[PATCH] c++: wrong std::is_convertible with cv-qual fn [PR109680]

[PATCH] c++: wrong std::is_convertible with cv-qual fn [PR109680]

[Marek Polacek]

This PR points out that std::is_convertible has given the wrong answer
in

  static_assert (!std::is_convertible_v <int () const, int (*) ()>, "");

since r13-2822 implemented __is_{,nothrow_}convertible.

std::is_convertible uses the imaginary

  To test() { return std::declval<From>(); }

to do its job.  Here, From is 'int () const'.  std::declval is defined as:

  template<class T>
  typename std::add_rvalue_reference<T>::type declval() noexcept;

std::add_rvalue_reference is defined as "If T is a function type that
has no cv- or ref- qualifier or an object type, provides a member typedef
type which is T&&, otherwise type is T."

In our case, T is cv-qualified, so the result is T, so we end up with

  int () const declval() noexcept;

which is invalid.  In other words, this is pretty much like:

  using T = int () const;
  T fn1(); // bad, fn returning a fn
  T& fn2(); // bad, cannot declare reference to qualified function type
  T* fn3(); // bad, cannot declare pointer to qualified function type

  using U = int ();
  U fn4(); // bad, fn returning a fn
  U& fn5(); // OK
  U* fn6(); // OK

I think is_convertible_helper needs to simulate std::declval better.
I wouldn't be surprised if other type traits needed a similar fix.

Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk/13?

I've tested the new test with G++12 and clang++ as well (with
std::is_convertible).

	PR c++/109680

gcc/cp/ChangeLog:

	* method.cc (is_convertible_helper): Correct simulating std::declval.

gcc/testsuite/ChangeLog:

	* g++.dg/ext/is_convertible6.C: New test.
---
 gcc/cp/method.cc                           | 20 ++++++++++++++++++++
 gcc/testsuite/g++.dg/ext/is_convertible6.C | 16 ++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 gcc/testsuite/g++.dg/ext/is_convertible6.C

diff --git a/gcc/cp/method.cc b/gcc/cp/method.cc
index 00eae56eb5b..38eb7520312 100644
--- a/gcc/cp/method.cc
+++ b/gcc/cp/method.cc
@@ -2245,6 +2245,26 @@ is_convertible_helper (tree from, tree to)
 {
   if (VOID_TYPE_P (from) && VOID_TYPE_P (to))
     return integer_one_node;
+  /* std::is_{,nothrow_}convertible test whether the imaginary function
+     definition
+
+       To test() { return std::declval<From>(); }
+
+     is well-formed.  A function can't return a function...  */
+  if (FUNC_OR_METHOD_TYPE_P (to)
+      /* ...neither can From be a function with cv-/ref-qualifiers:
+	 std::declval is defined as
+
+	  template<class T>
+	  typename std::add_rvalue_reference<T>::type declval() noexcept;
+
+	and std::add_rvalue_reference yields T when T is a function with
+	cv- or ref-qualifiers, making the definition ill-formed.
+	??? Should we check this in other uses of build_stub_object too?  */
+      || (FUNC_OR_METHOD_TYPE_P (from)
+	  && (type_memfn_quals (from) != TYPE_UNQUALIFIED
+	      || type_memfn_rqual (from) != REF_QUAL_NONE)))
+    return error_mark_node;
   cp_unevaluated u;
   tree expr = build_stub_object (from);
   deferring_access_check_sentinel acs (dk_no_deferred);
diff --git a/gcc/testsuite/g++.dg/ext/is_convertible6.C b/gcc/testsuite/g++.dg/ext/is_convertible6.C
new file mode 100644
index 00000000000..180582663e8
--- /dev/null
+++ b/gcc/testsuite/g++.dg/ext/is_convertible6.C
@@ -0,0 +1,16 @@
+// PR c++/109680
+// { dg-do compile { target c++11 } }
+
+#define SA(X) static_assert((X),#X)
+
+SA(!__is_convertible(int () const, int (*)()));
+SA(!__is_convertible(int (*)(), int () const));
+
+SA( __is_convertible(int (), int (*)()));
+SA(!__is_convertible(int (*)(), int ()));
+
+SA( __is_convertible(int (int), int (*) (int)));
+SA(!__is_convertible(int (*) (int), int (int)));
+
+SA(!__is_convertible(int (int) const, int (*) (int)));
+SA(!__is_convertible(int (*) (int), int (int) const));

