[Bug c++/122349] ICE: Segmentation fault

Tue Apr 14 13:50:46 GMT 2026

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=122349

--- Comment #1 from Xingbang He <qingren2hxb at gmail dot com> ---
The segmentation fault is caused by an AddressSanitizer-detected
stack-buffer-underflow. it also reproduces on gcc trunk
(https://godbolt.org/z/5Ga8ET7os).


```
test.C: In function 'int main()':
test.C:13:14: error: initializer-string for 'char [268435456]' is too long
[-fpermissive]
   13 |     A a1 = { "", NULL, NULL };
      |              ^~
=================================================================
==48==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7f857c800000
at pc 0x7f857ef4942e bp 0x7ffcce9e0a30 sp 0x7ffcce9e01d8
READ of size 4026531841 at 0x7f857c800000 thread T0
    #0 0x7f857ef4942d in memcpy
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115
    #1 0x2f94d71 in memcpy
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
    #2 0x2f94d71 in build_string(unsigned int, char const*)
/workspace/src/gcc/gcc/tree.cc:2630
    #3 0xf3f2f5 in digest_init_r /workspace/src/gcc/gcc/cp/typeck2.cc:1389
    #4 0xf43e3c in massage_init_elt /workspace/src/gcc/gcc/cp/typeck2.cc:1666
    #5 0xf41c76 in process_init_constructor_record
/workspace/src/gcc/gcc/cp/typeck2.cc:1909
    #6 0xf41c76 in process_init_constructor
/workspace/src/gcc/gcc/cp/typeck2.cc:2204
    #7 0xf41c76 in digest_init_r /workspace/src/gcc/gcc/cp/typeck2.cc:1494
    #8 0xf43f22 in digest_init_flags(tree_node*, tree_node*, int, int)
/workspace/src/gcc/gcc/cp/typeck2.cc:1540
    #9 0xf44044 in store_init_value(tree_node*, tree_node*, vec<tree_node*,
va_gc, vl_embed>**, int) /workspace/src/gcc/gcc/cp/typeck2.cc:946
    #10 0x9b9665 in check_initializer /workspace/src/gcc/gcc/cp/decl.cc:8661
    #11 0x9c644e in cp_finish_decl(tree_node*, tree_node*, bool, tree_node*,
int, cp_decomp*) /workspace/src/gcc/gcc/cp/decl.cc:9931
    #12 0xcdc8ea in cp_parser_init_declarator
/workspace/src/gcc/gcc/cp/parser.cc:26380
    #13 0xce4dd9 in cp_parser_simple_declaration
/workspace/src/gcc/gcc/cp/parser.cc:18081
    #14 0xce5fde in cp_parser_block_declaration
/workspace/src/gcc/gcc/cp/parser.cc:17900
    #15 0xce6174 in cp_parser_declaration_statement
/workspace/src/gcc/gcc/cp/parser.cc:16937
    #16 0xc54e1f in cp_parser_statement
/workspace/src/gcc/gcc/cp/parser.cc:14444
    #17 0xc55611 in cp_parser_statement_seq_opt
/workspace/src/gcc/gcc/cp/parser.cc:15014
    #18 0xc55d3e in cp_parser_compound_statement
/workspace/src/gcc/gcc/cp/parser.cc:14861
    #19 0xcd7e81 in cp_parser_function_body
/workspace/src/gcc/gcc/cp/parser.cc:28845
    #20 0xcd7e81 in cp_parser_ctor_initializer_opt_and_function_body
/workspace/src/gcc/gcc/cp/parser.cc:28896
    #21 0xcd999b in cp_parser_function_definition_after_declarator
/workspace/src/gcc/gcc/cp/parser.cc:36123
    #22 0xcdb1a9 in
cp_parser_function_definition_from_specifiers_and_declarator
/workspace/src/gcc/gcc/cp/parser.cc:36038
    #23 0xcdb1a9 in cp_parser_init_declarator
/workspace/src/gcc/gcc/cp/parser.cc:26044
    #24 0xce4dd9 in cp_parser_simple_declaration
/workspace/src/gcc/gcc/cp/parser.cc:18081
    #25 0xce5fde in cp_parser_block_declaration
/workspace/src/gcc/gcc/cp/parser.cc:17900
    #26 0xd1919b in cp_parser_declaration
/workspace/src/gcc/gcc/cp/parser.cc:17701
    #27 0xd176bb in cp_parser_toplevel_declaration
/workspace/src/gcc/gcc/cp/parser.cc:17722
    #28 0xd20a16 in cp_parser_translation_unit
/workspace/src/gcc/gcc/cp/parser.cc:5596
    #29 0xd20a16 in c_parse_file() /workspace/src/gcc/gcc/cp/parser.cc:57505
    #30 0x106c0cf in c_common_parse_file()
/workspace/src/gcc/gcc/c-family/c-opts.cc:1430
    #31 0x2440a75 in compile_file /workspace/src/gcc/gcc/toplev.cc:455
    #32 0x2449c7c in do_compile /workspace/src/gcc/gcc/toplev.cc:2225
    #33 0x2449c7c in toplev::main(int, char**)
/workspace/src/gcc/gcc/toplev.cc:2389
    #34 0x61847c9 in main /workspace/src/gcc/gcc/main.cc:39
    #35 0x7f857e8531c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId:
8e9fd827446c24067541ac5390e6f527fb5947bb)
    #36 0x7f857e85328a in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId:
8e9fd827446c24067541ac5390e6f527fb5947bb)
    #37 0x7bd9f4 in _start
(/opt/gcc-san/6f5a97f5a3bf/libexec/gcc/x86_64-pc-linux-gnu/16.0.1/cc1plus+0x7bd9f4)
(BuildId: 537fd124eadf3a51928c35d6213ad701faaa244e)

Address 0x7f857c800000 is located in stack of thread T0 at offset 0 in frame
    #0 0x618472e in main /workspace/src/gcc/gcc/main.cc:35

  This frame has 1 object(s):
    [32, 34) 'toplev' (line 36) <== Memory access at offset 0 partially
underflows this variable
HINT: this may be a false positive if your program uses some custom stack
unwind mechanism, swapcontext or vfork
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-underflow
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115
in memcpy
Shadow bytes around the buggy address:
  0x7f857c7ffd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f857c7ffe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f857c7ffe80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f857c7fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7f857c7fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x7f857c800000:[f1]f1 f1 f1 02 f3 f3 f3 f5 f5 f5 f5 f5 f5 f5 f5
  0x7f857c800080: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x7f857c800100: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x7f857c800180: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x7f857c800200: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
  0x7f857c800280: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==48==ABORTING
```