c++: bound ttp in lambda function type [PR109651]

After r14-11-g2245459c85a3f4 we now coerce the template arguments of a
bound ttp again after level-lowering it.  Notably a level-lowered ttp
doesn't have DECL_CONTEXT set, so during this coercion we fall back to
using current_template_parms to obtain the relevant set of in-scope
parameters.

But it turns out current_template_parms isn't properly set when
substituting the function type of a generic lambda, and so if the type
contains bound ttps that need to be lowered we'll crash during their
attempted coercion.  Specifically in the first testcase below,
current_template_parms during the lambda type substitution (with T=int)
is "1 U" instead of the expected "2 TT, 1 U", and we crash when level
lowering TT<int>.

Ultimately the problem is that tsubst_lambda_expr does things in the
wrong order: we ought to substitute (and install) the in-scope template
parameters _before_ substituting anything that may use those template
parameters (such as the function type of a generic lambda).  This patch
corrects this substitution order.

	PR c++/109651

gcc/cp/ChangeLog:

	* pt.cc (coerce_template_args_for_ttp): Mention we can hit the
	current_template_parms fallback when level-lowering a bound ttp.
	(tsubst_template_decl): Add lambda_tparms parameter.  Prefer to
	use lambda_tparms instead of substituting DECL_TEMPLATE_PARMS.
	(tsubst_decl) <case TEMPLATE_DECL>: Pass NULL_TREE as lambda_tparms
	to tsubst_template_decl.
	(tsubst_lambda_expr): For a generic lambda, substitute
	DECL_TEMPLATE_PARMS and set current_template_parms to it
	before substituting the function type.  Pass the substituted
	DECL_TEMPLATE_PARMS as lambda_tparms to tsubst_template_decl.

gcc/testsuite/ChangeLog:

	* g++.dg/cpp2a/lambda-generic-ttp1.C: New test.
	* g++.dg/cpp2a/lambda-generic-ttp2.C: New test.

3 files changed, 50 insertions, 8 deletions

diff --git a/gcc/cp/pt.cc b/gcc/cp/pt.cc
index 0f4fb25..ee4a2f3 100644
--- a/gcc/cp/pt.cc
+++ b/gcc/cp/pt.cc
@@ -7880,7 +7880,8 @@ coerce_template_args_for_ttp (tree templ, tree arglist,
   else if (current_template_parms)
     {
       /* This is an argument of the current template, so we haven't set
-	 DECL_CONTEXT yet.  */
+	 DECL_CONTEXT yet.  We can also get here when level-lowering a
+	 bound ttp. */
       tree relevant_template_parms;
 
       /* Parameter levels that are greater than the level of the given
@@ -14614,7 +14615,7 @@ tsubst_function_decl (tree t, tree args, tsubst_flags_t complain,
 
 static tree
 tsubst_template_decl (tree t, tree args, tsubst_flags_t complain,
-		      tree lambda_fntype)
+		      tree lambda_fntype, tree lambda_tparms)
 {
   /* We can get here when processing a member function template,
      member class template, or template template parameter.  */
@@ -14704,8 +14705,10 @@ tsubst_template_decl (tree t, tree args, tsubst_flags_t complain,
   auto tparm_guard = make_temp_override (current_template_parms);
   DECL_TEMPLATE_PARMS (r)
     = current_template_parms
-    = tsubst_template_parms (DECL_TEMPLATE_PARMS (t), args,
-			     complain);
+    = (lambda_tparms
+       ? lambda_tparms
+       : tsubst_template_parms (DECL_TEMPLATE_PARMS (t), args,
+				complain));
 
   bool class_p = false;
   tree inner = decl;
@@ -14876,7 +14879,9 @@ tsubst_decl (tree t, tree args, tsubst_flags_t complain)
   switch (TREE_CODE (t))
     {
     case TEMPLATE_DECL:
-      r = tsubst_template_decl (t, args, complain, /*lambda*/NULL_TREE);
+      r = tsubst_template_decl (t, args, complain,
+				/*lambda_fntype=*/NULL_TREE,
+				/*lambda_tparms=*/NULL_TREE);
       break;
 
     case FUNCTION_DECL:
@@ -20121,12 +20126,24 @@ tsubst_lambda_expr (tree t, tree args, tsubst_flags_t complain, tree in_decl)
 		  ? DECL_TI_TEMPLATE (oldfn)
 		  : NULL_TREE);
 
+  tree tparms = NULL_TREE;
+  if (oldtmpl)
+    tparms = tsubst_template_parms (DECL_TEMPLATE_PARMS (oldtmpl), args, complain);
+
   tree fntype = static_fn_type (oldfn);
+
+  tree saved_ctp = current_template_parms;
   if (oldtmpl)
-    ++processing_template_decl;
+    {
+      ++processing_template_decl;
+      current_template_parms = tparms;
+    }
   fntype = tsubst (fntype, args, complain, in_decl);
   if (oldtmpl)
-    --processing_template_decl;
+    {
+      current_template_parms = saved_ctp;
+      --processing_template_decl;
+    }
 
   if (fntype == error_mark_node)
     r = error_mark_node;
@@ -20142,7 +20159,8 @@ tsubst_lambda_expr (tree t, tree args, tsubst_flags_t complain, tree in_decl)
 				 type_memfn_quals (fntype),
 				 type_memfn_rqual (fntype));
       tree inst = (oldtmpl
-		   ? tsubst_template_decl (oldtmpl, args, complain, fntype)
+		   ? tsubst_template_decl (oldtmpl, args, complain,
+					   fntype, tparms)
 		   : tsubst_function_decl (oldfn, args, complain, fntype));
       if (inst == error_mark_node)
 	{
diff --git a/gcc/testsuite/g++.dg/cpp2a/lambda-generic-ttp1.C b/gcc/testsuite/g++.dg/cpp2a/lambda-generic-ttp1.C
new file mode 100644
index 0000000..27b56fc
--- /dev/null
+++ b/gcc/testsuite/g++.dg/cpp2a/lambda-generic-ttp1.C
@@ -0,0 +1,11 @@
+// PR c++/109651
+// { dg-do compile { target c++20 } }
+
+template<class T>
+void f() {
+  []<class U>(U) {
+    []<template<class> class TT>(TT<int>) { };
+  }(0);
+}
+
+template void f<int>();
diff --git a/gcc/testsuite/g++.dg/cpp2a/lambda-generic-ttp2.C b/gcc/testsuite/g++.dg/cpp2a/lambda-generic-ttp2.C
new file mode 100644
index 0000000..dc2029d
--- /dev/null
+++ b/gcc/testsuite/g++.dg/cpp2a/lambda-generic-ttp2.C
@@ -0,0 +1,13 @@
+// PR c++/109651
+// { dg-do compile { target c++20 } }
+
+template<class T>
+auto f() {
+  return []<class U, template<class V, U, V> class TT>(U, TT<int, 1, 2>) { };
+}
+
+template<class T, int N, int M> struct A { };
+
+int main() {
+  f<int>()(0, A<int, 1, 2>{});
+}