https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116907
--- Comment #20 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
#2 0x0000000001271d97 in DFS::DFS_write_tree_body (this=0x7fffffffd3c0,
ob=0x3f52620, expr=<addr_expr 0x7fffe8079800>, expr_state=0x3f76060,
ref_p=true) at /home/apinski/src/upstream-gcc/gcc/gcc/lto-streamer-out.cc:1104
1104 DFS_follow_tree_edge (TREE_BLOCK (expr));
(gdb) l
1099
1100 if (CODE_CONTAINS_STRUCT (code, TS_EXP))
1101 {
1102 for (int i = 0; i < TREE_OPERAND_LENGTH (expr); i++)
1103 DFS_follow_tree_edge (TREE_OPERAND (expr, i));
1104 DFS_follow_tree_edge (TREE_BLOCK (expr));
1105 }
1106
1107 if (CODE_CONTAINS_STRUCT (code, TS_BLOCK))
1108 {
(gdb) p debug_tree(expr)
<addr_expr 0x7fffe8079800
type <pointer_type 0x7fffe3d92f18
type <record_type 0x7fffe3d8e888 ._anon_166 sizes-gimplified cxx-odr-p
type_5 type_6 QI
size <integer_cst 0x7ffff77ae330 constant 8>
unit-size <integer_cst 0x7ffff77ae348 constant 1>
align:8 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7fffe3d8e888 fields <field_decl 0x7fffe3d90000 __t> context <function_decl
0x7fffe3d87e00 transform>
pointer_to_this <pointer_type 0x7fffe3d92f18> reference_to_this
<reference_type 0x7fffe3d960a8>>
unsigned DI
size <integer_cst 0x7ffff77ae240 constant 64>
unit-size <integer_cst 0x7ffff77ae258 constant 8>
align:64 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7fffe3d92f18>
arg:0 <component_ref 0x7fffe3a84fc0 type <record_type 0x7fffe3d8e888
._anon_166>
arg:0 <var_decl 0x7fffe3c86510 factory type <record_type 0x7fffe3d96498
ViewFactory>
used QI t.cc:106557:16 size <integer_cst 0x7ffff77ae330 8>
unit-size <integer_cst 0x7ffff77ae348 1>
align:8 warn_if_not_align:0 context <function_decl 0x7fffe413d300
option_to_strings> abstract_origin <parm_decl 0x7fffe3d93c80 factory> chain
<var_decl 0x7fffe3c86750 D.126268>>
arg:1 <field_decl 0x7fffe3d90b48 func type <record_type 0x7fffe3d8e888
._anon_166>
used nonlocal decl_3 QI t.cc:77215:51 size <integer_cst
0x7ffff77ae330 8> unit-size <integer_cst 0x7ffff77ae348 1>
align:8 warn_if_not_align:0 offset_align 128 decl_not_flexarray: 0
offset <integer_cst 0x7ffff77ae270 constant 0>
bit-offset <integer_cst 0x7ffff77ae2b8 constant 0> context
<record_type 0x7fffe3d96498 ViewFactory>>
t.cc:77223:20 start: t.cc:77223:12 finish: t.cc:77223:23>
t.cc:77223:24 start: t.cc:77223:12 finish: t.cc:77223:51>
$2 = void
(gdb) p debug_generic_expr(expr)
&factory.func
So the TREE_BLOCK (expr) has been free'd.
The original code:
```
template<typename Range, typename Func>
decltype(auto) operator| (Range&& range, ViewFactory<Func> factory)
{
return factory.func(std::forward<Range>(range));
}
```
Which is still in the reduced testcase:
```
template <typename Range, typename Func>
auto operator|(Range range, Func factory) {
return factory.func(range);
}
```
