https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100111
--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
The ICE is during ((struct j *) this)->e = 0 evaluation and the problem seems
to be that *valp, which is CONSTRUCTOR for the a variable initializer, is
{.h={}}
where the type of the inner {} is b rather than j.
That invalid CONSTRUCTOR elt seems to have been inserted when
cxx_eval_store_expression
*(struct b *) this = *(const struct b &) (const struct b *) &k;
I wonder if the bug isn't in:
/* Don't share a CONSTRUCTOR that might be changed later. */
init = unshare_constructor (init);
if (*valp && TREE_CODE (*valp) == CONSTRUCTOR
&& TREE_CODE (init) == CONSTRUCTOR)
{
/* An outer ctx->ctor might be pointing to *valp, so replace
its contents. */
if (!same_type_ignoring_top_level_qualifiers_p (TREE_TYPE (init),
TREE_TYPE (*valp)))
{
/* For initialization of an empty base, the original target will be
*(base*)this, evaluation of which resolves to the object
argument, which has the derived type rather than the base type. In
this situation, just evaluate the initializer and return, since
there's no actual data to store. */
gcc_assert (is_empty_class (TREE_TYPE (init)) && !lval);
return init;
}
CONSTRUCTOR_ELTS (*valp) = CONSTRUCTOR_ELTS (init);
TREE_CONSTANT (*valp) = TREE_CONSTANT (init);
TREE_SIDE_EFFECTS (*valp) = TREE_SIDE_EFFECTS (init);
CONSTRUCTOR_NO_CLEARING (*valp)
= CONSTRUCTOR_NO_CLEARING (init);
}
else
*valp = init;
where we do that if (!same_type_ignoring... check and early out only if *valp,
but in this case *valp is NULL and so we do the *valp = init; , except that
it is still empty class store with !lval. While TREE_TYPE (*valp) can't be
checked obviously, type can.
