[Bug c++/124721] New: ICE in cp/name-lookup.cc:1820 when class template derives from base and has invalid using-declaration

[attackerj1113 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124721

            Bug ID: 124721
           Summary: ICE in cp/name-lookup.cc:1820 when class template
                    derives from base and has invalid using-declaration
           Product: gcc
           Version: 16.0
            Status: UNCONFIRMED
          Keywords: ice-checking, ice-on-invalid-code
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: attackerj1113 at gmail dot com
  Target Milestone: ---

The following code causes ICE out on x86-64 gcc since version 10.4(assertions)
and reproducible on trunk(Because on Godbolt, the earliest version that
supports assertions is 10.4):

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
class A {};

template<typename X> struct B {};

template<typename X, typename Y>
struct T : B<X> {
public:
    using typename A::err;
    void a() {}
};

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interestingly, if you include different headers, the earliest crashing version
changes: for example, with #include <cerrno> it starts crashing at 15.1, while
with #include <vector> it starts crashing at 13.1.

https://godbolt.org/z/nzsE3EvvY

The ICE only occurs when the invalid using typename A::err; appears in the body
of a class template that also derives from a base class template and declares a
member function.
If there is no inheritance, or if the using-declaration is only in the base
class, or if the class template has no member functions, GCC correctly issues
without crashing.

Output:

<source>:11:23: error: no type named 'err' in 'class A' [-Wtemplate-body]
   11 |     using typename A::err;
      |                       ^~~
<source>:9:8: error: no type named 'err' in 'class A' [-Wtemplate-body]
    9 | struct T : B<X> {
      |        ^
<source>: In member function 'void T<X, Y>::a()':
<source>:12:14: internal compiler error: tree check: expected tree that
contains 'decl minimal' structure, have 'error_mark' in
member_vec_binary_search, at cp/name-lookup.cc:1820
   12 |     void a() {}
      |              ^
0x2968048 diagnostics::context::diagnostic_impl(rich_location*,
diagnostics::metadata const*, diagnostics::option_id, char const*,
__va_list_tag (*) [1], diagnostics::kind)
        ???:0
0x295cc8b internal_error(char const*, ...)
        ???:0
0xa28ce0 tree_contains_struct_check_failed(tree_node const*,
tree_node_structure_enum, char const*, int, char const*)
        ???:0
0xce42a5 get_class_binding_direct(tree_node*, tree_node*, bool)
        ???:0
0xdfd898 lookup_member(tree_node*, tree_node*, int, bool, int,
access_failure_info*)
        ???:0
0xcea627 outer_binding(tree_node*, cxx_binding*, bool)
        ???:0
0xcea883 innermost_non_namespace_value(tree_node*)
        ???:0
0xd791ff check_template_shadow(tree_node*)
        ???:0
0xcf7590 pushdecl(tree_node*, bool)
        ???:0
0xc03c21 do_push_parm_decls(tree_node*, tree_node*, tree_node**)
        ???:0
0xc0475a start_preparsed_function(tree_node*, tree_node*, int)
        ???:0
0xd6f553 c_parse_file()
        ???:0
0xef9b49 c_common_parse_file()
        ???:0
/cefs/02/02238f02d15f5f58321427e2_gcc-trunk-20260331/bin/../libexec/gcc/x86_64-linux-gnu/16.0.1/cc1plus
-quiet -imultiarch x86_64-linux-gnu -iprefix
/cefs/02/02238f02d15f5f58321427e2_gcc-trunk-20260331/bin/../lib/gcc/x86_64-linux-gnu/16.0.1/
-D_GNU_SOURCE <source> -quiet -dumpdir /app/ -dumpbase output.cpp -dumpbase-ext
.cpp -masm=intel -mtune=generic -march=x86-64 -g -fdiagnostics-color=always
-fno-verbose-asm -o /app/output.s
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
Compiler returned: 1