From 4192ffd74c69e3fb6d761becc8e5117c3de42052 Mon Sep 17 00:00:00 2001
From: Marek Polacek <polacek@redhat.com>
Date: Mon, 30 Nov 2020 14:53:24 -0500
Subject: [PATCH] c++: Fix tsubst ICE with invalid code [PR97993, PR97187]

I had a strong sense of deja vu when looking into this, and no wonder,
since this is almost identical to c++/95728.

Since r11-423 tsubst_copy_and_build/TREE_LIST uses tsubst_tree_list
instead of open coding it.  While the latter could return an error
node wrapped in a TREE_LIST, the former can return a naked error node.

That broke in tsubst_copy_and_build/NEW_EXPR, because we were accessing
TREE_VALUE of an error node.

gcc/cp/ChangeLog:

	PR c++/97187
	PR c++/97993
	* pt.c (tsubst_copy_and_build) <case NEW_EXPR>: Return error_mark_node
	if init is erroneous.

gcc/testsuite/ChangeLog:

	PR c++/97187
	PR c++/97993
	* g++.dg/eh/crash2.C: New test.
	* g++.dg/template/crash132.C: New test.
---
 gcc/cp/pt.c                              |  2 ++
 gcc/testsuite/g++.dg/eh/crash2.C         | 20 ++++++++++++++++++++
 gcc/testsuite/g++.dg/template/crash132.C |  6 ++++++
 3 files changed, 28 insertions(+)
 create mode 100644 gcc/testsuite/g++.dg/eh/crash2.C
 create mode 100644 gcc/testsuite/g++.dg/template/crash132.C

diff --git a/gcc/cp/pt.c b/gcc/cp/pt.c
index 4fb0bc82c31..72d6cc3ad98 100644
--- a/gcc/cp/pt.c
+++ b/gcc/cp/pt.c
@@ -19829,6 +19829,8 @@ tsubst_copy_and_build (tree t,
 	   parameter packs are of length zero.  */
 	if (init == NULL_TREE && TREE_OPERAND (t, 3) == NULL_TREE)
 	  init_vec = NULL;
+	else if (init == error_mark_node)
+	  RETURN (error_mark_node);
 	else
 	  {
 	    init_vec = make_tree_vector ();
diff --git a/gcc/testsuite/g++.dg/eh/crash2.C b/gcc/testsuite/g++.dg/eh/crash2.C
new file mode 100644
index 00000000000..fff8e142fd6
--- /dev/null
+++ b/gcc/testsuite/g++.dg/eh/crash2.C
@@ -0,0 +1,20 @@
+// PR c++/97187
+// { dg-do compile { target c++14 } }
+// { dg-options "-fno-exceptions" }
+
+auto yp = [] { return 0; };
+
+template <class DI>
+DI
+zl ()
+{
+  auto au = [] () -> DI { return *new auto (true ? yp : throw); }; // { dg-error "exception handling disabled" }
+
+  return au ();
+}
+
+auto
+vd ()
+{
+  return zl <decltype (yp)> ();
+}
diff --git a/gcc/testsuite/g++.dg/template/crash132.C b/gcc/testsuite/g++.dg/template/crash132.C
new file mode 100644
index 00000000000..f6f4863e937
--- /dev/null
+++ b/gcc/testsuite/g++.dg/template/crash132.C
@@ -0,0 +1,6 @@
+// PR c++/97993
+// { dg-do compile { target c++14 } }
+
+template <class T> T a;
+template <class T, class A, class=decltype(::new T (A()))> auto foo ();
+struct S decltype (foo <int, S>); // { dg-error "" }
-- 
2.30.2