[Bug c++/95719] New: SEGV in tree_check

[Bug c++/95719] New: SEGV in tree_check

[sbergman at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

            Bug ID: 95719
           Summary: SEGV in tree_check
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: sbergman at redhat dot com
  Target Milestone: ---

With a locally-built recent GCC 11 trunk (git rev
48b6386f5d0bdcbe5c901678a043516d544a9f7f), but not with e.g.
gcc-c++-10.1.1-1.fc32.x86_64:

> $ cat test.cc
> struct S1 { virtual ~S1(); };
> struct S2 {
>     virtual ~S2();
>     virtual void f();
> };
> struct S3 final: S1, S2 { using S2::f; };
> void g(S3 & s) { s.f(); }

> $ g++ -fsyntax-only test.cc
> test.cc: In function ‘void g(S3&)’:
> test.cc:7:22: internal compiler error: Segmentation fault
>     7 | void g(S3 & s) { s.f(); }
>       |                      ^
> 0x100471f crash_signal
> 	../../src/gcc/toplev.c:328
> 0x7f245b447aaf ???
> 	/usr/src/debug/glibc-2.31-17-gab029a2801/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
> 0x8afd41 tree_check(tree_node*, char const*, int, char const*, tree_code)
> 	../../src/gcc/tree.h:3300
> 0x8afd41 lookup_vfn_in_binfo(tree_node*, tree_node*)
> 	../../src/gcc/cp/class.c:2459
> 0x89f872 build_over_call
> 	../../src/gcc/cp/call.c:8697
> 0x8a1a2c build_new_method_call_1
> 	../../src/gcc/cp/call.c:10352
> 0x8a294f build_new_method_call(tree_node*, tree_node*, vec<tree_node*, va_gc, vl_embed>**, tree_node*, int, tree_node**, int)
> 	../../src/gcc/cp/call.c:10427
> 0x9d408c cp_parser_postfix_expression
> 	../../src/gcc/cp/parser.c:7481
> 0x9b61ca cp_parser_binary_expression
> 	../../src/gcc/cp/parser.c:9609
> 0x9b7d2e cp_parser_assignment_expression
> 	../../src/gcc/cp/parser.c:9914
> 0x9b8052 cp_parser_expression
> 	../../src/gcc/cp/parser.c:10082
> 0x9baee8 cp_parser_expression_statement
> 	../../src/gcc/cp/parser.c:11742
> 0x9c6290 cp_parser_statement
> 	../../src/gcc/cp/parser.c:11538
> 0x9c7b68 cp_parser_statement_seq_opt
> 	../../src/gcc/cp/parser.c:11889
> 0x9c7c48 cp_parser_compound_statement
> 	../../src/gcc/cp/parser.c:11839
> 0x9df215 cp_parser_function_body
> 	../../src/gcc/cp/parser.c:23115
> 0x9df215 cp_parser_ctor_initializer_opt_and_function_body
> 	../../src/gcc/cp/parser.c:23166
> 0x9e253d cp_parser_function_definition_after_declarator
> 	../../src/gcc/cp/parser.c:29062
> 0x9e3529 cp_parser_function_definition_from_specifiers_and_declarator
> 	../../src/gcc/cp/parser.c:28978
> 0x9e3529 cp_parser_init_declarator
> 	../../src/gcc/cp/parser.c:20721
> Please submit a full bug report,
> with preprocessed source if appropriate.
> Please include the complete backtrace with any bug report.
> See <https://gcc.gnu.org/bugs/> for instructions.

[Bug c++/95719] [11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
      Known to fail|                            |11.0
   Target Milestone|---                         |11.0
           Keywords|                            |ice-on-valid-code
            Summary|SEGV in tree_check          |[11 Regression] ICE in
                   |                            |lookup_vfn_in_binfo at
                   |                            |gcc/cp/class.c:2459 since
                   |                            |r11-954-g0ddb93ce77374004
   Last reconfirmed|                            |2020-06-17
             Status|UNCONFIRMED                 |NEW
      Known to work|                            |10.1.0
     Ever confirmed|0                           |1
                 CC|                            |jason at gcc dot gnu.org,
                   |                            |marxin at gcc dot gnu.org

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Confirmed, started with r11-954-g0ddb93ce77374004.
Thank you for the report.