base-commit: 33020780a9699f1146eeed61783cec89fde337a0
-- 
2.40.1

Re: [PATCH] c++: wrong std::is_convertible with cv-qual fn [PR109680]

[Jason Merrill]

On 5/2/23 19:10, Marek Polacek wrote:
> This PR points out that std::is_convertible has given the wrong answer
> in
> 
>    static_assert (!std::is_convertible_v <int () const, int (*) ()>, "");
> 
> since r13-2822 implemented __is_{,nothrow_}convertible.
> 
> std::is_convertible uses the imaginary
> 
>    To test() { return std::declval<From>(); }
> 
> to do its job.  Here, From is 'int () const'.  std::declval is defined as:
> 
>    template<class T>
>    typename std::add_rvalue_reference<T>::type declval() noexcept;
> 
> std::add_rvalue_reference is defined as "If T is a function type that
> has no cv- or ref- qualifier or an object type, provides a member typedef
> type which is T&&, otherwise type is T."
> 
> In our case, T is cv-qualified, so the result is T, so we end up with
> 
>    int () const declval() noexcept;
> 
> which is invalid.  In other words, this is pretty much like:
> 
>    using T = int () const;
>    T fn1(); // bad, fn returning a fn
>    T& fn2(); // bad, cannot declare reference to qualified function type
>    T* fn3(); // bad, cannot declare pointer to qualified function type
> 
>    using U = int ();
>    U fn4(); // bad, fn returning a fn
>    U& fn5(); // OK
>    U* fn6(); // OK
> 
> I think is_convertible_helper needs to simulate std::declval better.
> I wouldn't be surprised if other type traits needed a similar fix.
> 
> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk/13?
> 
> I've tested the new test with G++12 and clang++ as well (with
> std::is_convertible).
> 
> 	PR c++/109680
> 
> gcc/cp/ChangeLog:
> 
> 	* method.cc (is_convertible_helper): Correct simulating std::declval.
> 
> gcc/testsuite/ChangeLog:
> 
> 	* g++.dg/ext/is_convertible6.C: New test.
> ---
>   gcc/cp/method.cc                           | 20 ++++++++++++++++++++
>   gcc/testsuite/g++.dg/ext/is_convertible6.C | 16 ++++++++++++++++
>   2 files changed, 36 insertions(+)
>   create mode 100644 gcc/testsuite/g++.dg/ext/is_convertible6.C
> 
> diff --git a/gcc/cp/method.cc b/gcc/cp/method.cc
> index 00eae56eb5b..38eb7520312 100644
> --- a/gcc/cp/method.cc
> +++ b/gcc/cp/method.cc
> @@ -2245,6 +2245,26 @@ is_convertible_helper (tree from, tree to)
>   {
>     if (VOID_TYPE_P (from) && VOID_TYPE_P (to))
>       return integer_one_node;
> +  /* std::is_{,nothrow_}convertible test whether the imaginary function
> +     definition
> +
> +       To test() { return std::declval<From>(); }
> +
> +     is well-formed.  A function can't return a function...  */
> +  if (FUNC_OR_METHOD_TYPE_P (to)
> +      /* ...neither can From be a function with cv-/ref-qualifiers:
> +	 std::declval is defined as
> +
> +	  template<class T>
> +	  typename std::add_rvalue_reference<T>::type declval() noexcept;
> +
> +	and std::add_rvalue_reference yields T when T is a function with
> +	cv- or ref-qualifiers, making the definition ill-formed.
> +	??? Should we check this in other uses of build_stub_object too?  */

Probably we want a build_trait_object that wraps build_stub_object with 
these extra checks, or does something that exercises more of the normal 
code, maybe by tsubsting into T (U&&) with { to, from }?

