C++23 lifetime extension in range-based for loops: Clang destroys temporaries bound to references by default member initializer early (without warning)

[hubert-reinterpretcast]

Clang normally warns that it fails to extend the lifetime of temporaries bound to member references by default member initializers in aggregate initialization.
It fails to even warn when the aggregate initialization occurs as a subexpression of a for-range-initializer.

Online compiler link (with two cases: one where the aggregate initialization occurs as a subexpression and another where it is the for-range-initializer): https://godbolt.org/z/T9zdrevv8

SOURCE (<stdin>):

extern "C" void exit(int);

struct A {
  int arr[1];
  ~A() noexcept(false) { throw 42; }
};

struct B {
  int x;
  const A &a = A{{0}};
  const int *begin() { return a.arr; }
  const int *end() { return &a.arr[1]; }
};

int main() {
  for (auto &&x : B{0}.a.arr) { exit(0); }
  //for (auto &&x : B{0}) { exit(0); }
}

COMPILER INVOCATION:

clang++ -std=c++23 -Werror -xc++ -

COMPILER OUTPUT:

(clean compile with no warnings)

ACTUAL RUN OUTPUT:

$ ./a.out
libc++abi: terminating due to uncaught exception of type int

EXPECTED RUN OUTPUT:

rc = 0

COMPILER VERSION INFO (clang++ -v):

clang version 19.0.0git (https://github.com/llvm/llvm-project.git c0d03d28c58f3016eb25ce8d1160e11183d01735)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /opt/wandbox/clang-head/bin
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/10
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/9
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/10
Candidate multilib: .;@m64
Selected multilib: .;@m64

[llvmbot]

@llvm/issue-subscribers-clang-frontend

Author: Hubert Tong (hubert-reinterpretcast)

Clang normally warns that it fails to extend the lifetime of temporaries bound to member references by default member initializers in aggregate initialization. It fails to even warn when the aggregate initialization occurs as a subexpression of a for-range-initializer.

Online compiler link (with two cases: one where the aggregate initialization occurs as a subexpression and another where it is the for-range-initializer): https://godbolt.org/z/T9zdrevv8

SOURCE (<stdin>):

extern "C" void exit(int);

struct A {
  int arr[1];
  ~A() noexcept(false) { throw 42; }
};

struct B {
  int x;
  const A &a = A{{0}};
  const int *begin() { return a.arr; }
  const int *end() { return &a.arr[1]; }
};

int main() {
  for (auto &&x : B{0}.a.arr) { exit(0); }
  //for (auto &&x : B{0}) { exit(0); }
}

COMPILER INVOCATION:

clang++ -std=c++23 -Werror -xc++ -

COMPILER OUTPUT:

(clean compile with no warnings)

ACTUAL RUN OUTPUT:

$ ./a.out
libc++abi: terminating due to uncaught exception of type int

EXPECTED RUN OUTPUT:

rc = 0

COMPILER VERSION INFO (clang++ -v):

clang version 19.0.0git (https://github.com/llvm/llvm-project.git c0d03d28c58f3016eb25ce8d1160e11183d01735)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /opt/wandbox/clang-head/bin
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/10
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/9
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/10
Candidate multilib: .;@<!-- -->m64
Selected multilib: .;@<!-- -->m64

[yronglin]

Sorry for the late reply and thank you report this issue. I've tried to extend the lifetime of the temporaries in CXXDefaultInitExpr with my local clang build, and below IR was generated , but I'm not sure if this is the expected result.