[Bug c++/95719] [11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |doko at debian dot org

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
*** Bug 95838 has been marked as a duplicate of this bug. ***

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mpolacek at gcc dot gnu.org
            Summary|[11 Regression] ICE in      |[10/11 Regression] ICE in
                   |lookup_vfn_in_binfo at      |lookup_vfn_in_binfo at
                   |gcc/cp/class.c:2459 since   |gcc/cp/class.c:2459 since
                   |r11-954-g0ddb93ce77374004   |r11-954-g0ddb93ce77374004
   Target Milestone|11.0                        |10.2

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jason at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jason Merrill <jason@gcc.gnu.org>:

https://gcc.gnu.org/g:7d6baf68fe22b6ef5b1d6fabbef97c0e1b4d7abf

commit r11-1637-g7d6baf68fe22b6ef5b1d6fabbef97c0e1b4d7abf
Author: Jason Merrill <jason@redhat.com>
Date:   Tue Jun 23 21:25:21 2020 -0400

    c++: Fix ICE with using and virtual function. [PR95719]

    conversion_path points to the base where we found the using-declaration,
not
    where the function is actually a member; look up the actual base.  And then
    maybe look back to the derived class if the base is primary.

    gcc/cp/ChangeLog:

            PR c++/95719
            * call.c (build_over_call): Look up the overrider in base_binfo.
            * class.c (lookup_vfn_in_binfo): Look through BINFO_PRIMARY_P.

    gcc/testsuite/ChangeLog:

            PR c++/95719
            * g++.dg/tree-ssa/final4.C: New test.

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jason Merrill
<jason@gcc.gnu.org>:

https://gcc.gnu.org/g:554eb7d2e1ef5660d6a8e1c12ee1d751a70bbf31

commit r10-8363-g554eb7d2e1ef5660d6a8e1c12ee1d751a70bbf31
Author: Jason Merrill <jason@redhat.com>
Date:   Tue Jun 23 21:25:21 2020 -0400

    c++: Fix ICE with using and virtual function. [PR95719]

    conversion_path points to the base where we found the using-declaration,
not
    where the function is actually a member; look up the actual base.  And then
    maybe look back to the derived class if the base is primary.

    gcc/cp/ChangeLog:

            PR c++/95719
            * call.c (build_over_call): Look up the overrider in base_binfo.
            * class.c (lookup_vfn_in_binfo): Look through BINFO_PRIMARY_P.

    gcc/testsuite/ChangeLog:

            PR c++/95719
            * g++.dg/tree-ssa/final4.C: New test.

    (cherry picked from commit 7d6baf68fe22b6ef5b1d6fabbef97c0e1b4d7abf)

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[jason at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

Jason Merrill <jason at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #5 from Jason Merrill <jason at gcc dot gnu.org> ---
Fixed for 10.2/11.

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[ht990332 at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

Hussam Al-Tayeb <ht990332 at gmx dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ht990332 at gmx dot com

--- Comment #6 from Hussam Al-Tayeb <ht990332 at gmx dot com> ---
gcc-9 branch also has a backport of
https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=0ddb93ce77374004 which caused
the regression.
Can the fix for this bug be backported to the gcc-9 branch please?

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

--- Comment #7 from Martin Liška <marxin at gcc dot gnu.org> ---
*** Bug 98232 has been marked as a duplicate of this bug. ***

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
And to 8 branch too.

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:710df943389a854ef00c15ed0ad219b41db236aa

commit r9-9479-g710df943389a854ef00c15ed0ad219b41db236aa
Author: Jason Merrill <jason@redhat.com>
Date:   Tue Jun 23 21:25:21 2020 -0400

    c++: Fix ICE with using and virtual function. [PR95719]

    conversion_path points to the base where we found the using-declaration,
not
    where the function is actually a member; look up the actual base.  And then
    maybe look back to the derived class if the base is primary.

    gcc/cp/ChangeLog:

            PR c++/95719
            * call.c (build_over_call): Look up the overrider in base_binfo.
            * class.c (lookup_vfn_in_binfo): Look through BINFO_PRIMARY_P.

    gcc/testsuite/ChangeLog:

            PR c++/95719
            * g++.dg/tree-ssa/final4.C: New test.