> +      || (FUNC_OR_METHOD_TYPE_P (from)
> +	  && (type_memfn_quals (from) != TYPE_UNQUALIFIED
> +	      || type_memfn_rqual (from) != REF_QUAL_NONE)))
> +    return error_mark_node;
>     cp_unevaluated u;
>     tree expr = build_stub_object (from);
>     deferring_access_check_sentinel acs (dk_no_deferred);
> diff --git a/gcc/testsuite/g++.dg/ext/is_convertible6.C b/gcc/testsuite/g++.dg/ext/is_convertible6.C
> new file mode 100644
> index 00000000000..180582663e8
> --- /dev/null
> +++ b/gcc/testsuite/g++.dg/ext/is_convertible6.C
> @@ -0,0 +1,16 @@
> +// PR c++/109680
> +// { dg-do compile { target c++11 } }
> +
> +#define SA(X) static_assert((X),#X)
> +
> +SA(!__is_convertible(int () const, int (*)()));
> +SA(!__is_convertible(int (*)(), int () const));
> +
> +SA( __is_convertible(int (), int (*)()));
> +SA(!__is_convertible(int (*)(), int ()));
> +
> +SA( __is_convertible(int (int), int (*) (int)));
> +SA(!__is_convertible(int (*) (int), int (int)));
> +
> +SA(!__is_convertible(int (int) const, int (*) (int)));
> +SA(!__is_convertible(int (*) (int), int (int) const));
> 
> base-commit: 33020780a9699f1146eeed61783cec89fde337a0

[PATCH v2] c++: wrong std::is_convertible with cv-qual fn [PR109680]

[Marek Polacek]

On Wed, May 03, 2023 at 03:37:03PM -0400, Jason Merrill wrote:
> On 5/2/23 19:10, Marek Polacek wrote:
> > This PR points out that std::is_convertible has given the wrong answer
> > in
> > 
> >    static_assert (!std::is_convertible_v <int () const, int (*) ()>, "");
> > 
> > since r13-2822 implemented __is_{,nothrow_}convertible.
> > 
> > std::is_convertible uses the imaginary
> > 
> >    To test() { return std::declval<From>(); }
> > 
> > to do its job.  Here, From is 'int () const'.  std::declval is defined as:
> > 
> >    template<class T>
> >    typename std::add_rvalue_reference<T>::type declval() noexcept;
> > 
> > std::add_rvalue_reference is defined as "If T is a function type that
> > has no cv- or ref- qualifier or an object type, provides a member typedef
> > type which is T&&, otherwise type is T."
> > 
> > In our case, T is cv-qualified, so the result is T, so we end up with
> > 
> >    int () const declval() noexcept;
> > 
> > which is invalid.  In other words, this is pretty much like:
> > 
> >    using T = int () const;
> >    T fn1(); // bad, fn returning a fn
> >    T& fn2(); // bad, cannot declare reference to qualified function type
> >    T* fn3(); // bad, cannot declare pointer to qualified function type
> > 
> >    using U = int ();
> >    U fn4(); // bad, fn returning a fn
> >    U& fn5(); // OK
> >    U* fn6(); // OK
> > 
> > I think is_convertible_helper needs to simulate std::declval better.
> > I wouldn't be surprised if other type traits needed a similar fix.
> > 
> > Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk/13?
> > 
> > I've tested the new test with G++12 and clang++ as well (with
> > std::is_convertible).
> > 
> > 	PR c++/109680
> > 
> > gcc/cp/ChangeLog:
> > 
> > 	* method.cc (is_convertible_helper): Correct simulating std::declval.
> > 
> > gcc/testsuite/ChangeLog:
> > 
> > 	* g++.dg/ext/is_convertible6.C: New test.
> > ---
> >   gcc/cp/method.cc                           | 20 ++++++++++++++++++++
> >   gcc/testsuite/g++.dg/ext/is_convertible6.C | 16 ++++++++++++++++
> >   2 files changed, 36 insertions(+)
> >   create mode 100644 gcc/testsuite/g++.dg/ext/is_convertible6.C
> > 
> > diff --git a/gcc/cp/method.cc b/gcc/cp/method.cc
> > index 00eae56eb5b..38eb7520312 100644
> > --- a/gcc/cp/method.cc
> > +++ b/gcc/cp/method.cc
> > @@ -2245,6 +2245,26 @@ is_convertible_helper (tree from, tree to)
> >   {
> >     if (VOID_TYPE_P (from) && VOID_TYPE_P (to))
> >       return integer_one_node;
> > +  /* std::is_{,nothrow_}convertible test whether the imaginary function
> > +     definition
> > +
> > +       To test() { return std::declval<From>(); }
> > +
> > +     is well-formed.  A function can't return a function...  */
> > +  if (FUNC_OR_METHOD_TYPE_P (to)
> > +      /* ...neither can From be a function with cv-/ref-qualifiers:
> > +	 std::declval is defined as
> > +
> > +	  template<class T>
> > +	  typename std::add_rvalue_reference<T>::type declval() noexcept;
> > +
> > +	and std::add_rvalue_reference yields T when T is a function with
> > +	cv- or ref-qualifiers, making the definition ill-formed.
> > +	??? Should we check this in other uses of build_stub_object too?  */
> 
> Probably we want a build_trait_object that wraps build_stub_object with
> these extra checks, or does something that exercises more of the normal
> code, maybe by tsubsting into T (U&&) with { to, from }?

