user:$ gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/i686-linux-gnu/4.6.1/lto-wrapper
Target: i686-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu/Linaro 4.6.1-9ubuntu3' --with-bugurl=file:///usr/share/doc/gcc-4.6/README.Bugs --enable-languages=c,c++,fortran,objc,obj-c++,go --prefix=/usr --program-suffix=-4.6 --enable-shared --enable-linker-build-id --with-system-zlib --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --with-gxx-include-dir=/usr/include/c++/4.6 --libdir=/usr/lib --enable-nls --with-sysroot=/ --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --enable-plugin --enable-objc-gc --enable-targets=all --disable-werror --with-arch-32=i686 --with-tune=generic --enable-checking=release --build=i686-linux-gnu --host=i686-linux-gnu --target=i686-linux-gnu
Thread model: posix
gcc version 4.6.1 (Ubuntu/Linaro 4.6.1-9ubuntu3) 
user:$ 



user$ gcc main.cpp & cat main.cpp
[1] 31057
namespace N { struct A { struct Inner; }; struct Inner {}; }
namespace NN { struct AA : N::A {}; struct AA::Inner : N::Inner {}; }

int main() { return 0; }
user$ gcc: internal compiler error: Segmentation fault (program cc1plus)
Please submit a full bug report,
with preprocessed source if appropriate.
See <file:///usr/share/doc/gcc-4.6/README.Bugs> for instructions.

Reduced:

namespace N { struct A { struct Inner; }; }
namespace NN { struct AA : N::A {}; struct AA::Inner {}; }

If the nested class is declared in an enclosing namespace scope (as required) but still with the nested-name-qualifier of the derived type, G++ accepts it:

namespace N { struct A { struct Inner; }; }
namespace NN { struct AA : N::A {}; }
struct NN::AA::Inner {}; 

Clang++ and Comeau both reject this.

I agree, but they don't perform a segmentation fault

Why do you think I confirmed the bug and changed its status to NEW?

Cygwin gcc (GCC) 4.7.3

Nested class in wrong class with typedef name qualifier also causes a segmentation fault:

struct Foo
{
  struct Impl;
};

struct Bar
{
  typedef Foo base_type;

  struct base_type::Impl
  {
  };

};

Note: if "struct base_type::Impl" is changed to "struct Foo::Impl" then it will produce an error message.

Still ICEs.  push_inner_scope_r calls itself recursively and never stops:

4073   prev = CP_DECL_CONTEXT (TREE_CODE (inner) == NAMESPACE_DECL ? inner : TYPE_NAME (inner));
4074   if (outer != prev)
4075     push_inner_scope_r (outer, prev);

Comment 2 testcase fixed with r11-175.

(In reply to Marek Polacek from comment #8)
> Comment 2 testcase fixed with r11-175.

And the accepts invalid is recorded as PR 58661.