https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97419
--- Comment #3 from Steve Fink <sphink at gmail dot com> --- This invokes decl_as_string(decl, TFF_DECL_SPECIFIERS | TFF_CHASE_TYPEDEF) TREE_CODE(decl) is FUNCTION_DECL. dump_function_decl(decl) is attempting to render the return type of the function. It's in a local variable `ret` from ret = fndecl_declared_return_type (t); TREE_CODE(ret) is DECLTYPE_TYPE. dump_type(ret) checks typedef_variant(p), which is true, and TFF_CHASE_TYPEDEF was given, so it calls strip_typedefs(ret). strip_typedefs recurses through many layers, though I think that's for other parts of the type. gdb gets a little confused stepping through this stuff, so it's hard for me to tell. The final crash stack makes it seem like it's all in the finish_decltype_type() of the INDIRECT_REF in the DECLTYPE_TYPE return value, though. Oh, shoot. I still haven't attached the most important thing, the crash stack.