I did the former.  We only have the To type when processing
__is_convertible, so I think that can't be part of the declval
function, which takes another type, From.  IOW, if we want to factor
declval out, build_trait_object will take only one type.  Eh, that
still sounds confusing.  But the patch is simple.

Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?

-- >8 --
This PR points out that std::is_convertible has given the wrong answer
in

  static_assert (!std::is_convertible_v <int () const, int (*) ()>, "");

since r13-2822 implemented __is_{,nothrow_}convertible.

std::is_convertible uses the imaginary

  To test() { return std::declval<From>(); }

to do its job.  Here, From is 'int () const'.  std::declval is defined as:

  template<class T>
  typename std::add_rvalue_reference<T>::type declval() noexcept;

std::add_rvalue_reference is defined as "If T is a function type that
has no cv- or ref- qualifier or an object type, provides a member typedef
type which is T&&, otherwise type is T."

In our case, T is cv-qualified, so the result is T, so we end up with

  int () const declval() noexcept;

which is invalid.  In other words, this is pretty much like:

  using T = int () const;
  T fn1(); // bad, fn returning a fn
  T& fn2(); // bad, cannot declare reference to qualified function type
  T* fn3(); // bad, cannot declare pointer to qualified function type

  using U = int ();
  U fn4(); // bad, fn returning a fn
  U& fn5(); // OK
  U* fn6(); // OK

I think is_convertible_helper needs to simulate std::declval better.
To that end, I'm introducing build_trait_object, to be used where
a declval is needed.

