[PATCH v2] c++: wrong std::is_convertible with cv-qual fn [PR109680]

[Marek Polacek <polacek@redhat.com>]

On Wed, May 03, 2023 at 03:37:03PM -0400, Jason Merrill wrote:
> On 5/2/23 19:10, Marek Polacek wrote:
> > This PR points out that std::is_convertible has given the wrong answer
> > in
> > 
> >    static_assert (!std::is_convertible_v <int () const, int (*) ()>, "");
> > 
> > since r13-2822 implemented __is_{,nothrow_}convertible.
> > 
> > std::is_convertible uses the imaginary
> > 
> >    To test() { return std::declval<From>(); }
> > 
> > to do its job.  Here, From is 'int () const'.  std::declval is defined as:
> > 
> >    template<class T>
> >    typename std::add_rvalue_reference<T>::type declval() noexcept;
> > 
> > std::add_rvalue_reference is defined as "If T is a function type that
> > has no cv- or ref- qualifier or an object type, provides a member typedef
> > type which is T&&, otherwise type is T."
> > 
> > In our case, T is cv-qualified, so the result is T, so we end up with
> > 
> >    int () const declval() noexcept;
> > 
> > which is invalid.  In other words, this is pretty much like:
> > 
> >    using T = int () const;
> >    T fn1(); // bad, fn returning a fn
> >    T& fn2(); // bad, cannot declare reference to qualified function type
> >    T* fn3(); // bad, cannot declare pointer to qualified function type
> > 
> >    using U = int ();
> >    U fn4(); // bad, fn returning a fn
> >    U& fn5(); // OK
> >    U* fn6(); // OK
> > 
> > I think is_convertible_helper needs to simulate std::declval better.
> > I wouldn't be surprised if other type traits needed a similar fix.
> > 
> > Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk/13?
> > 
> > I've tested the new test with G++12 and clang++ as well (with
> > std::is_convertible).
> > 
> > 	PR c++/109680
> > 
> > gcc/cp/ChangeLog:
> > 
> > 	* method.cc (is_convertible_helper): Correct simulating std::declval.
> > 
> > gcc/testsuite/ChangeLog:
> > 
> > 	* g++.dg/ext/is_convertible6.C: New test.
> > ---
> >   gcc/cp/method.cc                           | 20 ++++++++++++++++++++
> >   gcc/testsuite/g++.dg/ext/is_convertible6.C | 16 ++++++++++++++++
> >   2 files changed, 36 insertions(+)
> >   create mode 100644 gcc/testsuite/g++.dg/ext/is_convertible6.C
> > 
> > diff --git a/gcc/cp/method.cc b/gcc/cp/method.cc
> > index 00eae56eb5b..38eb7520312 100644
> > --- a/gcc/cp/method.cc
> > +++ b/gcc/cp/method.cc
> > @@ -2245,6 +2245,26 @@ is_convertible_helper (tree from, tree to)
> >   {
> >     if (VOID_TYPE_P (from) && VOID_TYPE_P (to))
> >       return integer_one_node;
> > +  /* std::is_{,nothrow_}convertible test whether the imaginary function
> > +     definition
> > +
> > +       To test() { return std::declval<From>(); }
> > +
> > +     is well-formed.  A function can't return a function...  */
> > +  if (FUNC_OR_METHOD_TYPE_P (to)
> > +      /* ...neither can From be a function with cv-/ref-qualifiers:
> > +	 std::declval is defined as
> > +
> > +	  template<class T>
> > +	  typename std::add_rvalue_reference<T>::type declval() noexcept;
> > +
> > +	and std::add_rvalue_reference yields T when T is a function with
> > +	cv- or ref-qualifiers, making the definition ill-formed.
> > +	??? Should we check this in other uses of build_stub_object too?  */
> 
> Probably we want a build_trait_object that wraps build_stub_object with
> these extra checks, or does something that exercises more of the normal
> code, maybe by tsubsting into T (U&&) with { to, from }?

I did the former.  We only have the To type when processing
__is_convertible, so I think that can't be part of the declval
function, which takes another type, From.  IOW, if we want to factor
declval out, build_trait_object will take only one type.  Eh, that
still sounds confusing.  But the patch is simple.

Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?

-- >8 --
This PR points out that std::is_convertible has given the wrong answer
in

  static_assert (!std::is_convertible_v <int () const, int (*) ()>, "");

since r13-2822 implemented __is_{,nothrow_}convertible.

std::is_convertible uses the imaginary

  To test() { return std::declval<From>(); }

to do its job.  Here, From is 'int () const'.  std::declval is defined as:

  template<class T>
  typename std::add_rvalue_reference<T>::type declval() noexcept;

std::add_rvalue_reference is defined as "If T is a function type that
has no cv- or ref- qualifier or an object type, provides a member typedef
type which is T&&, otherwise type is T."

In our case, T is cv-qualified, so the result is T, so we end up with

  int () const declval() noexcept;

which is invalid.  In other words, this is pretty much like:

  using T = int () const;
  T fn1(); // bad, fn returning a fn
  T& fn2(); // bad, cannot declare reference to qualified function type
  T* fn3(); // bad, cannot declare pointer to qualified function type

  using U = int ();
  U fn4(); // bad, fn returning a fn
  U& fn5(); // OK
  U* fn6(); // OK

I think is_convertible_helper needs to simulate std::declval better.
To that end, I'm introducing build_trait_object, to be used where
a declval is needed.

