https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109556
Patrick Palka <ppalka at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |ppalka at gcc dot gnu.org
Assignee|unassigned at gcc dot gnu.org |ppalka at gcc dot
gnu.org
--- Comment #4 from Patrick Palka <ppalka at gcc dot gnu.org> ---
It looks like the satisfaction cache is holding on to a TREE_VEC that's been
ggc_free'd. It got freed from
pt.cc:try_class_unification#L23897:
if (TMPL_ARGS_HAVE_MULTIPLE_LEVELS (targs))
for (tree level : tree_vec_range (targs))
ggc_free (level);
ggc_free (targs);
Removing these calls to ggc_free fixes the ICE, thus I'm pretty sure this
started with r13-377-g3e948d645bc908. In hindsight freeing this copy of
'targs' isn't generally safe because the call to unify in try_class_unification
could perform satisfaction which in turn would capture parts of targs into the
satisfaction cache.