	PR c++/109680

gcc/cp/ChangeLog:

	* method.cc (build_trait_object): New.
	(assignable_expr): Use it.
	(ref_xes_from_temporary): Likewise.
	(is_convertible_helper): Likewise.  Check FUNC_OR_METHOD_TYPE_P.

gcc/testsuite/ChangeLog:

	* g++.dg/ext/is_convertible6.C: New test.
---
 gcc/cp/method.cc                           | 39 +++++++++++++++++++---
 gcc/testsuite/g++.dg/ext/is_convertible6.C | 16 +++++++++
 2 files changed, 51 insertions(+), 4 deletions(-)
 create mode 100644 gcc/testsuite/g++.dg/ext/is_convertible6.C

diff --git a/gcc/cp/method.cc b/gcc/cp/method.cc
index 00eae56eb5b..7ec7bfe8387 100644
--- a/gcc/cp/method.cc
+++ b/gcc/cp/method.cc
@@ -1902,6 +1902,27 @@ build_stub_object (tree reftype)
   return convert_from_reference (stub);
 }
 
+/* Build a std::declval<TYPE>() expression and return it.  */
+
+tree
+build_trait_object (tree type)
+{
+  /* TYPE can't be a function with cv-/ref-qualifiers: std::declval is
+     defined as
+
+       template<class T>
+       typename std::add_rvalue_reference<T>::type declval() noexcept;
+
+     and std::add_rvalue_reference yields T when T is a function with
+     cv- or ref-qualifiers, making the definition ill-formed.  */
+  if (FUNC_OR_METHOD_TYPE_P (type)
+      && (type_memfn_quals (type) != TYPE_UNQUALIFIED
+	  || type_memfn_rqual (type) != REF_QUAL_NONE))
+    return error_mark_node;
+
+  return build_stub_object (type);
+}
+
 /* Determine which function will be called when looking up NAME in TYPE,
    called with a single ARGTYPE argument, or no argument if ARGTYPE is
    null.  FLAGS and COMPLAIN are as for build_new_method_call.
@@ -2050,8 +2071,8 @@ static tree
 assignable_expr (tree to, tree from)
 {
   cp_unevaluated cp_uneval_guard;
-  to = build_stub_object (to);
-  from = build_stub_object (from);
+  to = build_trait_object (to);
+  from = build_trait_object (from);
   tree r = cp_build_modify_expr (input_location, to, NOP_EXPR, from, tf_none);
   return r;
 }
@@ -2231,7 +2252,9 @@ ref_xes_from_temporary (tree to, tree from, bool direct_init_p)
     return false;
   /* We don't check is_constructible<T, U>: if T isn't constructible
      from U, we won't be able to create a conversion.  */
-  tree val = build_stub_object (from);
+  tree val = build_trait_object (from);
+  if (val == error_mark_node)
+    return false;
   if (!TYPE_REF_P (from) && TREE_CODE (from) != FUNCTION_TYPE)
     val = CLASS_TYPE_P (from) ? force_rvalue (val, tf_none) : rvalue (val);
   return ref_conv_binds_to_temporary (to, val, direct_init_p).is_true ();
@@ -2246,7 +2269,15 @@ is_convertible_helper (tree from, tree to)
   if (VOID_TYPE_P (from) && VOID_TYPE_P (to))
     return integer_one_node;
   cp_unevaluated u;
-  tree expr = build_stub_object (from);
+  tree expr = build_trait_object (from);
+  /* std::is_{,nothrow_}convertible test whether the imaginary function
+     definition
+
+       To test() { return std::declval<From>(); }
+
+     is well-formed.  A function can't return a function.  */
+  if (FUNC_OR_METHOD_TYPE_P (to) || expr == error_mark_node)
+    return error_mark_node;
   deferring_access_check_sentinel acs (dk_no_deferred);
   return perform_implicit_conversion (to, expr, tf_none);
 }
diff --git a/gcc/testsuite/g++.dg/ext/is_convertible6.C b/gcc/testsuite/g++.dg/ext/is_convertible6.C
new file mode 100644
index 00000000000..180582663e8
--- /dev/null
+++ b/gcc/testsuite/g++.dg/ext/is_convertible6.C
@@ -0,0 +1,16 @@
+// PR c++/109680
+// { dg-do compile { target c++11 } }
+
+#define SA(X) static_assert((X),#X)
+
+SA(!__is_convertible(int () const, int (*)()));
+SA(!__is_convertible(int (*)(), int () const));
+
+SA( __is_convertible(int (), int (*)()));
+SA(!__is_convertible(int (*)(), int ()));
+
+SA( __is_convertible(int (int), int (*) (int)));
+SA(!__is_convertible(int (*) (int), int (int)));
+
+SA(!__is_convertible(int (int) const, int (*) (int)));
+SA(!__is_convertible(int (*) (int), int (int) const));

