[clang] p0388 conversion to incomplete array

[urnathan]

Summary

This implements the new implicit conversion sequence to an incomplete (unbounded) array type. It is mostly Richard Smith's work (from D102650), updated to trunk, testcases added and a few bugs fixed found in such testing.

It is not a complete implementation of p0388.

[rsmith]

clang/include/clang/Sema/Initialization.h

1288

clang/lib/AST/ExprConstant.cpp

7799

Are there any cases here where we're adding an array bound and we need to check that it's correct? Presumably casts that add an array bound can result in wrongly-typed pointers during constant evaluation, but they'll only be wrong by virtue of having the wrong array bounds, and we should be using the stored value rather than the pointer type for our bounds checks, so maybe that's OK?

13203

I'd be inclined to add this to the above "invalid cast kind for integral value" list instead, since we have such a list here.

13935

Similarly, this is an invalid cast kind for complex so we could move this to the previous set of cases.

clang/lib/CodeGen/CGExpr.cpp

4694–4695

Instead of manually preserving the address space, you could compute it from the destination reference type, like we do for CK_LValueBitCast below.

4750

I think you will need to do this too, in case the destination type is a variably-modified type. Eg, in:

extern int arr[];
int g();
void f() {
  return ((int(&)[g()])arr)[0];
}

... we need to emit the call to g().

clang/lib/CodeGen/CGExprAgg.cpp

861

Hm. Aggregate IR emission can be used for lvalues of aggregate types (IR generation will step through temporary materialization and lvalue-to-rvalue conversions looking for the source of the value, to optimize away some obviously-unnecessary copies). But... I think this is still impossible, because array lvalues are never used to initialize arrays.

clang/lib/CodeGen/CGExprConstant.cpp

1129

(due to your changes to ExprConstant.cpp, yes)

clang/lib/Sema/SemaExprCXX.cpp

4554–4555

Do we need to handle the case where there's both an address-space change and an array-bound change? I'd imagine we want two ImpCastExprs in that case, with a suitably-determined intermediate type (either the source type with the destination address space or the destination type with the source address space; I can't think of a good reason to prefer one over the other).

clang/lib/Sema/SemaInit.cpp

8398

We may need to preserve the value kind, like we do for QualificationConversion. We could use the value kind of CurInit.get(), but I don't think that will do the right thing for initializing a const lvalue reference from an array xvalue:

using T = int[3];
const int (&arr)[] = T{1, 2, 3}; // materialized temporary is an xvalue, but converted initializer should be an lvalue

clang/lib/Sema/SemaOverload.cpp

293

Yes, this seems right to me. We're only trying to strip off casts that either might be, or might follow, a narrowing conversion (to get to the pre-narrowing type), and an array bound conversion can't be either.

3268

It'd be consistent with ObjCLifetimeConversion to use a reference here. I mean, in an ideal world I'd prefer we didn't have three bool parameters in a row, especially not with two of them being out-parameters. Maybe we could return a bitfield enum, eg:

enum QualificationConversionKind {
  QCK_NotQualificationConversion = 0x0,
  QCK_QualificationConversion = 0x1,
  QCK_IncludesObjCLifetimeConversion = 0x2,
  QCK_IncludesArrayBoundConversion = 0x4
};

3284–3296

Style nits:

• we generally use while (true) not for (;;)
• please use braces for ifs containing (transitively) more than one statement

4243

Yes, I think we do need a comparison here.

I made a start on P0388 a couple of years ago. I never got very far, but it looks like the parts I covered are mostly non-overlapping with the parts you've covered, and do include this. I've uploaded my work here: https://reviews.llvm.org/D102650; please feel free to take all / some / none of that :)

4610

Yeah, it should be correct to isa / cast directly.

[urnathan]

Richard, thanks for the comments -- I'd not realized I'd left quite so many FIXMEs lying around! The high bit I'm taking is that you're fine with the approach I'm taking.

clang/lib/AST/ExprConstant.cpp

7799

This patch only allows the bound->unbound (even though the code emission is more general), but yes, when unbound->bound is permitted we could end up with such invalid constant evaluations. Making sure that DTRT is on the ToDo list.

clang/lib/CodeGen/CGExpr.cpp

4694–4695

Sounds good.

clang/lib/Sema/SemaExprCXX.cpp

4554–4555

Ok, The code emission for ArrayBound will handle changing the address space, but a 2 step AST makes sense. I think I have a slight preference for placing the address-space change outermost.

