[Bug c++/53026] New: segfault in pt.c: lookup_template_class

[Bug c++/53026] New: segfault in pt.c: lookup_template_class

[mattipee at yahoo dot co.uk]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53026

             Bug #: 53026
           Summary: segfault in pt.c: lookup_template_class
    Classification: Unclassified
           Product: gcc
           Version: 4.8.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: mattipee@yahoo.co.uk


HEADLINE: pt.c:7595 - "Address 0x3 is not stack'd, malloc'd..."

user@host:~$ g++ -v
Using built-in specs.
COLLECT_GCC=g++
COLLECT_LTO_WRAPPER=/usr/local/libexec/gcc/i686-pc-linux-gnu/4.8.0/lto-wrapper
Target: i686-pc-linux-gnu
Configured with: ../gcc-svn/configure : (reconfigured) ../gcc-svn/configure :
(reconfigured) ../gcc-svn/configure
--enable-languages=c,c++,fortran,java,lto,objc --no-create --no-recursion :
(reconfigured) ../gcc-svn/configure --enable-languages=c++ : (reconfigured)
../gcc-svn/configure --enable-languages=c,c++,lto --no-create --no-recursion :
(reconfigured) ../gcc-svn/configure --enable-languages=c,c++,lto --no-create
--no-recursion : (reconfigured) ../gcc-svn/configure
--enable-languages=c,c++,lto --no-create --no-recursion
Thread model: posix
gcc version 4.8.0 20120417 (experimental) (GCC) 

(built, I believe, at revision 186523)

It would take some effort to construct minimal code to reproduce this segfault,
but the following details are available now...

user@host:~$ valgrind /path/to/cc1plus -std=c++11 -O2 -g0 -Wall ...
...
==18469==    at 0x81915D1: lookup_template_class(tree_node*, tree_node*,
tree_node*, tree_node*, int, int) (pt.c:7595)
==18469==    by 0x8194504: tsubst_aggr_type(tree_node*, tree_node*, int,
tree_node*, int) (pt.c:9876)
==18469==    by 0x819FB2A: tsubst(tree_node*, tree_node*, int, tree_node*)
(pt.c:11662)
==18469==    by 0x81B1E1E: tsubst_arg_types(tree_node*, tree_node*, int,
tree_node*) (pt.c:10844)
==18469==    by 0x81B1D04: tsubst_arg_types(tree_node*, tree_node*, int,
tree_node*) (pt.c:10814)
==18469==    by 0x81B219A: tsubst_function_type(tree_node*, tree_node*, int,
tree_node*) (pt.c:10940)
==18469==    by 0x819F676: tsubst(tree_node*, tree_node*, int, tree_node*)
(pt.c:11599)
==18469==    by 0x81A862D: tsubst_decl(tree_node*, tree_node*, int)
(pt.c:10247)
==18469==    by 0x81A01E4: tsubst(tree_node*, tree_node*, int, tree_node*)
(pt.c:11111)
==18469==    by 0x81AA6B4: tsubst_decl(tree_node*, tree_node*, int)
(pt.c:10094)
==18469==    by 0x81A01E4: tsubst(tree_node*, tree_node*, int, tree_node*)
(pt.c:11111)
==18469==    by 0x81D087F: instantiate_class_template(tree_node*) (pt.c:8935)
==18469==  Address 0x3 is not stack'd, malloc'd or (recently) free'd
==18469==

[Bug c++/53026] segfault in pt.c: lookup_template_class

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53026

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |WAITING
   Last reconfirmed|                            |2012-04-18
     Ever Confirmed|0                           |1

--- Comment #1 from Paolo Carlini <paolo.carlini at oracle dot com> 2012-04-18 01:54:36 UTC ---
If you don't have a minimal testcase, just send a testcase, maybe help yourself
with 'delta' (http://gcc.gnu.org/wiki/A_guide_to_testcase_reduction), because
otherwise it's very hard to make something out of this PR, it will be soon
closed as badly invalid per the bug reporting instructions. At the very
minimum, please pinpoint a small range of revisions where the problem appeared.

[Bug c++/53026] segfault in pt.c: lookup_template_class

[mattipee at yahoo dot co.uk]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53026

--- Comment #2 from mattipee at yahoo dot co.uk 2012-04-18 09:32:16 UTC ---
The code was many hundreds of lines long, but I've stripped it down to fewer
than 40 lines with which I can reliably reproduce the ICE.


user@host:~$ g++ -v --save-temps -std=c++11 -Wall -c -o gcc53026.o gcc53026.cpp
Using built-in specs.
COLLECT_GCC=g++
Target: i686-pc-linux-gnu
Configured with: ../gcc-svn/configure : (reconfigured) ../gcc-svn/configure :
(reconfigured) ../gcc-svn/configure
--enable-languages=c,c++,fortran,java,lto,objc --no-create --no-recursion :
(reconfigured) ../gcc-svn/configure --enable-languages=c++ : (reconfigured)
../gcc-svn/configure --enable-languages=c,c++,lto --no-create --no-recursion :
(reconfigured) ../gcc-svn/configure --enable-languages=c,c++,lto --no-create
--no-recursion : (reconfigured) ../gcc-svn/configure
--enable-languages=c,c++,lto --no-create --no-recursion
Thread model: posix
gcc version 4.8.0 20120417 (experimental) (GCC) 
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-std=c++11' '-Wall' '-c' '-o'
'gcc53026.o' '-shared-libgcc' '-mtune=generic' '-march=pentiumpro'
 /usr/local/libexec/gcc/i686-pc-linux-gnu/4.8.0/cc1plus -E -quiet -v
-D_GNU_SOURCE gcc53026.cpp -mtune=generic -march=pentiumpro -std=c++11 -Wall
-fpch-preprocess -o gcc53026.ii
ignoring nonexistent directory
"/usr/local/lib/gcc/i686-pc-linux-gnu/4.8.0/../../../../i686-pc-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
 /usr/local/lib/gcc/i686-pc-linux-gnu/4.8.0/../../../../include/c++/4.8.0

