[gcc r16-6145] c++: avoid in-place modification of TYPENAME_TYPE

[Patrick Palka]

https://gcc.gnu.org/g:880492a8cb10d046b0162c31c9567c1e72d1be8f

commit r16-6145-g880492a8cb10d046b0162c31c9567c1e72d1be8f
Author: Patrick Palka <ppalka@redhat.com>
Date:   Mon Dec 15 15:03:43 2025 -0500

    c++: avoid in-place modification of TYPENAME_TYPE
    
    Since we have a TYPENAME_TYPE cache, through which equivalent
    TYPENAME_TYPEs are reused, in-place modification of a TYPENAME_TYPE is
    generally unsafe.  This is a latent issue noticed when attempting a
    different approach to fix PR122752.
    
    gcc/cp/ChangeLog:
    
            * parser.cc (cp_parser_template_id): Rebuild instead of modifying
            a TYPENAME_TYPE corresponding to a dependently-scoped template.
    
    Reviewed-by: Jason Merrill <jason@redhat.com>

Diff:
---
 gcc/cp/parser.cc | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/gcc/cp/parser.cc b/gcc/cp/parser.cc
index 17199e013ba1..394725fde394 100644
--- a/gcc/cp/parser.cc
+++ b/gcc/cp/parser.cc
@@ -20426,10 +20426,15 @@ cp_parser_template_id (cp_parser *parser,
 	   && TREE_CODE (TREE_TYPE (templ)) == TYPENAME_TYPE)
     {
       /* Some type template in dependent scope.  */
-      tree &name = TYPENAME_TYPE_FULLNAME (TREE_TYPE (templ));
-      name = build_min_nt_loc (combined_loc,
-			       TEMPLATE_ID_EXPR,
-			       name, arguments);
+      tree fullname = TYPENAME_TYPE_FULLNAME (TREE_TYPE (templ));
+      fullname = build_min_nt_loc (combined_loc,
+				   TEMPLATE_ID_EXPR,
+				   fullname, arguments);
+      TREE_TYPE (templ)
+	= build_typename_type (TYPE_CONTEXT (TREE_TYPE (templ)),
+			       TYPE_NAME (TREE_TYPE (templ)),
+			       fullname,
+			       get_typename_tag (TREE_TYPE (templ)));
       template_id = templ;
     }
   else