http://gcc.gnu.org/bugzilla/show_bug.cgi?id=45983
--- Comment #8 from Richard Guenther <rguenth at gcc dot gnu.org> 2010-10-12 14:54:58 UTC --- We have an array type with a TYPE_DOMAIN with TYPE_MAXVAL being template_parm_index - 1. The array is field 'm' in chunk_array_t which is the DECL_CONTEXT of scalar_type_t which is referenced by the statement D.1506_3 = this_1(D)->vals[0][cha_2(D)]; as the type of the reference. I wonder why this uses chunk_array_t::scalar_type_t at all. Hmm. We build that array-ref in the frontend: #1 0x00000000006839ef in cp_build_array_ref (loc=2910, array=0x7ffff5b11480, idx=0x7ffff5b10198, complain=3) at /space/rguenther/src/svn/trunk/gcc/cp/typeck.c:3039 3039 rval = build4 (ARRAY_REF, type, array, idx, NULL_TREE, NULL_TREE); and the array has element type scalar_type_t already. It's array type is already built with that element type by 0x00000000007056f8 in build_cplus_array_type (elt_type=0x7ffff5b011f8, index_type=0x7ffff5aeebd0) at /space/rguenther/src/svn/trunk/gcc/cp/tree.c:665 665 t = build_array_type (elt_type, index_type); (gdb) up #1 0x00000000007064d7 in cp_build_qualified_type_real (type=0x7ffff5aeef18, type_quals=1, complain=7) at /space/rguenther/src/svn/trunk/gcc/cp/tree.c:822 822 t = build_cplus_array_type (element_type, TYPE_DOMAIN (type)); (gdb) up #2 0x00000000004fb789 in grokdeclarator (declarator=0x1aa2330, declspecs=0x7fffffffd5d0, decl_context=FIELD, initialized=0, attrlist=0x7fffffffd380) at /space/rguenther/src/svn/trunk/gcc/cp/decl.c:8322 8322 type = cp_build_qualified_type_real which is ultimately derived from #1 0x00000000004f9956 in create_array_type_for_decl (name=0x7ffff5afad68, type=0x7ffff5aee690, size=0x7ffff5ae28c0) at /space/rguenther/src/svn/trunk/gcc/cp/decl.c:7640 7640 return build_cplus_array_type (type, itype); (gdb) up #2 0x00000000004fc05c in grokdeclarator (declarator=0x1aa2130, declspecs=0x7fffffffd5d0, decl_context=FIELD, initialized=0, attrlist=0x7fffffffd380) at /space/rguenther/src/svn/trunk/gcc/cp/decl.c:8525 8525 type = create_array_type_for_decl (dname, type, which has type of scalar_type_t already. So - I have no idea how scalar_type_t leaks there ... Jason?