Question: Is the address space change only concerning the outermost pointer? What about such changes that appear in the middle of a cv-decomposition?

clang/lib/Sema/SemaOverload.cpp

3268

was wondering about that too. Generally I dislike such out parameters and a bitflag return would be nicer. Presumably with a rename from IsFOO to FOOKind or similar?

3284–3296

thanks for guiding.

Question: What about collating blocks of cascading case labels? They seem to be unordered, which does make navigating them unclear.

[urnathan]

Cleanup diff, I forgot to review the actual diff :(

[urnathan]

ping?

[rsmith]

If you want to skip the VLA handling for now, that's fine by me, but I think we do eventually want to allow this kind of conversion for VLAs too, and it looks like it might be pretty straightforward to do as part of this change. I think we should at least handle the composite pointer type case for two constant arrays here, though. Eg:

int (*a)[3];
int (*b)[4];
auto *p = true ? a : b; // should be int (*)[] in C++20

clang/lib/AST/ASTContext.cpp

5804 ↗

(On Diff #351166)

(A little more VLA work here.)

clang/lib/Sema/SemaExprCXX.cpp

4554–4555

I think a non-top-level address space change would necessarily be a reinterpret cast: a T AS(1) * and a T AS(2) * might have different representations, so a T AS(1) ** cannot in general be meaningfully cast to T AS(2) **. (I don't think we currently special-case the situation where the pointer representations are the same between address spaces for such casts, but I could be wrong about that.)

6673

We seem to not handle the case where both types are constant array types, but with different bounds (where, based on the comment below, we're supposed to form an array of unknown bound). We should probably also unwrap here if one of the types is an incomplete array type and the other is a VLA. And maybe also if we have two distinct VLA types, or a VLA and a constant-bound array. So I think perhaps the logic should be:

• Prior to C++20: if both types to be incomplete array types, unwrap and add an incomplete array step.
• In C++20 onwards: if we get this far (if we have two array types that don't have the same constant bound) and the types aren't equal, unwrap and add an incomplete array step.

clang/lib/Sema/SemaOverload.cpp

3261

I think we should also allow VLA -> array of unknown bound conversions as qualification conversions.

[urnathan]

This adds support for the cond ? arya : aryb cases you pointed out. There is a problem with decaying VLAs to arrays of unknown bound -- Implicit Conversion Sequence was unprepared to deal with that. It's starting to look a little rat-holey, so if you don't mind I've not handled that.

[urnathan]

clang/lib/Sema/SemaExprCXX.cpp

6673

Handling VLA -> [] fell into problems with Implicit Conversion Sequence, so I punted that. Constant array -> [] is handled though.

[urnathan]

I've marked the comments from the v1 patch as addressed, but most of them were mooted by the v2 patch based on your D102650 patch. I find Phabricator a little hard to use :(

[urnathan]

ping? as commented, the v2 patch's absorption of Richard's D102650 diff mooted many of the original comments.

[urnathan]

ping?

[aaron.ballman]

Can you also update the cxx_status page to show that we're getting a partial implementation of P0388?

The changes LGTM, though I spotted an unrelated change that can go in as an NFC commit while we finalize this review. I'm adding Erich as a second set of eyes, in case Richard is busy at the moment.

clang/lib/Sema/SemaInit.cpp

8267

Unrelated typo fix (feel free to land as an NFC change though).

[urnathan]

the cxx_status change is in https://reviews.llvm.org/D103908, which is ready to land once this one is done :) Then you get the whole of p0388.

[urnathan]

ping?

[aaron.ballman]

LGTM!

clang/include/clang/AST/OperationKinds.def

 
 /// CK_NoOp - A conversion which does not affect the type other than
 /// (possibly) adding qualifiers or removing noexcept.
 ///   int    -> int
 ///   char** -> const char * const *
 ///   void () noexcept -> void ()
 CAST_OPERATION(NoOp)
 
+/// CK_ArrayBound - A conversion from a pointer/reference to an array that
+/// changes the bounds of the array.
+///   int (*)[]    -> int (*)[5]
+///   char (&)[5] -> char (&)[]
+///   float (*)[5] -> float (*)[4]
+CAST_OPERATION(ArrayBound)
+
 /// CK_BaseToDerived - A conversion from a C++ class pointer/reference
 /// to a derived class pointer/reference.
 ///   B *b = static_cast<B*>(a);
 CAST_OPERATION(BaseToDerived)
 
