https://gcc.gnu.org/bugzilla/show_bug.cgi?id=118856
--- Comment #6 from Sergei Trofimovich <slyfox at gcc dot gnu.org> --- The ICE is gone, but the tests in mesonlsp-4.3.7 are still failing. I think test flags the real problem, but I'm not sure if it's valid use of temps. Minimized example out of https://github.com/JCWasmx86/mesonlsp/blob/50a64edcc59e99b8bd3d6eefde7f98565d38bb3a/tests/libutils/test.cpp#L78: // $ cat bug.cpp #include <string> #include <vector> int main(){ for (const auto &vec : std::vector<std::vector<std::string>>{ {"aaa"}, }) { } } Crashing the runtime: # ok $ g++ bug.cpp -o bug -fsanitize=address $ ./bug # bad: $ g++ bug.cpp -o bug -fsanitize=address -std=c++23 $ ./bug ================================================================= ==3828042==ERROR: AddressSanitizer: heap-use-after-free on address 0x7ba90dbe0040 at pc 0x000000404279 bp 0x7ffd9db5c110 sp 0x7ffd9db5c108 READ of size 8 at 0x7ba90dbe0040 thread T0 #0 0x000000404278 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_data() const (bug+0x404278) ... 0x7ba90dbe0040 is located 0 bytes inside of 32-byte region [0x7ba90dbe0040,0x7ba90dbe0060) freed by thread T0 here: #0 0x7f790f1180c8 in operator delete(void*, unsigned long) (/<<NIX>>/gcc-15.0.1-lib/lib/libasan.so.8+0x1180c8) #1 0x000000406a4b in std::__new_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::deallocate(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >*, unsigned long) (bug+0x406a4b) ... previously allocated by thread T0 here: #0 0x7f790f1171a8 in operator new(unsigned long) (/<<NIX>>/gcc-15.0.1-lib/lib/libasan.so.8+0x1171a8) #1 0x000000404c9f in std::__new_allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::allocate(unsigned long, void const*) (bug+0x404c9f) ... SUMMARY: AddressSanitizer: heap-use-after-free (bug+0x404278) in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_data() const Shadow bytes around the buggy address: 0x7ba90dbdfd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ba90dbdfe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ba90dbdfe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ba90dbdff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x7ba90dbdff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x7ba90dbe0000: fa fa 00 00 00 fa fa fa[fd]fd fd fd fa fa fd fd 0x7ba90dbe0080: fd fa fa fa fd fd fd fd fa fa fa fa fa fa fa fa 0x7ba90dbe0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7ba90dbe0180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7ba90dbe0200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x7ba90dbe0280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3828042==ABORTING
