https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831
--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> --- The releases/gcc-10 branch has been updated by Marek Polacek <mpola...@gcc.gnu.org>: https://gcc.gnu.org/g:3252b78f7ef7847b109e7b43daf7ca1a6f0d6fab commit r10-9689-g3252b78f7ef7847b109e7b43daf7ca1a6f0d6fab Author: Marek Polacek <pola...@redhat.com> Date: Thu Apr 1 10:42:43 2021 -0400 c++: GC collects live data when synthesizing operator== [PR99831] Here we crash in reshape_init because we're accessing ggc_freed & poisoned data: since r277865 in defaulted_late_check we call synthesize_method here: if (kind == sfk_comparison) { /* If the function was declared constexpr, check that the definition qualifies. Otherwise we can define the function lazily. */ if (DECL_DECLARED_CONSTEXPR_P (fn) && !DECL_INITIAL (fn)) synthesize_method (fn); return; } which in this test triggers when we're processing the string<"a">{} in the static_assert. First, we create a CONSTRUCTOR for the "{}" in cp_parser_functional_cast, then we call finish_compound_literal which calls complete_type and that results in garbage collection, which then frees the CONSTRUCTOR {} we created when parsing the braced-list in string<"a">{} -- at this point, it's not referenced by anything. (That's not the case for 'type' in finish_compound_literal: the symbol table contains a node for operator==, so ggc_mark_roots goes and marks the fn decl, its type, its arguments etc., as used, so we don't collect it.) We could just bump function_depth around the new call to synthesize_method to prevent GC. gcc/cp/ChangeLog: PR c++/99831 * method.c (defaulted_late_check): ++ and -- function_depth around the call to synthesize_method. * pt.c: Remove the saved_trees global. gcc/testsuite/ChangeLog: PR c++/99831 * g++.dg/other/gc6.C: New test. (cherry picked from commit 6a60ffc297b9d4903543a25538e62e7fb39420a9)
