[Bug c++/99505] New: ICE Segmentation fault when decltype lambda in parameter list

[Bug c++/99505] New: ICE Segmentation fault when decltype lambda in parameter list

[hewillk at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99505

            Bug ID: 99505
           Summary: ICE Segmentation fault when decltype lambda in
                    parameter list
           Product: gcc
           Version: 9.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: hewillk at gmail dot com
  Target Milestone: ---

This may be related/duplicated to the 99478, but I am not sure.

The following code will trigger ICE only on gcc-9:

int main() {
  [] (decltype([]{})) {} ({});
}

(godbolt: https://godbolt.org/z/xdr94q)

But this will trigger ICE on gcc-9, gcc-10 and gcc-11:

struct S {
  template <typename T>
  operator T() { return {}; }
};

int main() {
  [] (decltype([]{})) {} (S{});
}

(godbolt: https://godbolt.org/z/3dh477)

[Bug c++/99505] ICE Segmentation fault when decltype lambda in parameter list

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99505

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org
             Status|UNCONFIRMED                 |WAITING
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-03-10

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Cannot reproduce that locally..

[Bug c++/99505] ICE Segmentation fault when decltype lambda in parameter list

[hewillk at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99505

--- Comment #2 from 康桓瑋 <hewillk at gmail dot com> ---
Yep, wandbox (https://wandbox.org/permlink/OUJpCz6dFrlA1vod) compiles fine. 

This invalid code maybe can reproduce that locally.

int main() {
  [] (decltype([]{})) {} ();
}

(wandbox: https://wandbox.org/permlink/re9O9DXwoaYmNInd)
(godbolt: https://godbolt.org/z/e4e7or)

[Bug c++/99505] ICE Segmentation fault when decltype lambda in parameter list

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99505

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to 康桓瑋 from comment #2)
> Yep, wandbox (https://wandbox.org/permlink/OUJpCz6dFrlA1vod) compiles fine. 
> 
> This invalid code maybe can reproduce that locally.
> 
> int main() {
>   [] (decltype([]{})) {} ();
> }
> 
> (wandbox: https://wandbox.org/permlink/re9O9DXwoaYmNInd)
> (godbolt: https://godbolt.org/z/e4e7or)

