https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70617
--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> --- (gdb) p p $2 = (const void *) 0x1f0 is the TREE_TYPE of a CEIL_MOD_EXPR. That looks like a bogus pointer to me. That CEIL_MOD_EXPR is at 0x7ffff5bd0b48. It's first allocated as TYPE_DECL for me, then as lang-specific via cxx_make_type for a UNION_TYPE (0x7ffff5bd2150). We end up coming here via walking CP binding levels TYPE_NAME (TREE_TYPE (TREE_VALUE (TYPE_ARG_TYPES (TYPE_CANONICAL (TREE_TYPE (FUNCTION_DECL)))))) and then that TYPE_NAME is CEIL_MOD_EXPR. bool <Tab14> (struct tVfpPacketDesc *, unsigned char, const struct VFP_INGRESS_PORT_RECORD *, unsigned int, struct t_ing_zeroed *, unsigned int *, unsigned int *, unsigned int *, const struct INTERFACE_DEST_INFO * *, union IP_ADDRESS_AND_L2TP *, struct t_ing_p1_flags *, union IPV6_ADDRESS *, struct t_ing_tunnel_info *, struct INGRESS_VRF_RECORD *, unsigned int, const struct INGRESS_ILM_RECORD *, unsigned char, struct INTERFACE_DEST_INFO *, unsigned int, short unsigned int, short unsigned int, struct DPISUB_VFP_INFO *, const struct VFP_INGRESS_SAP_INFO *, struct t_ing_qos *, const struct DEST_INDICES *, struct t_ing_special_ucast_l3_info *) #5 0x000000000090923b in gt_ggc_mx_lang_tree_node (x_p=0x7ffff4137d20) at ./gt-cp-tree.h:543 543 gt_ggc_m_9tree_node ((*x).generic.type_non_common.with_lang_specific.common.common.typed.type); (gdb) p debug_generic_expr ((tree)x) struct tVfpPacketDesc * $43 = void (gdb) down #4 0x00000000009093c9 in gt_ggc_mx_lang_tree_node (x_p=0x7ffff40f9348) at ./gt-cp-tree.h:567 567 gt_ggc_m_9tree_node ((*x).generic.type_non_common.with_lang_specific.common.name); (gdb) p debug_generic_expr ((tree)x) struct %[cl] $44 = void looking at how TYPE_NAME of that record evolves. I suspect it should have remained the TYPE_DECL and not released to be re-allocated as lang-specific data. Ok, so I think this is a dup of PR70297.