------- Additional Comments From jakub at gcc dot gnu dot org 2005-01-18 10:12
-------
This bug was introduced by Mark's
http://gcc.gnu.org/ml/gcc-patches/2004-12/msg02130.html
patch, particularly ggc_free (newdecl); in duplicate_decls.
name-lookup.c apparently uses it, although it is freed now.
On the short testcase above, ggc_free is called from:
#2 0x084bfe45 in ggc_free (p=0xf7d64a8c) at ../../gcc/ggc-page.c:1339
#3 0x08068d2d in duplicate_decls (newdecl=0xf7d64a8c, olddecl=0xf7d643cc) at
../../gcc/cp/decl.c:2010
#4 0x08153483 in pushdecl (x=0xf7d64a8c) at ../../gcc/cp/name-lookup.c:701
#5 0x0815765b in pushdecl_with_scope (x=0xf7d64a8c, level=0xf7cdda20) at
../../gcc/cp/name-lookup.c:1816
#6 0x0815bd61 in pushdecl_namespace_level (x=0xf7d64a8c) at
../../gcc/cp/name-lookup.c:3023
but pushdecl_namespace_level certainly doesn't expect X to be freed and uses
it after the pushdecl_with_scope call:
3023 t = pushdecl_with_scope (x, NAMESPACE_LEVEL (current_namespace));
3024
3025 /* Now, the type_shadowed stack may screw us. Munge it so it does
3026 what we want. */
3027 if (TREE_CODE (x) == TYPE_DECL)
--
What |Removed |Added
----------------------------------------------------------------------------
CC| |mark at codesourcery dot com
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19349
