http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55076
--- Comment #4 from Markus Trippelsdorf <markus at trippelsdorf dot de> 2012-10-26 13:41:36 UTC --- Valgrind says: markus@x4 tmp % /var/tmp/gcc_valgrind/usr/local/bin/g++ -std=c++11 -c test.ii ==10632== Invalid read of size 2 ==10632== at 0x668622: lvalue_kind(tree_node const*) (tree.c:148) ==10632== by 0x668803: lvalue_kind(tree_node const*) (tree.c:103) ==10632== by 0x6691C8: lvalue_p(tree_node const*) (tree.c:269) ==10632== by 0x4CF7EC: standard_conversion(tree_node*, tree_node*, tree_node*, bool, int) (call.c:1104) ==10632== by 0x4D5629: implicit_conversion(tree_node*, tree_node*, tree_node*, bool, int, int) (call.c:1696) ==10632== by 0x4D7702: add_function_candidate(z_candidate**, tree_node*, tree_node*, tree_node*, vec_t<tree_node*> const*, tree_node*, tree_node*, int, int) (call.c:1987) ==10632== by 0x4D3EEE: add_candidates(tree_node*, tree_node*, vec_t<tree_node*> const*, tree_node*, tree_node*, bool, tree_node*, tree_node*, int, z_candidate**, int) (call.c:4954) ==10632== by 0x4DA7B0: perform_overload_resolution(tree_node*, vec_t<tree_node*> const*, z_candidate**, bool*, int) (call.c:3807) ==10632== by 0x4E0D5C: build_new_function_call(tree_node*, vec_t<tree_node*>**, bool, int) (call.c:3884) ==10632== by 0x656EEA: finish_call_expr(tree_node*, vec_t<tree_node*>**, bool, bool, int) (semantics.c:2190) ==10632== by 0x5CEA2E: cp_parser_postfix_expression(cp_parser*, bool, bool, bool, cp_id_kind*) (parser.c:5814) ==10632== by 0x5D9D32: cp_parser_unary_expression(cp_parser*, bool, bool, cp_id_kind*) (parser.c:6682) ==10632== Address 0x0 is not stack'd, malloc'd or (recently) free'd ==10632==