/usr/local/lib/gcc/i686-pc-linux-gnu/4.8.0/../../../../include/c++/4.8.0/i686-pc-linux-gnu

/usr/local/lib/gcc/i686-pc-linux-gnu/4.8.0/../../../../include/c++/4.8.0/backward
 /usr/local/lib/gcc/i686-pc-linux-gnu/4.8.0/include
 /usr/local/include
 /usr/local/lib/gcc/i686-pc-linux-gnu/4.8.0/include-fixed
 /usr/include
End of search list.
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-std=c++11' '-Wall' '-c' '-o'
'gcc53026.o' '-shared-libgcc' '-mtune=generic' '-march=pentiumpro'
 /usr/local/libexec/gcc/i686-pc-linux-gnu/4.8.0/cc1plus -fpreprocessed
gcc53026.ii -quiet -dumpbase gcc53026.cpp -mtune=generic -march=pentiumpro
-auxbase-strip gcc53026.o -Wall -std=c++11 -version -o gcc53026.s
GNU C++ (GCC) version 4.8.0 20120417 (experimental) (i686-pc-linux-gnu)
    compiled by GNU C version 4.8.0 20120417 (experimental), GMP version 4.3.2,
MPFR version 3.0.0-p3, MPC version 0.8.2
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
GNU C++ (GCC) version 4.8.0 20120417 (experimental) (i686-pc-linux-gnu)
    compiled by GNU C version 4.8.0 20120417 (experimental), GMP version 4.3.2,
MPFR version 3.0.0-p3, MPC version 0.8.2
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
Compiler executable checksum: d2533c0e8475a14a337438d44156a8a5
gcc53026.cpp: In instantiation of ‘struct Outer<const Inner<f()::Stub> >’:
gcc53026.cpp:37:13:   required from here
gcc53026.cpp:23:47: internal compiler error: Segmentation fault
     using MyInnerType = typename MyInner::type; // <--- !
                                               ^
Please submit a full bug report,
with preprocessed source if appropriate.
See <http://gcc.gnu.org/bugs.html> for instructions.
user@host:~$ cat gcc53026.ii 
# 1 "gcc53026.cpp"
# 1 "<command-line>"
# 1 "gcc53026.cpp"

template<typename T>
struct Inner
{
    using type = T;
};


template<typename T>
struct Outer;

template<typename T>
struct Outer<Inner<T>>
{
    using MyInner = Inner<T>;
    using MyInnerType = typename MyInner::type;
};

template<typename T>
struct Outer<const Inner<T>>
{
    using MyInner = const Inner<T>;
    using MyInnerType = typename MyInner::type;
};


void f()
{
    struct Stub {};

    using I = Inner<Stub>;
    using O = Outer<I>;
    O o;

    using I_const = const Inner<Stub>;
    using O_const = Outer<I_const>;
    O_const o_const;

}
user@host:~$


"O o;" is ok, but "O_const o_const;" is not. However, it appears to work if
"using MyInner = const Inner<T>;" is replaced with "typedef const Inner<T>
MyInner;".


Sorry I haven't checked the behaviour of previous builds - it takes about an
hour per build on my machine.

[Bug c++/53026] ICE with alias-declarations

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53026

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW
                 CC|                            |jason at gcc dot gnu.org
            Summary|segfault in pt.c:           |ICE with alias-declarations
                   |lookup_template_class       |

--- Comment #3 from Paolo Carlini <paolo.carlini at oracle dot com> 2012-04-18 09:39:26 UTC ---
Ok, thanks, this is confirmed. Cannot be a regression because the testcase uses
alias-declarations, but must be fixed.

[Bug c++/53026] ICE with alias-declarations

[kennytm at gmail dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53026

kennytm at gmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |kennytm at gmail dot com

--- Comment #4 from kennytm at gmail dot com 2012-06-23 18:40:55 UTC ---
A smaller test case which should be the same bug. 

----------------------
struct M {};
template <typename>
using K = const M;
K<int> a;
----------------------

Both the segfault appear in the lookup_template_class() function.

[Bug c++/53026] ICE with alias-declarations

[paolo.carlini at oracle dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=53026

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|jason at gcc dot gnu.org    |
         Resolution|                            |DUPLICATE

--- Comment #5 from Paolo Carlini <paolo.carlini at oracle dot com> 2012-12-05 13:05:34 UTC ---
Dup, already fixed.

*** This bug has been marked as a duplicate of bug 54466 ***