From e82f9ef748f25bbbdc9821efcb287ab1b48dd066 Mon Sep 17 00:00:00 2001
From: Martin Sebor <msebor@redhat.com>
Date: Thu, 26 Nov 2015 01:52:04 +0000
Subject: [PATCH] PR c++/67876 - [6 Regression] ICE when compiling Firefox 38

gcc/cp
	* pt.c (convert_template_argument): Make sure number of tree
	operands is greater than zero before attempting to extract one.

gcc/testsuite/
	* g++.dg/pr67876.C: New test.

From-SVN: r230924
---
 gcc/cp/ChangeLog               | 10 ++++++++--
 gcc/cp/pt.c                    |  1 +
 gcc/testsuite/ChangeLog        |  5 +++++
 gcc/testsuite/g++.dg/pr67876.C | 32 ++++++++++++++++++++++++++++++++
 4 files changed, 46 insertions(+), 2 deletions(-)
 create mode 100644 gcc/testsuite/g++.dg/pr67876.C

diff --git a/gcc/cp/ChangeLog b/gcc/cp/ChangeLog
index 52ca12f77f9..82a29a3b0f6 100644
--- a/gcc/cp/ChangeLog
+++ b/gcc/cp/ChangeLog
@@ -1,3 +1,9 @@
+2015-11-25  Martin Sebor  <msebor@redhat.com>
+
+	PR c++/67876
+	* pt.c (convert_template_argument): Make sure number of tree
+	operands is greater than zero before attempting to extract one.
+
 2015-11-25  Ryan Burn  <contact@rnburn.com>
 
 	PR c++/68434
@@ -369,10 +375,10 @@
 	(cp_parser_pragma): Adjust omp_declare_simd checking.  Call
 	cp_ensure_no_oacc_routine.
 	(cp_parser_pragma): Add OpenACC routine handling.
-	
+
 2015-11-08  Martin Sebor  <msebor@redhat.com>
 
-	PR c++/67942 
+	PR c++/67942
 	* cp/init.c (warn_placement_new_too_small): Convert integer
 	operand of POINTER_PLUS_EXPR to ssize_t to determine its signed
 	value.
diff --git a/gcc/cp/pt.c b/gcc/cp/pt.c
index 24322837326..5befd644c09 100644
--- a/gcc/cp/pt.c
+++ b/gcc/cp/pt.c
@@ -7234,6 +7234,7 @@ convert_template_argument (tree parm,
           if (TREE_CODE (TREE_TYPE (inner)) == REFERENCE_TYPE
               && TREE_CODE (TREE_TYPE (TREE_TYPE (inner))) == FUNCTION_TYPE
               && TREE_CODE (TREE_TYPE (inner)) == REFERENCE_TYPE
+              && 0 < TREE_OPERAND_LENGTH (inner)
               && reject_gcc_builtin (TREE_OPERAND (inner, 0)))
               return error_mark_node;
         }
diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 41804b98efc..9d022fce86b 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,8 @@
+2015-11-25  Martin Sebor  <msebor@redhat.com>
+
+	PR c++/67876
+	* g++.dg/pr67876.C: New test.
+
 2015-11-25  Aditya Kumar  <aditya.k7@samsung.com>
 	    Sebastian Pop  <s.pop@samsung.com>
 
diff --git a/gcc/testsuite/g++.dg/pr67876.C b/gcc/testsuite/g++.dg/pr67876.C
new file mode 100644
index 00000000000..5d62b5ae742
--- /dev/null
+++ b/gcc/testsuite/g++.dg/pr67876.C
@@ -0,0 +1,32 @@
+// PR c++/67876 - [6 Regression] ICE when compiling Firefox 38
+// Caused by a patch for c/66516 - missing diagnostic on taking
+// the address of a builtin function
+// { dg-do compile }
+
+template <class T, void (&F)(T*)>
+struct S { };
+
+extern void foo (int*);
+
+template <class T, void (&F)(T*)>
+void bar (S<T, F>&s) { }
+
+S<int, foo> s;
+
+void foobar (S<int, foo> &s) { bar (s); }
+// PR c++/67876 - [6 Regression] ICE when compiling Firefox 38
+// Caused by a patch for c/66516 - missing diagnostic on taking
+// the address of a builtin function
+// { dg-do compile }
+
+template <class T, void (&F)(T*)>
+struct S { };
+
+extern void foo (int*);
+
+template <class T, void (&F)(T*)>
+void bar (S<T, F>&s) { }
+
+S<int, foo> s;
+
+void foobar (S<int, foo> &s) { bar (s); }
-- 
2.30.2