 /// CK_DerivedToBase - A conversion from a C++ class pointer
 /// to a base class pointer.
 ///   A *a = new B();

clang/include/clang/Sema/Initialization.h

enum StepKind {
     /// temporary object, which is permitted (but not required) by
     /// C++98/03 but not C++0x.
     SK_ExtraneousCopyToTemporary,
 
     /// Direct-initialization from a reference-related object in the
     /// final stage of class copy-initialization.
     SK_FinalCopy,
 
+    /// Change the bounds of an array type somewhere in the pointer
+    /// decomposition of a type (i.e. not necessarily only at the outermost
+    /// level).
+    SK_ArrayBoundConversion,
+
     /// Perform a user-defined conversion, either via a conversion
     /// function or via a constructor.
     SK_UserConversion,
 
     /// Perform a qualification conversion, producing an rvalue.
     SK_QualificationConversionRValue,
 
     /// Perform a qualification conversion, producing an xvalue.
void AddUserConversionStep(FunctionDecl *Function,
                              QualType T,
                              bool HadMultipleCandidates);
 
   /// Add a new step that performs a qualification conversion to the
   /// given type.
   void AddQualificationConversionStep(QualType Ty,
                                      ExprValueKind Category);
 
+  /// Add a new step that performs an array boundconversion to the
+  /// given type.
+  void AddArrayBoundConversionStep(QualType Ty);
+
   /// Add a new step that performs a function reference conversion to the
   /// given type.
   void AddFunctionReferenceConversionStep(QualType Ty);
 
   /// Add a new step that performs conversion from non-atomic to atomic
   /// type.
   void AddAtomicConversionStep(QualType Ty);
 

clang/include/clang/Sema/Overload.h

public:
     /// string literal to a pointer to non-const character data
     /// (C++ 4.2p2).
     unsigned DeprecatedStringLiteralToCharPtr : 1;
 
     /// Whether the qualification conversion involves a change in the
     /// Objective-C lifetime (for automatic reference counting).
     unsigned QualificationIncludesObjCLifetime : 1;
 
+    // Whether the qualification conversion involves a change in array bounds
+    // (and is therefore CK_ArrayBound, rather than CK_NoOp).
+    unsigned QualificationIncludesArrayBound : 1;
+
     /// IncompatibleObjC - Whether this is an Objective-C conversion
     /// that we should warn about (if we actually use it).
     unsigned IncompatibleObjC : 1;
 
     /// ReferenceBinding - True when this is a reference binding
     /// (C++ [over.ics.ref]).
     unsigned ReferenceBinding : 1;
 

clang/include/clang/Sema/Sema.h

public:
   bool IsMemberPointerConversion(Expr *From, QualType FromType, QualType ToType,
                                  bool InOverloadResolution,
                                  QualType &ConvertedType);
   bool CheckMemberPointerConversion(Expr *From, QualType ToType,
                                     CastKind &Kind,
                                     CXXCastPath &BasePath,
                                     bool IgnoreBaseAccess);
   bool IsQualificationConversion(QualType FromType, QualType ToType,
-                                 bool CStyle, bool &ObjCLifetimeConversion);
+                                 bool CStyle, bool &ObjCLifetimeConversion,
+                                 bool *ArrayBoundConversion = nullptr);
   bool IsFunctionConversion(QualType FromType, QualType ToType,
                             QualType &ResultTy);
   bool DiagnoseMultipleUserDefinedConversion(Expr *From, QualType ToType);
   bool isSameOrCompatibleFunctionType(CanQualType Param, CanQualType Arg);
 
   ExprResult PerformMoveOrCopyInitialization(const InitializedEntity &Entity,
                                              const VarDecl *NRVOCandidate,
                                              QualType ResultType,
public:
   };
 
   // Fake up a scoped enumeration that still contextually converts to bool.
   struct ReferenceConversionsScope {
     /// The conversions that would be performed on an lvalue of type T2 when
     /// binding a reference of type T1 to it, as determined when evaluating
     /// whether T1 is reference-compatible with T2.
     enum ReferenceConversions {
-      Qualification = 0x1,
-      NestedQualification = 0x2,
-      Function = 0x4,
-      DerivedToBase = 0x8,
-      ObjC = 0x10,
-      ObjCLifetime = 0x20,
+      // At-most one of the following can be set.
+      Function = 1 << 0,
+      DerivedToBase = 1 << 1,
+      ArrayBound = 1 << 2,
+      ObjC = 1 << 3,
+
+      // The following are combinable.
+      Qualification = 1 << 4,
+      NestedQualification = 1 << 5,
+      ObjCLifetime = 1 << 6,
 