base-commit: bdc10c2bfaceb3be567e0a27d8951a22b4be2ed4
-- 
2.40.1

Re: [PATCH v2] c++: wrong std::is_convertible with cv-qual fn [PR109680]

[Jason Merrill]

On 5/10/23 17:28, Marek Polacek wrote:
> On Wed, May 03, 2023 at 03:37:03PM -0400, Jason Merrill wrote:
>> On 5/2/23 19:10, Marek Polacek wrote:
>>> This PR points out that std::is_convertible has given the wrong answer
>>> in
>>>
>>>     static_assert (!std::is_convertible_v <int () const, int (*) ()>, "");
>>>
>>> since r13-2822 implemented __is_{,nothrow_}convertible.
>>>
>>> std::is_convertible uses the imaginary
>>>
>>>     To test() { return std::declval<From>(); }
>>>
>>> to do its job.  Here, From is 'int () const'.  std::declval is defined as:
>>>
>>>     template<class T>
>>>     typename std::add_rvalue_reference<T>::type declval() noexcept;
>>>
>>> std::add_rvalue_reference is defined as "If T is a function type that
>>> has no cv- or ref- qualifier or an object type, provides a member typedef
>>> type which is T&&, otherwise type is T."
>>>
>>> In our case, T is cv-qualified, so the result is T, so we end up with
>>>
>>>     int () const declval() noexcept;
>>>
>>> which is invalid.  In other words, this is pretty much like:
>>>
>>>     using T = int () const;
>>>     T fn1(); // bad, fn returning a fn
>>>     T& fn2(); // bad, cannot declare reference to qualified function type
>>>     T* fn3(); // bad, cannot declare pointer to qualified function type
>>>
>>>     using U = int ();
>>>     U fn4(); // bad, fn returning a fn
>>>     U& fn5(); // OK
>>>     U* fn6(); // OK
>>>
>>> I think is_convertible_helper needs to simulate std::declval better.
>>> I wouldn't be surprised if other type traits needed a similar fix.
>>>
>>> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk/13?
>>>
>>> I've tested the new test with G++12 and clang++ as well (with
>>> std::is_convertible).
>>>
>>> 	PR c++/109680
>>>
>>> gcc/cp/ChangeLog:
>>>
>>> 	* method.cc (is_convertible_helper): Correct simulating std::declval.
>>>
>>> gcc/testsuite/ChangeLog:
>>>
>>> 	* g++.dg/ext/is_convertible6.C: New test.
>>> ---
>>>    gcc/cp/method.cc                           | 20 ++++++++++++++++++++
>>>    gcc/testsuite/g++.dg/ext/is_convertible6.C | 16 ++++++++++++++++
>>>    2 files changed, 36 insertions(+)
>>>    create mode 100644 gcc/testsuite/g++.dg/ext/is_convertible6.C
>>>
>>> diff --git a/gcc/cp/method.cc b/gcc/cp/method.cc
>>> index 00eae56eb5b..38eb7520312 100644
>>> --- a/gcc/cp/method.cc
>>> +++ b/gcc/cp/method.cc
>>> @@ -2245,6 +2245,26 @@ is_convertible_helper (tree from, tree to)
>>>    {
>>>      if (VOID_TYPE_P (from) && VOID_TYPE_P (to))
>>>        return integer_one_node;
>>> +  /* std::is_{,nothrow_}convertible test whether the imaginary function
>>> +     definition
>>> +
>>> +       To test() { return std::declval<From>(); }
>>> +
>>> +     is well-formed.  A function can't return a function...  */
>>> +  if (FUNC_OR_METHOD_TYPE_P (to)
>>> +      /* ...neither can From be a function with cv-/ref-qualifiers:
>>> +	 std::declval is defined as
>>> +
>>> +	  template<class T>
>>> +	  typename std::add_rvalue_reference<T>::type declval() noexcept;
>>> +
>>> +	and std::add_rvalue_reference yields T when T is a function with
>>> +	cv- or ref-qualifiers, making the definition ill-formed.
>>> +	??? Should we check this in other uses of build_stub_object too?  */
>>
>> Probably we want a build_trait_object that wraps build_stub_object with
>> these extra checks, or does something that exercises more of the normal
>> code, maybe by tsubsting into T (U&&) with { to, from }?
> 
> I did the former.  We only have the To type when processing
> __is_convertible, so I think that can't be part of the declval
> function, which takes another type, From.  IOW, if we want to factor
> declval out, build_trait_object will take only one type.  Eh, that
> still sounds confusing.  But the patch is simple.
> 
> Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?

