Jason, this is another case cought by the type variant checking. build_ptrmemfunc_type, for qualified type, first calls itself recursively to produce member pointer type for unqalified variant.
Subsequentely it produces the member pointer from scratch - I believe it is because the field decl representing pointer should be qualified, so we have rather rare case where we do not share fields in between type and variant (other is Fortran when dropping restrict quantifiers deeply from the structure). It however produces fresh BINFO for the variant and overwrites its BINFO_TYPE pointer to t. I do not see a reason for having duplicated binfo here: both structures should be equivalent from type inheritance POV. This patch just avoids the duplicated BINFO and copies one from unqalified variant, if available. Seems sane? Bootstrapped/regtested x86_64-linux. * decl.c (build_ptrmemfunc_type): Do not produce duplicated BINFO for the variant. Index: cp/decl.c =================================================================== --- cp/decl.c (revision 212098) +++ cp/decl.c (working copy) @@ -8074,7 +8074,6 @@ build_ptrmemfunc_type (tree type) = build_ptrmemfunc_type (TYPE_MAIN_VARIANT (type)); t = make_class_type (RECORD_TYPE); - xref_basetypes (t, NULL_TREE); /* Let the front end know this is a pointer to member function... */ TYPE_PTRMEMFUNC_FLAG (t) = 1; @@ -8109,8 +8108,10 @@ build_ptrmemfunc_type (tree type) TYPE_MAIN_VARIANT (t) = unqualified_variant; TYPE_NEXT_VARIANT (t) = TYPE_NEXT_VARIANT (unqualified_variant); TYPE_NEXT_VARIANT (unqualified_variant) = t; - TREE_TYPE (TYPE_BINFO (t)) = t; + TYPE_BINFO (t) = TYPE_BINFO (unqualified_variant); } + else + xref_basetypes (t, NULL_TREE); /* Cache this pointer-to-member type so that we can find it again later. */