[Bug c++/111299] New: lack of warning on dangling reference to temporary

["barry.revzin at gmail dot com" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111299

            Bug ID: 111299
           Summary: lack of warning on dangling reference to temporary
           Product: gcc
           Version: 13.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: barry.revzin at gmail dot com
  Target Milestone: ---

Consider the following reduced example:

using size_t = decltype(sizeof(0));

template <typename T, size_t N>
struct array {
    T elems[N];

    auto data() -> T* { return elems; }
    auto data() const -> T const* { return elems; }

    auto size() const -> size_t { return N; }
};

template <typename T>
struct Span {
    T* p;
    size_t len;

    Span(T* p, size_t len) : p(p), len(len) { }

    template <typename R>
    Span(R&& r) : p(r.data()), len(r.size()) { }
};

struct [[gnu::packed]] X {
    array<int, 1> value;
};

auto get_slice_ref(X const& x) {
    return Span<int const>(x.value);
}

auto get_slice_ptr(X const& x) {
    return Span<int const>(x.value.data(), 1);
}


Span<T> is a heavily reduced version of std::span: no fixed extent, no
constraints, etc.

X is a packed struct with a single array member.

Neither version (get_slice_ptr or get_slice_ref) emits any warnings on gcc,
with -Wall -Wextra -Wdangling-reference. 

But the -DREF version is horribly broken. What ends up happening is that in
order to bind x.value to the reference parameter R&& r, we can't actually do
that, so instead we create a temporary initialized by copying x.value and we
bind a reference to that temporary, returning a Span pointing to... that. Which
immediately goes out of scope and we end up with a dangling Span.

You can see the broken-ness in the codegen (https://godbolt.org/z/zY77eresb).
The pointer version does the right thing:

get_slice_ptr(X const&):
        mov     rax, rdi
        mov     edx, 1
        ret

The ref version gives me some garbage:

get_slice_ref(X const&):
        lea     rax, [rsp-12]
        mov     edx, 1
        ret

It would be really helpful if I had any indication that something is going
wrong here.