Yes, I can reproduce that. It triggers a stack overflow:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000c64428 in ggc_internal_alloc (size=size@entry=48, f=f@entry=0x0,
s=s@entry=0, n=n@entry=1) at /home/marxin/Programming/gcc/gcc/ggc-page.c:1278
1278    {
Missing separate debuginfos, use: zypper install
libgmp10-debuginfo-6.2.1-2.2.x86_64 libisl23-debuginfo-0.23-2.2.x86_64
libmpc3-debuginfo-1.2.1-1.2.x86_64 libmpfr6-debuginfo-4.1.0-2.1.x86_64
libzstd1-debuginfo-1.4.8-2.2.x86_64
(gdb) bt
#0  0x0000000000c64428 in ggc_internal_alloc (size=size@entry=48,
f=f@entry=0x0, s=s@entry=0, n=n@entry=1) at
/home/marxin/Programming/gcc/gcc/ggc-page.c:1278
#1  0x0000000000e5f4ee in ggc_internal_cleared_alloc (size=48, f=f@entry=0x0,
s=s@entry=0, n=n@entry=1) at /home/marxin/Programming/gcc/gcc/ggc-common.c:117
#2  0x0000000001445a64 in ggc_internal_cleared_alloc (s=<optimized out>) at
/home/marxin/Programming/gcc/gcc/ggc.h:143
#3  ggc_alloc_cleared_tree_node_stat (s=<optimized out>) at
/home/marxin/Programming/gcc/gcc/ggc.h:315
#4  make_node (code=code@entry=BASELINK) at
/home/marxin/Programming/gcc/gcc/tree.c:1079
#5  0x0000000000b69ab6 in build_baselink (binfo=0x7ffff7725420,
access_binfo=0x7ffff7725420, functions=0x7ffff7733e00, optype=0x0) at
/home/marxin/Programming/gcc/gcc/cp/search.c:1087
#6  0x0000000000b6a03e in lookup_member (xbasetype=<optimized out>,
name=0x7ffff75efcc0, protect=<optimized out>, protect@entry=0,
want_type=want_type@entry=false, complain=complain@entry=3, afi=afi@entry=0x0)
at /home/marxin/Programming/gcc/gcc/cp/search.c:1230
#7  0x0000000000a40ef9 in lambda_function (lambda=lambda@entry=0x7ffff7720f18)
at /home/marxin/Programming/gcc/gcc/cp/lambda.c:196
#8  0x0000000000a206f9 in dump_aggr_type (t=0x7ffff7720f18, flags=1,
pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:788
#9  0x0000000000a288cc in dump_scope (scope=<optimized out>, flags=<optimized
out>, pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:241
#10 0x0000000000a2084d in dump_aggr_type (t=<optimized out>, flags=0,
pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:770
#11 0x0000000000a27de9 in dump_parameters (parmtypes=0x7ffff77315a0, flags=0,
pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/tree.h:3354
#12 0x0000000000a20758 in dump_aggr_type (t=0x7ffff7720f18, flags=1,
pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:789
#13 0x0000000000a288cc in dump_scope (scope=<optimized out>, flags=<optimized
out>, pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:241
#14 0x0000000000a2084d in dump_aggr_type (t=<optimized out>, flags=0,
pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:770
#15 0x0000000000a27de9 in dump_parameters (parmtypes=0x7ffff77315a0, flags=0,
pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/tree.h:3354
#16 0x0000000000a20758 in dump_aggr_type (t=0x7ffff7720f18, flags=1,
pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:789
#17 0x0000000000a288cc in dump_scope (scope=<optimized out>, flags=<optimized
out>, pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:241
#18 0x0000000000a2084d in dump_aggr_type (t=<optimized out>, flags=0,
pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:770
#19 0x0000000000a27de9 in dump_parameters (parmtypes=0x7ffff77315a0, flags=0,
pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/tree.h:3354
#20 0x0000000000a20758 in dump_aggr_type (t=0x7ffff7720f18, flags=1,
pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:789
#21 0x0000000000a288cc in dump_scope (scope=<optimized out>, flags=<optimized
out>, pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:241
#22 0x0000000000a2084d in dump_aggr_type (t=<optimized out>, flags=0,
pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:770
...
#2163 0x0000000000a27de9 in dump_parameters (parmtypes=0x7ffff77315a0,
flags=128, pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/tree.h:3354
#2164 0x0000000000a20758 in dump_aggr_type (t=0x7ffff7720f18, flags=128,
pp=0x285cd00 <actual_pretty_printer>) at
/home/marxin/Programming/gcc/gcc/cp/error.c:789
#2165 0x0000000000a2191c in type_to_string (typ=0x7ffff7720f18,
verbose=<optimized out>, postprocessed=<optimized out>, quote=0x7fffffffcca7,
show_color=<optimized out>) at /home/marxin/Programming/gcc/gcc/cp/error.c:3285
#2166 0x0000000000a2ab95 in cp_printer (pp=0x2a14610, text=0x7fffffffce50,
spec=<optimized out>, precision=<optimized out>, wide=<optimized out>,
set_locus=<optimized out>, verbose=false, quoted=0x7fffffffcca7,
buffer_ptr=0x2a167b0)
    at /home/marxin/Programming/gcc/gcc/cp/error.c:4378
#2167 0x0000000001d5e843 in pp_format (pp=<optimized out>,
text=text@entry=0x7fffffffce50) at
/home/marxin/Programming/gcc/gcc/pretty-print.c:1475
#2168 0x0000000001d43831 in diagnostic_report_diagnostic (context=0x29b9dc0
<global_diagnostic_context>, diagnostic=0x7fffffffce50) at
/home/marxin/Programming/gcc/gcc/diagnostic.c:1244
#2169 0x0000000001d46d83 in diagnostic_impl (kind=DK_ERROR, ap=0x7fffffffce38,
gmsgid=0x1eb62e8 "no match for call to %<(%T) (%A)%>", opt=-1, metadata=0x0,
richloc=0x7fffffffcea0) at /home/marxin/Programming/gcc/gcc/diagnostic.c:1406
#2170 error (gmsgid=gmsgid@entry=0x1eb62e8 "no match for call to %<(%T)
(%A)%>") at /home/marxin/Programming/gcc/gcc/diagnostic.c:1702
#2171 0x0000000000963a80 in build_op_call_1 (complain=-144817672,
args=0x7fffffffd057, obj=0x7ffff75e41f8) at
/home/marxin/Programming/gcc/gcc/tree.h:3468
#2172 build_op_call (obj=obj@entry=0x7ffff75e41f8,
args=args@entry=0x7fffffffd208, complain=complain@entry=3) at
/home/marxin/Programming/gcc/gcc/cp/call.c:4993
#2173 0x0000000000b790e6 in finish_call_expr (fn=fn@entry=0x7ffff75e41f8,
args=0x7fffffffd208, disallow_virtual=<optimized out>, koenig_p=<optimized
out>, complain=3) at /home/marxin/Programming/gcc/gcc/cp/semantics.c:2767
#2174 0x0000000000ada38c in cp_parser_postfix_expression
(parser=0x7ffff7604850, address_p=<optimized out>, cast_p=<optimized out>,
member_access_only_p=<optimized out>, decltype_p=false, pidk_return=0x0) at
/home/marxin/Programming/gcc/gcc/cp/cp-tree.h:68
#2175 0x0000000000ac2293 in cp_parser_binary_expression (parser=0x7ffff7604850,
cast_p=<optimized out>, no_toplevel_fold_p=false, decltype_p=<optimized out>,
prec=PREC_NOT_OPERATOR, pidk=<optimized out>) at
/home/marxin/Programming/gcc/gcc/cp/parser.c:9828

[Bug c++/99505] ICE Segmentation fault when decltype lambda in parameter list

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99505

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jason at gcc dot gnu.org
           Keywords|                            |ice-on-invalid-code

--- Comment #4 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r9-4045-g0c1e0d63fe0ceabb.

[Bug c++/99505] ICE Segmentation fault when decltype lambda in parameter list

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99505

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |nickhuang99 at hotmail dot com

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 102799 has been marked as a duplicate of this bug. ***

[Bug c++/99505] ICE Segmentation fault when decltype lambda in parameter list

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99505

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 104137 has been marked as a duplicate of this bug. ***

[Bug c++/99505] ICE Segmentation fault when decltype lambda in parameter list

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99505

--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to 康桓瑋 from comment #2)
> int main() {
>   [] (decltype([]{})) {} ();
> }

This testcase still ICEs.

Note clang, EDG and MSVC all reject it with a similar message here is clang's:
```
<source>:3:3: error: no matching function for call to object of type '(lambda
at <source>:3:3)'
    3 |   [] (decltype([]{})) {} ();
      |   ^~~~~~~~~~~~~~~~~~~~~~
<source>:3:3: note: candidate function not viable: requires 1 argument, but 0
were provided
    3 |   [] (decltype([]{})) {} ();
      |   ^   ~~~~~~~~~~~~~~
<source>:3:3: note: conversion candidate of type 'void (*)(decltype([] {
}))' (aka 'void (*)((lambda at <source>:3:16))')

```