http://gcc.gnu.org/bugzilla/show_bug.cgi?id=51318
--- Comment #6 from Paolo Carlini <paolo.carlini at oracle dot com> 2011-12-04 16:32:52 UTC --- For some reason, in mainline tsubst_template_arg (thus tsubst_expr -> tsubst_copy_and_build, which crashes because TREE_TYPE (r) is null) handles an INDIRECT_REF (with a COND_EXPR as arg 0) instead of a COND_EXPR.