Consider:

extern "C" void exit(int);

struct A {
  int arr[1];
  ~A() noexcept(false) { throw 42; }
};

struct B {
  int x;
  const A &a = A{{0}};
  const int *begin() { return a.arr; }
  const int *end() { return &a.arr[1]; }
};

int main() {
  for (auto &&x : B{0}) { exit(0); }
}

LLVM IR:

define noundef i32 @main() #0 personality ptr @__gxx_personality_v0 {
entry:
  %retval = alloca i32, align 4
  %__range1 = alloca ptr, align 8
  %ref.tmp = alloca %struct.B, align 8
  %ref.tmp1 = alloca %struct.A, align 4
  %__begin1 = alloca ptr, align 8
  %__end1 = alloca ptr, align 8
  %x3 = alloca ptr, align 8
  %exn.slot = alloca ptr, align 8
  %ehselector.slot = alloca i32, align 4
  store i32 0, ptr %retval, align 4
  %x = getelementptr inbounds %struct.B, ptr %ref.tmp, i32 0, i32 0
  store i32 0, ptr %x, align 8
  %a = getelementptr inbounds %struct.B, ptr %ref.tmp, i32 0, i32 1
  %arr = getelementptr inbounds %struct.A, ptr %ref.tmp1, i32 0, i32 0
  %arrayinit.begin = getelementptr inbounds [1 x i32], ptr %arr, i64 0, i64 0
  store i32 0, ptr %arrayinit.begin, align 4
  store ptr %ref.tmp1, ptr %a, align 8
  store ptr %ref.tmp, ptr %__range1, align 8
  %0 = load ptr, ptr %__range1, align 8
  %call = call noundef ptr @_ZN1B5beginEv(ptr noundef nonnull align 8 dereferenceable(16) %0)
  store ptr %call, ptr %__begin1, align 8
  %1 = load ptr, ptr %__range1, align 8
  %call2 = call noundef ptr @_ZN1B3endEv(ptr noundef nonnull align 8 dereferenceable(16) %1)
  store ptr %call2, ptr %__end1, align 8
  br label %for.cond

for.cond:                                         ; preds = %for.inc, %entry
  %2 = load ptr, ptr %__begin1, align 8
  %3 = load ptr, ptr %__end1, align 8
  %cmp = icmp ne ptr %2, %3
  br i1 %cmp, label %for.body, label %for.cond.cleanup

for.cond.cleanup:                                 ; preds = %for.cond
  %call4 = call noundef ptr @_ZN1BD1Ev(ptr noundef nonnull align 8 dereferenceable(16) %ref.tmp) #5
  %call6 = call noundef ptr @_ZN1AD1Ev(ptr noundef nonnull align 4 dereferenceable(4) %ref.tmp1)
  br label %for.end

for.body:                                         ; preds = %for.cond
  %4 = load ptr, ptr %__begin1, align 8
  store ptr %4, ptr %x3, align 8
  invoke void @exit(i32 noundef 0)
          to label %invoke.cont unwind label %lpad

invoke.cont:                                      ; preds = %for.body
  br label %for.inc

for.inc:                                          ; preds = %invoke.cont
  %5 = load ptr, ptr %__begin1, align 8
  %incdec.ptr = getelementptr inbounds i32, ptr %5, i32 1
  store ptr %incdec.ptr, ptr %__begin1, align 8
  br label %for.cond

lpad:                                             ; preds = %for.body
  %6 = landingpad { ptr, i32 }
          cleanup
  %7 = extractvalue { ptr, i32 } %6, 0
  store ptr %7, ptr %exn.slot, align 8
  %8 = extractvalue { ptr, i32 } %6, 1
  store i32 %8, ptr %ehselector.slot, align 4
  %call5 = call noundef ptr @_ZN1BD1Ev(ptr noundef nonnull align 8 dereferenceable(16) %ref.tmp) #5
  %call8 = invoke noundef ptr @_ZN1AD1Ev(ptr noundef nonnull align 4 dereferenceable(4) %ref.tmp1)
          to label %invoke.cont7 unwind label %terminate.lpad

invoke.cont7:                                     ; preds = %lpad
  br label %eh.resume

for.end:                                          ; preds = %for.cond.cleanup
  ret i32 0

eh.resume:                                        ; preds = %invoke.cont7
  %exn = load ptr, ptr %exn.slot, align 8
  %sel = load i32, ptr %ehselector.slot, align 4
  %lpad.val = insertvalue { ptr, i32 } poison, ptr %exn, 0
  %lpad.val9 = insertvalue { ptr, i32 } %lpad.val, i32 %sel, 1
  resume { ptr, i32 } %lpad.val9

terminate.lpad:                                   ; preds = %lpad
  %9 = landingpad { ptr, i32 }
          catch ptr null
  %10 = extractvalue { ptr, i32 } %9, 0
  call void @__clang_call_terminate(ptr %10) #6
  unreachable
}

