunk/gcc/testsuite/g++.dg/cpp0x/variadic122.C
Modified:
    trunk/gcc/cp/ChangeLog
    trunk/gcc/cp/cp-tree.h
    trunk/gcc/cp/pt.c
    trunk/gcc/testsuite/ChangeLog

[Bug c++/52043] [4.7 Regression] [C++0x] ICE: SIGSEGV in tsubst_copy (pt.c:12081) with -Wreturn-type

[jason at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=52043

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #3 from Jason Merrill <jason at gcc dot gnu.org> 2012-01-31 17:43:28 UTC ---
Fixed.