https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90172
Jakub Jelinek <jakub at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jason at gcc dot gnu.org --- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> --- So, I guess the rejects-valid part is a P2 8/9 regression (if the testcase is really valid) and the ICE is error recovery regression for that (9 only). For the latter, I guess something like: --- gcc/cp/pt.c.jj 2019-04-22 16:03:23.000000000 +0200 +++ gcc/cp/pt.c 2019-04-23 17:21:01.898950417 +0200 @@ -18869,7 +18869,8 @@ tsubst_copy_and_build (tree t, /* We aren't going to do normal overload resolution, so force the template-id to resolve. */ function = resolve_nondeduced_context (function, complain); - for (unsigned i = 0; i < nargs; ++i) + unsigned int n_call_args = call_args->length (); + for (unsigned i = 0; i < n_call_args; ++i) { /* In a thunk, pass through args directly, without any conversions. */ @@ -18881,9 +18882,10 @@ tsubst_copy_and_build (tree t, if (thisarg) { /* Shift the other args over to make room. */ - vec_safe_push (call_args, (*call_args)[nargs-1]); - for (int i = nargs-1; i > 0; --i) - (*call_args)[i] = (*call_args)[i-1]; + tree last_arg = (*call_args)[n_call_args - 1]; + vec_safe_push (call_args, last_arg); + for (int i = n_call_args - 1; i > 0; --i) + (*call_args)[i] = (*call_args)[i - 1]; (*call_args)[0] = thisarg; } ret = build_call_a (function, call_args->length (), could do the job, nargs doesn't take into account if there are more arguments in call_args due to some pack expansion and also the vec_safe_push is broken because (*call_args)[nargs-1] is just a reference and trying to push it if it needs to reallocate is broken. I have no idea if n_call_args could be 0 and thisarg non-NULL, if yes, we need to just vec_safe_push (call_args, thisarg); in that case instead of moving anything.