https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107360
Bug ID: 107360 Summary: ICE on sizeof(*f(x)) when f's (deduced) return type is a pointer to VLA Product: gcc Version: 12.2.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: c++ Assignee: unassigned at gcc dot gnu.org Reporter: izbyshev at ispras dot ru Target Milestone: --- auto f(int n) { int (*a)[n] = 0; return a; } int g() { return sizeof *f(1); } Output of GCC 12.2: during RTL pass: expand <source>: In function 'int g()': <source>:7:23: internal compiler error: in expand_expr_real_1, at expr.cc:10586 7 | return sizeof *f(1); | ^ 0x1bb069e internal_error(char const*, ...) ???:0 0x6ff396 fancy_abort(char const*, int, char const*) ???:0 0xab97bd expand_expr_real_2(separate_ops*, rtx_def*, machine_mode, expand_modifier) ???:0 0xaab144 expand_expr_real_1(tree_node*, rtx_def*, machine_mode, expand_modifier, rtx_def**, bool) ???:0 0xab97bd expand_expr_real_2(separate_ops*, rtx_def*, machine_mode, expand_modifier) ???:0 0xaab144 expand_expr_real_1(tree_node*, rtx_def*, machine_mode, expand_modifier, rtx_def**, bool) ???:0 0xab38c4 expand_operands(tree_node*, tree_node*, rtx_def*, rtx_def**, rtx_def**, expand_modifier) ???:0 0xaba7ac expand_expr_real_2(separate_ops*, rtx_def*, machine_mode, expand_modifier) ???:0 0xaab144 expand_expr_real_1(tree_node*, rtx_def*, machine_mode, expand_modifier, rtx_def**, bool) ???:0 0xabb2c9 expand_expr_real_2(separate_ops*, rtx_def*, machine_mode, expand_modifier) ???:0 0xaab144 expand_expr_real_1(tree_node*, rtx_def*, machine_mode, expand_modifier, rtx_def**, bool) ???:0 All versions supporting C++14 return type deduction (i.e. since 4.8) produce ICE, except 4.9, which generates wrong code for g() instead (it returns 1 regardless of f's argument).