[yronglin]

cc @cor3ntin @zygoloid

[yronglin]

For a more hard case

extern "C" void exit(int);

struct X {
  ~X() {}
};

struct Y {
  const X &aaa = X{};
  ~Y() {}
};

struct A {
  int arr[1];
  const Y &bbb = Y{};
  ~A() noexcept(false) { throw 42; }
};

struct B {
  int x;
  const A &a = A{{0}};
  ~B() {}
  const int *begin() { return a.arr; }
  const int *end() { return &a.arr[1]; }
};

struct C {
  int arr[1];
  C() {}
  C(const A&) {}
  ~C() {}
  const int *begin() const { return arr; }
  const int *end() const { return &arr[1]; }
};

int main() {
  // for (auto &&x : B{0}.a.arr) { exit(0); }
  for (auto &&x : B{0}) { exit(0); }
  return 0;
}

#86960 generate below LLVM IR:

define noundef i32 @main() #0 personality ptr @__gxx_personality_v0 {
entry:
  %retval = alloca i32, align 4
  %__range1 = alloca ptr, align 8
  %ref.tmp = alloca %struct.B, align 8
  %ref.tmp1 = alloca %struct.A, align 8
  %ref.tmp2 = alloca %struct.Y, align 8
  %ref.tmp3 = alloca %struct.X, align 1
  %__begin1 = alloca ptr, align 8
  %exn.slot = alloca ptr, align 8
  %ehselector.slot = alloca i32, align 4
  %__end1 = alloca ptr, align 8
  %x6 = alloca ptr, align 8
  store i32 0, ptr %retval, align 4
  %x = getelementptr inbounds %struct.B, ptr %ref.tmp, i32 0, i32 0
  store i32 0, ptr %x, align 8
  %a = getelementptr inbounds %struct.B, ptr %ref.tmp, i32 0, i32 1
  %arr = getelementptr inbounds %struct.A, ptr %ref.tmp1, i32 0, i32 0
  %arrayinit.begin = getelementptr inbounds [1 x i32], ptr %arr, i64 0, i64 0
  store i32 0, ptr %arrayinit.begin, align 4
  %bbb = getelementptr inbounds %struct.A, ptr %ref.tmp1, i32 0, i32 1
  %aaa = getelementptr inbounds %struct.Y, ptr %ref.tmp2, i32 0, i32 0
  store ptr %ref.tmp3, ptr %aaa, align 8
  store ptr %ref.tmp2, ptr %bbb, align 8
  store ptr %ref.tmp1, ptr %a, align 8
  store ptr %ref.tmp, ptr %__range1, align 8
  %0 = load ptr, ptr %__range1, align 8
  %call = invoke noundef ptr @_ZN1B5beginEv(ptr noundef nonnull align 8 dereferenceable(16) %0)
          to label %invoke.cont unwind label %lpad

invoke.cont:                                      ; preds = %entry
  store ptr %call, ptr %__begin1, align 8
  %1 = load ptr, ptr %__range1, align 8
  %call5 = invoke noundef ptr @_ZN1B3endEv(ptr noundef nonnull align 8 dereferenceable(16) %1)
          to label %invoke.cont4 unwind label %lpad

invoke.cont4:                                     ; preds = %invoke.cont
  store ptr %call5, ptr %__end1, align 8
  br label %for.cond

for.cond:                                         ; preds = %for.inc, %invoke.cont4
  %2 = load ptr, ptr %__begin1, align 8
  %3 = load ptr, ptr %__end1, align 8
  %cmp = icmp ne ptr %2, %3
  br i1 %cmp, label %for.body, label %for.cond.cleanup

