Related: <rdar://problem/10832617>

Here's a smaller test case, also reduced from well-formed code:

template <class C> struct scoped_array {
  scoped_array(C* p = __null);
};
template <class Payload> struct Foo {
  Foo() : a_(new scoped_array<int>[5]) { }
  scoped_array< scoped_array<int> > a_;
};
class Bar {};
Foo<Bar> x;

This breaks chrome too. Here's the reduced test case for that:

class MessageLoop {
public:
  explicit MessageLoop(int type = 0);
};

template <class CookieStoreTestTraits>
class CookieStoreTest {
protected:
  CookieStoreTest() {
    new MessageLoop;
  }
};

struct CookieMonsterTestTraits {
};

class DeferredCookieTaskTest : public CookieStoreTest<CookieMonsterTestTraits> {
  DeferredCookieTaskTest() {}
};

Fixed in r151146. Now compiles Matt's and Nico's test cases cleanly, and doesn't crash on Ted's (there's no way to compile that one cleanly). Also works with a variant of Matt's case with two default arguments.

*** Bug 12065 has been marked as a duplicate of this bug. ***

*** Bug 12065 has been marked as a duplicate of this bug. ***