OK.

> -- >8 --
> This PR points out that std::is_convertible has given the wrong answer
> in
> 
>    static_assert (!std::is_convertible_v <int () const, int (*) ()>, "");
> 
> since r13-2822 implemented __is_{,nothrow_}convertible.
> 
> std::is_convertible uses the imaginary
> 
>    To test() { return std::declval<From>(); }
> 
> to do its job.  Here, From is 'int () const'.  std::declval is defined as:
> 
>    template<class T>
>    typename std::add_rvalue_reference<T>::type declval() noexcept;
> 
> std::add_rvalue_reference is defined as "If T is a function type that
> has no cv- or ref- qualifier or an object type, provides a member typedef
> type which is T&&, otherwise type is T."
> 
> In our case, T is cv-qualified, so the result is T, so we end up with
> 
>    int () const declval() noexcept;
> 
> which is invalid.  In other words, this is pretty much like:
> 
>    using T = int () const;
>    T fn1(); // bad, fn returning a fn
>    T& fn2(); // bad, cannot declare reference to qualified function type
>    T* fn3(); // bad, cannot declare pointer to qualified function type
> 
>    using U = int ();
>    U fn4(); // bad, fn returning a fn
>    U& fn5(); // OK
>    U* fn6(); // OK
> 
> I think is_convertible_helper needs to simulate std::declval better.
> To that end, I'm introducing build_trait_object, to be used where
> a declval is needed.
> 
> 	PR c++/109680
> 
> gcc/cp/ChangeLog:
> 
> 	* method.cc (build_trait_object): New.
> 	(assignable_expr): Use it.
> 	(ref_xes_from_temporary): Likewise.
> 	(is_convertible_helper): Likewise.  Check FUNC_OR_METHOD_TYPE_P.
> 
> gcc/testsuite/ChangeLog:
> 
> 	* g++.dg/ext/is_convertible6.C: New test.
> ---
>   gcc/cp/method.cc                           | 39 +++++++++++++++++++---
>   gcc/testsuite/g++.dg/ext/is_convertible6.C | 16 +++++++++
>   2 files changed, 51 insertions(+), 4 deletions(-)
>   create mode 100644 gcc/testsuite/g++.dg/ext/is_convertible6.C
> 
> diff --git a/gcc/cp/method.cc b/gcc/cp/method.cc
> index 00eae56eb5b..7ec7bfe8387 100644
> --- a/gcc/cp/method.cc
> +++ b/gcc/cp/method.cc
> @@ -1902,6 +1902,27 @@ build_stub_object (tree reftype)
>     return convert_from_reference (stub);
>   }
>   
> +/* Build a std::declval<TYPE>() expression and return it.  */
> +
> +tree
> +build_trait_object (tree type)
> +{
> +  /* TYPE can't be a function with cv-/ref-qualifiers: std::declval is
> +     defined as
> +
> +       template<class T>
> +       typename std::add_rvalue_reference<T>::type declval() noexcept;
> +
> +     and std::add_rvalue_reference yields T when T is a function with
> +     cv- or ref-qualifiers, making the definition ill-formed.  */
> +  if (FUNC_OR_METHOD_TYPE_P (type)
> +      && (type_memfn_quals (type) != TYPE_UNQUALIFIED
> +	  || type_memfn_rqual (type) != REF_QUAL_NONE))