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-8 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:4ccd63f07dc85911e4c76b350cdc19daeee7284a

commit r8-10932-g4ccd63f07dc85911e4c76b350cdc19daeee7284a
Author: Jason Merrill <jason@redhat.com>
Date:   Tue Jun 23 21:25:21 2020 -0400

    c++: Fix ICE with using and virtual function. [PR95719]

    conversion_path points to the base where we found the using-declaration,
not
    where the function is actually a member; look up the actual base.  And then
    maybe look back to the derived class if the base is primary.

    gcc/cp/ChangeLog:

            PR c++/95719
            * call.c (build_over_call): Look up the overrider in base_binfo.
            * class.c (lookup_vfn_in_binfo): Look through BINFO_PRIMARY_P.

    gcc/testsuite/ChangeLog:

            PR c++/95719
            * g++.dg/tree-ssa/final4.C: New test.

    (cherry picked from commit 710df943389a854ef00c15ed0ad219b41db236aa)

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:ebfe8b28d40746ff33724bd5b9ade2552e619213

commit r9-9558-gebfe8b28d40746ff33724bd5b9ade2552e619213
Author: Jason Merrill <jason@redhat.com>
Date:   Thu May 27 23:54:52 2021 -0400

    c++: 'this' adjustment for devirtualized call

    My patch for 95719 made us do a better job of finding the actual virtual
    function we want to call, but didn't update the 'this' pointer adjustment
to
    match.

    This backport also incorporates a bit of the r11-1638 reorganization.

            PR c++/100797
            PR c++/95719

    gcc/cp/ChangeLog:

            * call.c (build_over_call): Adjust base_binfo in
            resolves_to_fixed_type_p case.

    gcc/testsuite/ChangeLog:

            * g++.dg/inherit/virtual15.C: New test.
            * g++.dg/inherit/virtual15a.C: New test.

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

--- Comment #12 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jason Merrill <jason@gcc.gnu.org>:

https://gcc.gnu.org/g:f838e3ccf8d2849980e9d0f70aa60ecd2eb5772c

commit r12-1114-gf838e3ccf8d2849980e9d0f70aa60ecd2eb5772c
Author: Jason Merrill <jason@redhat.com>
Date:   Thu May 27 23:54:52 2021 -0400

    c++: 'this' adjustment for devirtualized call

    My patch for 95719 made us do a better job of finding the actual virtual
    function we want to call, but didn't update the 'this' pointer adjustment
to
    match.

            PR c++/100797
            PR c++/95719

    gcc/cp/ChangeLog:

            * call.c (build_over_call): Adjust base_binfo in
            resolves_to_fixed_type_p case.

    gcc/testsuite/ChangeLog:

            * g++.dg/inherit/virtual15.C: New test.

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Jason Merrill
<jason@gcc.gnu.org>:

https://gcc.gnu.org/g:7c61ce59421547194647a847263b2b9065a26e03

commit r11-8494-g7c61ce59421547194647a847263b2b9065a26e03
Author: Jason Merrill <jason@redhat.com>
Date:   Thu May 27 23:54:52 2021 -0400

    c++: 'this' adjustment for devirtualized call

    My patch for 95719 made us do a better job of finding the actual virtual
    function we want to call, but didn't update the 'this' pointer adjustment
to
    match.

            PR c++/100797
            PR c++/95719

    gcc/cp/ChangeLog:

            * call.c (build_over_call): Adjust base_binfo in
            resolves_to_fixed_type_p case.

    gcc/testsuite/ChangeLog:

            * g++.dg/inherit/virtual15.C: New test.

[Bug c++/95719] [10/11 Regression] ICE in lookup_vfn_in_binfo at gcc/cp/class.c:2459 since r11-954-g0ddb93ce77374004

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95719

--- Comment #14 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jason Merrill
<jason@gcc.gnu.org>:

https://gcc.gnu.org/g:1027e8c8837d9d4933946f2888d85deef2cf850b

commit r10-9876-g1027e8c8837d9d4933946f2888d85deef2cf850b
Author: Jason Merrill <jason@redhat.com>
Date:   Thu May 27 23:54:52 2021 -0400

    c++: 'this' adjustment for devirtualized call

    My patch for 95719 made us do a better job of finding the actual virtual
    function we want to call, but didn't update the 'this' pointer adjustment
to
    match.

    This backport also incorporates a bit of the r11-1638 reorganization.

            PR c++/100797
            PR c++/95719

    gcc/cp/ChangeLog:

            * call.c (build_over_call): Adjust base_binfo in
            resolves_to_fixed_type_p case.

    gcc/testsuite/ChangeLog:

            * g++.dg/inherit/virtual15.C: New test.
            * g++.dg/inherit/virtual15a.C: New test.