Hi,

this (and 55786, which is a Dup) is an ICE on invalid regression in 4.7/4.8. The problem is that for such broken input, check_elaborated_type_specifier is called by cp_parser_elaborated_type_specifier with a DECL which has a nul TREE_TYPE, a TEMPLATE_ID_EXPR actually, and therefore immediately crashes on TREE_CODE (type) == TEMPLATE_TYPE_PARM.

In comparison, 4_6-branch, instead of calling check_elaborated_type_specifier, has cp_parser_elaborated_type_specifier simply doing type = TREE_TYPE (decl), thus it seems we can cure the regression in a straightforward and safe way by simply checking that TREE_TYPE (decl) is not nul at the beginning of check_elaborated_type_specifier. In this way the error messages are also exactly the same produced by 4_6.

Tested x86_64-linux.

Thanks,
Paolo.

//////////////////////
/cp
2013-03-05  Paolo Carlini  <paolo.carl...@oracle.com>

        PR c++/56534
        * decl.c (check_elaborated_type_specifier): Check for NULL_TREE
        as TREE_TYPE (decl).

/testsuite
2013-03-05  Paolo Carlini  <paolo.carl...@oracle.com>

        PR c++/56534
        * g++.dg/template/crash115.C: New.
Index: cp/decl.c
===================================================================
--- cp/decl.c   (revision 196465)
+++ cp/decl.c   (working copy)
@@ -11725,6 +11725,8 @@ check_elaborated_type_specifier (enum tag_types ta
     decl = TYPE_NAME (TREE_TYPE (decl));
 
   type = TREE_TYPE (decl);
+  if (!type)
+    return NULL_TREE;
 
   /* Check TEMPLATE_TYPE_PARM first because DECL_IMPLICIT_TYPEDEF_P
      is false for this case as well.  */
Index: testsuite/g++.dg/template/crash115.C
===================================================================
--- testsuite/g++.dg/template/crash115.C        (revision 0)
+++ testsuite/g++.dg/template/crash115.C        (working copy)
@@ -0,0 +1,3 @@
+// PR c++/56534
+
+template < struct template rebind < > // { dg-error "expected" }

Reply via email to