https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109556
Patrick Palka <ppalka at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ppalka at gcc dot gnu.org Assignee|unassigned at gcc dot gnu.org |ppalka at gcc dot gnu.org --- Comment #4 from Patrick Palka <ppalka at gcc dot gnu.org> --- It looks like the satisfaction cache is holding on to a TREE_VEC that's been ggc_free'd. It got freed from pt.cc:try_class_unification#L23897: if (TMPL_ARGS_HAVE_MULTIPLE_LEVELS (targs)) for (tree level : tree_vec_range (targs)) ggc_free (level); ggc_free (targs); Removing these calls to ggc_free fixes the ICE, thus I'm pretty sure this started with r13-377-g3e948d645bc908. In hindsight freeing this copy of 'targs' isn't generally safe because the call to unify in try_class_unification could perform satisfaction which in turn would capture parts of targs into the satisfaction cache.