[Bug c++/124632] [15/16 Regression] gcc/cp/pt.cc:9665:27: runtime error: index 42405 out of bounds for t ype 'tree_code_class [389]'

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124632

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Target Milestone|16.0                        |15.3
     Ever confirmed|0                           |1
           Priority|P3                          |P2
   Last reconfirmed|                            |2026-03-31
            Summary|[16 Regression]             |[15/16 Regression]
                   |gcc/cp/pt.cc:9665:27:       |gcc/cp/pt.cc:9665:27:
                   |runtime error: index 42405  |runtime error: index 42405
                   |out of bounds for t ype     |out of bounds for t ype
                   |'tree_code_class [389]'     |'tree_code_class [389]'

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
I'll note that valgrind does not show any issues on x86_64-linux even with
--param ggc-min-expand=0 --param ggc-min-heapsize=0 and enabled valgrind
annotations (and otherwise debug, aka -O0 build of cc1plus) unless
you add -Wall which then shows loads of

==20641== Invalid read of size 2
...
==20641==    by 0x142D2C0: template_args_equal(tree_node*, tree_node*)
(pt.cc:9637)
==20641==    by 0x142D935: comp_template_args(tree_node*, tree_node*,
tree_node**, tree_node**) (pt.cc:9713)
...
==20641==    by 0x10FBE52: cxx_eval_store_expression(constexpr_ctx const*,
tree_node*, value_cat, bool*, bool*, tree_node**) (constexpr.cc:7808)
==20641==  Address 0x747df18 is in a rw- anonymous segment

So confirmed.  Not sure what part of -Wall triggers this.

I'll note that on the 15 branch the testcase ICEs even (w/o valgrind) when
doing all-GC aka --param ggc-min-expand=0 --param ggc-min-heapsize=0
and -Wall:

> /spc/abuild/rguenther/gcc15-g/gcc/testsuite/g++/../../cc1plus -quiet -nostdinc++ -v -I /abuild/rguenther/gcc15-g/x86_64-pc-linux-gnu/libstdc++-v3/include/x86_64-pc-linux-gnu -I /abuild/rguenther/gcc15-g/x86_64-pc-linux-gnu/libstdc++-v3/include -I /space/rguenther/src/gcc-15-branch/libstdc++-v3/libsupc++ -I /space/rguenther/src/gcc-15-branch/libstdc++-v3/include/backward -I /space/rguenther/src/gcc-15-branch/libstdc++-v3/testsuite/util -iprefix /spc/abuild/rguenther/gcc15-g/gcc/../lib64/gcc/x86_64-pc-linux-gnu/15.2.1/ -isystem /spc/abuild/rguenther/gcc15-g/gcc/testsuite/g++/../../include -isystem /spc/abuild/rguenther/gcc15-g/gcc/testsuite/g++/../../include-fixed -D_GNU_SOURCE /space/rguenther/src/gcc-15-branch/gcc/testsuite/g++.dg/cpp23/explicit-obj-lambda2.C -quiet -dumpdir ./ -dumpbase explicit-obj-lambda2.C -dumpbase-ext .C -mtune=generic -march=x86-64 -pedantic-errors -Wno-long-long -std=c++23 -version -fdiagnostics-color=never -fdiagnostics-urls=never -fno-diagnostics-show-caret -fno-diagnostics-show-line-numbers -fdiagnostics-path-format=separate-events -fdiagnostics-text-art-charset=none -fno-diagnostics-show-event-links -fmessage-length=0 -o /tmp/cciJb4mQ.s --param ggc-min-expand=0 --param ggc-min-heapsize=0 -Wall
...
/space/rguenther/src/gcc-15-branch/gcc/testsuite/g++.dg/cpp23/explicit-obj-lambda2.C:22:1:
internal compiler error: Segmentation fault
0x3bfa088 internal_error(char const*, ...)
        /space/rguenther/src/gcc-15-branch/gcc/diagnostic-global-context.cc:517
0x1d16121 crash_signal
        /space/rguenther/src/gcc-15-branch/gcc/toplev.cc:322
0x139563f c_tree_chain_next(tree_node*)
        /space/rguenther/src/gcc-15-branch/gcc/c-family/c-common.h:1442
0x1388d26 gt_ggc_mx_lang_tree_node(void*)
        ./gt-cp-tree.h:108
0x138ab65 gt_ggc_mx_lang_tree_node(void*)
        ./gt-cp-tree.h:463
0xfa704e gt_ggc_mx_constexpr_call(void*)
        ./gt-cp-constexpr.h:75
0xfa7163 gt_ggc_mx(constexpr_call*&)
        ./gt-cp-constexpr.h:105
0xfad3d3 ggc_remove<constexpr_call*>::ggc_mx(constexpr_call*&)
        /space/rguenther/src/gcc-15-branch/gcc/hash-traits.h:259
...

and that looks like the same issue.

The 14 branch shows neither of the ICE or the valgrind issue.