for.cond.cleanup:                                 ; preds = %for.cond
  %call8 = call noundef ptr @_ZN1BD1Ev(ptr noundef nonnull align 8 dereferenceable(16) %ref.tmp) #5
  %call12 = invoke noundef ptr @_ZN1AD1Ev(ptr noundef nonnull align 8 dereferenceable(16) %ref.tmp1)
          to label %invoke.cont11 unwind label %lpad10

lpad:                                             ; preds = %for.body, %invoke.cont, %entry
  %4 = landingpad { ptr, i32 }
          cleanup
  %5 = extractvalue { ptr, i32 } %4, 0
  store ptr %5, ptr %exn.slot, align 8
  %6 = extractvalue { ptr, i32 } %4, 1
  store i32 %6, ptr %ehselector.slot, align 4
  %call9 = call noundef ptr @_ZN1BD1Ev(ptr noundef nonnull align 8 dereferenceable(16) %ref.tmp) #5
  %call14 = invoke noundef ptr @_ZN1AD1Ev(ptr noundef nonnull align 8 dereferenceable(16) %ref.tmp1)
          to label %invoke.cont13 unwind label %terminate.lpad

for.body:                                         ; preds = %for.cond
  %7 = load ptr, ptr %__begin1, align 8
  store ptr %7, ptr %x6, align 8
  invoke void @exit(i32 noundef 0)
          to label %invoke.cont7 unwind label %lpad

invoke.cont7:                                     ; preds = %for.body
  br label %for.inc

for.inc:                                          ; preds = %invoke.cont7
  %8 = load ptr, ptr %__begin1, align 8
  %incdec.ptr = getelementptr inbounds i32, ptr %8, i32 1
  store ptr %incdec.ptr, ptr %__begin1, align 8
  br label %for.cond

invoke.cont11:                                    ; preds = %for.cond.cleanup
  %call15 = call noundef ptr @_ZN1YD1Ev(ptr noundef nonnull align 8 dereferenceable(8) %ref.tmp2) #5
  %call17 = call noundef ptr @_ZN1XD1Ev(ptr noundef nonnull align 1 dereferenceable(1) %ref.tmp3) #5
  br label %for.end

lpad10:                                           ; preds = %for.cond.cleanup
  %9 = landingpad { ptr, i32 }
          cleanup
  %10 = extractvalue { ptr, i32 } %9, 0
  store ptr %10, ptr %exn.slot, align 8
  %11 = extractvalue { ptr, i32 } %9, 1
  store i32 %11, ptr %ehselector.slot, align 4
  br label %ehcleanup

invoke.cont13:                                    ; preds = %lpad
  br label %ehcleanup

ehcleanup:                                        ; preds = %invoke.cont13, %lpad10
  %call16 = call noundef ptr @_ZN1YD1Ev(ptr noundef nonnull align 8 dereferenceable(8) %ref.tmp2) #5
  %call19 = call noundef ptr @_ZN1XD1Ev(ptr noundef nonnull align 1 dereferenceable(1) %ref.tmp3) #5
  br label %eh.resume

for.end:                                          ; preds = %invoke.cont11
  ret i32 0

eh.resume:                                        ; preds = %ehcleanup
  %exn = load ptr, ptr %exn.slot, align 8
  %sel = load i32, ptr %ehselector.slot, align 4
  %lpad.val = insertvalue { ptr, i32 } poison, ptr %exn, 0
  %lpad.val20 = insertvalue { ptr, i32 } %lpad.val, i32 %sel, 1
  resume { ptr, i32 } %lpad.val20

terminate.lpad:                                   ; preds = %lpad
  %12 = landingpad { ptr, i32 }
          catch ptr null
  %13 = extractvalue { ptr, i32 } %12, 0
  call void @__clang_call_terminate(ptr %13) #6
  unreachable
}

[yronglin]

I plan to make #87933 land at first, then fix this issue in #86960 .