From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
 id 390AB3848003; Fri,  9 Apr 2021 22:45:38 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 390AB3848003
From: "cvs-commit at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/99831] [10 Regression] ICE: in reshape_init, at
 cp/decl.c:6720
Date: Fri, 09 Apr 2021 22:45:37 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 11.0
X-Bugzilla-Keywords: GC, ice-on-valid-code, patch
X-Bugzilla-Severity: normal
X-Bugzilla-Who: cvs-commit at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: mpolacek at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 10.4
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-99831-4-vPsrxyz908@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-99831-4@http.gcc.gnu.org/bugzilla/>
References: <bug-99831-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-BeenThere: gcc-bugs@gcc.gnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Gcc-bugs mailing list <gcc-bugs.gcc.gnu.org>
List-Unsubscribe: <https://gcc.gnu.org/mailman/options/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=unsubscribe>
List-Archive: <https://gcc.gnu.org/pipermail/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-request@gcc.gnu.org?subject=help>
List-Subscribe: <https://gcc.gnu.org/mailman/listinfo/gcc-bugs>,
 <mailto:gcc-bugs-request@gcc.gnu.org?subject=subscribe>
X-List-Received-Date: Fri, 09 Apr 2021 22:45:38 -0000

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D99831

--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Marek Polacek
<mpolacek@gcc.gnu.org>:

https://gcc.gnu.org/g:3252b78f7ef7847b109e7b43daf7ca1a6f0d6fab

commit r10-9689-g3252b78f7ef7847b109e7b43daf7ca1a6f0d6fab
Author: Marek Polacek <polacek@redhat.com>
Date:   Thu Apr 1 10:42:43 2021 -0400

    c++: GC collects live data when synthesizing operator=3D=3D [PR99831]

    Here we crash in reshape_init because we're accessing ggc_freed
    & poisoned data: since r277865 in defaulted_late_check we call
    synthesize_method here:

      if (kind =3D=3D sfk_comparison)
        {
          /* If the function was declared constexpr, check that the definit=
ion
             qualifies.  Otherwise we can define the function lazily.  */
          if (DECL_DECLARED_CONSTEXPR_P (fn) && !DECL_INITIAL (fn))
            synthesize_method (fn);
          return;
        }

    which in this test triggers when we're processing the string<"a">{} in
    the static_assert.  First, we create a CONSTRUCTOR for the "{}" in
    cp_parser_functional_cast, then we call finish_compound_literal which
    calls complete_type and that results in garbage collection, which then
    frees the CONSTRUCTOR {} we created when parsing the braced-list in
    string<"a">{} -- at this point, it's not referenced by anything.
    (That's not the case for 'type' in finish_compound_literal: the symbol
    table contains a node for operator=3D=3D, so ggc_mark_roots goes and ma=
rks
    the fn decl, its type, its arguments etc., as used, so we don't collect
    it.)

    We could just bump function_depth around the new call to synthesize_met=
hod
    to prevent GC.

    gcc/cp/ChangeLog:

            PR c++/99831
            * method.c (defaulted_late_check): ++ and -- function_depth aro=
und
            the call to synthesize_method.
            * pt.c: Remove the saved_trees global.

    gcc/testsuite/ChangeLog:

            PR c++/99831
            * g++.dg/other/gc6.C: New test.

    (cherry picked from commit 6a60ffc297b9d4903543a25538e62e7fb39420a9)=