> +    return error_mark_node;
> +
> +  return build_stub_object (type);
> +}
> +
>   /* Determine which function will be called when looking up NAME in TYPE,
>      called with a single ARGTYPE argument, or no argument if ARGTYPE is
>      null.  FLAGS and COMPLAIN are as for build_new_method_call.
> @@ -2050,8 +2071,8 @@ static tree
>   assignable_expr (tree to, tree from)
>   {
>     cp_unevaluated cp_uneval_guard;
> -  to = build_stub_object (to);
> -  from = build_stub_object (from);
> +  to = build_trait_object (to);
> +  from = build_trait_object (from);
>     tree r = cp_build_modify_expr (input_location, to, NOP_EXPR, from, tf_none);
>     return r;
>   }
> @@ -2231,7 +2252,9 @@ ref_xes_from_temporary (tree to, tree from, bool direct_init_p)
>       return false;
>     /* We don't check is_constructible<T, U>: if T isn't constructible
>        from U, we won't be able to create a conversion.  */
> -  tree val = build_stub_object (from);
> +  tree val = build_trait_object (from);
> +  if (val == error_mark_node)
> +    return false;
>     if (!TYPE_REF_P (from) && TREE_CODE (from) != FUNCTION_TYPE)
>       val = CLASS_TYPE_P (from) ? force_rvalue (val, tf_none) : rvalue (val);
>     return ref_conv_binds_to_temporary (to, val, direct_init_p).is_true ();
> @@ -2246,7 +2269,15 @@ is_convertible_helper (tree from, tree to)
>     if (VOID_TYPE_P (from) && VOID_TYPE_P (to))
>       return integer_one_node;
>     cp_unevaluated u;
> -  tree expr = build_stub_object (from);
> +  tree expr = build_trait_object (from);
> +  /* std::is_{,nothrow_}convertible test whether the imaginary function
> +     definition
> +
> +       To test() { return std::declval<From>(); }
> +
> +     is well-formed.  A function can't return a function.  */
> +  if (FUNC_OR_METHOD_TYPE_P (to) || expr == error_mark_node)
> +    return error_mark_node;
>     deferring_access_check_sentinel acs (dk_no_deferred);
>     return perform_implicit_conversion (to, expr, tf_none);
>   }
> diff --git a/gcc/testsuite/g++.dg/ext/is_convertible6.C b/gcc/testsuite/g++.dg/ext/is_convertible6.C
> new file mode 100644
> index 00000000000..180582663e8
> --- /dev/null
> +++ b/gcc/testsuite/g++.dg/ext/is_convertible6.C
> @@ -0,0 +1,16 @@
> +// PR c++/109680
> +// { dg-do compile { target c++11 } }
> +
> +#define SA(X) static_assert((X),#X)
> +
> +SA(!__is_convertible(int () const, int (*)()));
> +SA(!__is_convertible(int (*)(), int () const));
> +
> +SA( __is_convertible(int (), int (*)()));
> +SA(!__is_convertible(int (*)(), int ()));
> +
> +SA( __is_convertible(int (int), int (*) (int)));
> +SA(!__is_convertible(int (*) (int), int (int)));
> +
> +SA(!__is_convertible(int (int) const, int (*) (int)));
> +SA(!__is_convertible(int (*) (int), int (int) const));
> 
> base-commit: bdc10c2bfaceb3be567e0a27d8951a22b4be2ed4