	PR c++/109680

gcc/cp/ChangeLog:

	* method.cc (build_trait_object): New.
	(assignable_expr): Use it.
	(ref_xes_from_temporary): Likewise.
	(is_convertible_helper): Likewise.  Check FUNC_OR_METHOD_TYPE_P.

gcc/testsuite/ChangeLog:

	* g++.dg/ext/is_convertible6.C: New test.
---
 gcc/cp/method.cc                           | 39 +++++++++++++++++++---
 gcc/testsuite/g++.dg/ext/is_convertible6.C | 16 +++++++++
 2 files changed, 51 insertions(+), 4 deletions(-)
 create mode 100644 gcc/testsuite/g++.dg/ext/is_convertible6.C

diff --git a/gcc/cp/method.cc b/gcc/cp/method.cc
index 00eae56eb5b..7ec7bfe8387 100644
--- a/gcc/cp/method.cc
+++ b/gcc/cp/method.cc
@@ -1902,6 +1902,27 @@ build_stub_object (tree reftype)
   return convert_from_reference (stub);
 }
 
+/* Build a std::declval<TYPE>() expression and return it.  */
+
+tree
+build_trait_object (tree type)
+{
+  /* TYPE can't be a function with cv-/ref-qualifiers: std::declval is
+     defined as
+
+       template<class T>
+       typename std::add_rvalue_reference<T>::type declval() noexcept;
+
+     and std::add_rvalue_reference yields T when T is a function with
+     cv- or ref-qualifiers, making the definition ill-formed.  */
+  if (FUNC_OR_METHOD_TYPE_P (type)
+      && (type_memfn_quals (type) != TYPE_UNQUALIFIED
+	  || type_memfn_rqual (type) != REF_QUAL_NONE))
+    return error_mark_node;
+
+  return build_stub_object (type);
+}
+
 /* Determine which function will be called when looking up NAME in TYPE,
    called with a single ARGTYPE argument, or no argument if ARGTYPE is
    null.  FLAGS and COMPLAIN are as for build_new_method_call.
@@ -2050,8 +2071,8 @@ static tree
 assignable_expr (tree to, tree from)
 {
   cp_unevaluated cp_uneval_guard;
-  to = build_stub_object (to);
-  from = build_stub_object (from);
+  to = build_trait_object (to);
+  from = build_trait_object (from);
   tree r = cp_build_modify_expr (input_location, to, NOP_EXPR, from, tf_none);
   return r;
 }
@@ -2231,7 +2252,9 @@ ref_xes_from_temporary (tree to, tree from, bool direct_init_p)
     return false;
   /* We don't check is_constructible<T, U>: if T isn't constructible
      from U, we won't be able to create a conversion.  */
-  tree val = build_stub_object (from);
+  tree val = build_trait_object (from);
+  if (val == error_mark_node)
+    return false;
   if (!TYPE_REF_P (from) && TREE_CODE (from) != FUNCTION_TYPE)
     val = CLASS_TYPE_P (from) ? force_rvalue (val, tf_none) : rvalue (val);
   return ref_conv_binds_to_temporary (to, val, direct_init_p).is_true ();
@@ -2246,7 +2269,15 @@ is_convertible_helper (tree from, tree to)
   if (VOID_TYPE_P (from) && VOID_TYPE_P (to))
     return integer_one_node;
   cp_unevaluated u;
-  tree expr = build_stub_object (from);
+  tree expr = build_trait_object (from);
+  /* std::is_{,nothrow_}convertible test whether the imaginary function
+     definition
+
+       To test() { return std::declval<From>(); }
+
+     is well-formed.  A function can't return a function.  */
+  if (FUNC_OR_METHOD_TYPE_P (to) || expr == error_mark_node)
+    return error_mark_node;
   deferring_access_check_sentinel acs (dk_no_deferred);
   return perform_implicit_conversion (to, expr, tf_none);
 }
diff --git a/gcc/testsuite/g++.dg/ext/is_convertible6.C b/gcc/testsuite/g++.dg/ext/is_convertible6.C
new file mode 100644
index 00000000000..180582663e8
--- /dev/null
+++ b/gcc/testsuite/g++.dg/ext/is_convertible6.C
@@ -0,0 +1,16 @@
+// PR c++/109680
+// { dg-do compile { target c++11 } }
+
+#define SA(X) static_assert((X),#X)
+
+SA(!__is_convertible(int () const, int (*)()));
+SA(!__is_convertible(int (*)(), int () const));
+
+SA( __is_convertible(int (), int (*)()));
+SA(!__is_convertible(int (*)(), int ()));
+
+SA( __is_convertible(int (int), int (*) (int)));
+SA(!__is_convertible(int (*) (int), int (int)));
+
+SA(!__is_convertible(int (int) const, int (*) (int)));
+SA(!__is_convertible(int (*) (int), int (int) const));

base-commit: bdc10c2bfaceb3be567e0a27d8951a22b4be2ed4
-- 
2.40.1