https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70344
--- Comment #3 from Patrick Palka <ppalka at gcc dot gnu.org> --- Problem ultimately seems to be that we're calling cp_fold_function on fn() before we call cp_genericize on it which is responsible for fixing up fn()'s parameter 'v' which is passed by invisible reference. The TREE_TYPE of v is a RECORD_TYPE before the fix-up, but after the fix-up it's a REFERENCE_TYPE to a RECORD_TYPE. The 1st argument to the recursive call to fn() however is a REFERENCE_TYPE. So in cxx_eval_call_expression (called indirectly from cp_fold_function) we see that fn() expects a RECORD_TYPE (because its parms haven't been fixed up yet) but the call passes a REFERENCE_TYPE. This type confusion triggers the ICE.