       LLVM_MARK_AS_BITMASK_ENUM(/*LargestValue=*/ObjCLifetime)
     };
   };
   using ReferenceConversions = ReferenceConversionsScope::ReferenceConversions;
 
   ReferenceCompareResult
   CompareReferenceRelationship(SourceLocation Loc, QualType T1, QualType T2,

clang/lib/AST/Expr.cpp

bool CastExpr::CastConsistency() const {
   case CK_IntegralToFixedPoint:
   case CK_MatrixCast:
     assert(!getType()->isBooleanType() && "unheralded conversion to bool");
     goto CheckNoBasePath;
 
   case CK_Dependent:
   case CK_LValueToRValue:
   case CK_NoOp:
+  case CK_ArrayBound:
   case CK_AtomicToNonAtomic:
   case CK_NonAtomicToAtomic:
   case CK_PointerToBoolean:
   case CK_IntegralToBoolean:
   case CK_FloatingToBoolean:
   case CK_MemberPointerToBoolean:
   case CK_FloatingComplexToBoolean:
   case CK_IntegralComplexToBoolean:

clang/lib/AST/ExprConstant.cpp

case CK_AtomicToNonAtomic: {
       // This does not need to be done in place even for class/array types:
       // atomic-to-non-atomic conversion implies copying the object
       // representation.
       if (!Evaluate(AtomicVal, Info, E->getSubExpr()))
         return false;
       return DerivedSuccess(AtomicVal, E);
     }
 
+    case CK_ArrayBound:
     case CK_NoOp:
     case CK_UserDefinedConversion:
       return StmtVisitorTy::Visit(E->getSubExpr());
 
     case CK_LValueToRValue: {
       LValue LVal;
       if (!EvaluateLValue(E->getSubExpr(), LVal, Info))
         return false;
bool IntExprEvaluator::VisitCastExpr(const CastExpr *E) {
   case CK_ARCReclaimReturnedObject:
   case CK_ARCExtendBlockObject:
   case CK_CopyAndAutoreleaseBlockObject:
     return Error(E);
 
   case CK_UserDefinedConversion:
   case CK_LValueToRValue:
   case CK_AtomicToNonAtomic:
+  case CK_ArrayBound:
   case CK_NoOp:
   case CK_LValueToRValueBitCast:
     return ExprEvaluatorBaseTy::VisitCastExpr(E);
 
   case CK_MemberPointerToBoolean:
   case CK_PointerToBoolean:
   case CK_IntegralToBoolean:
   case CK_FloatingToBoolean:
if (Overflowed) {
                                          diag::warn_fixedpoint_constant_overflow)
           << Result.toString() << E->getType();
       if (!HandleOverflow(Info, E, Result, E->getType()))
         return false;
     }
 
     return Success(Result, E);
   }
+  case CK_ArrayBound:
   case CK_NoOp:
   case CK_LValueToRValue:
     return ExprEvaluatorBaseTy::VisitCastExpr(E);
   default:
     return Error(E);
   }
 }
 
bool ComplexExprEvaluator::VisitCastExpr(const CastExpr *E) {
   case CK_FixedPointToBoolean:
   case CK_FixedPointToIntegral:
   case CK_IntegralToFixedPoint:
   case CK_MatrixCast:
     llvm_unreachable("invalid cast kind for complex value");
 
   case CK_LValueToRValue:
   case CK_AtomicToNonAtomic:
+  case CK_ArrayBound:
   case CK_NoOp:
   case CK_LValueToRValueBitCast:
     return ExprEvaluatorBaseTy::VisitCastExpr(E);
 
   case CK_Dependent:
   case CK_LValueBitCast:
   case CK_UserDefinedConversion:
     return Error(E);
if (isa<ExplicitCastExpr>(E)) {
           return ICEDiag(IK_NotICE, E->getBeginLoc());
         return NoDiag();
       }
     }
     switch (cast<CastExpr>(E)->getCastKind()) {
     case CK_LValueToRValue:
     case CK_AtomicToNonAtomic:
     case CK_NonAtomicToAtomic:
+    case CK_ArrayBound:
     case CK_NoOp:
     case CK_IntegralToBoolean:
     case CK_IntegralCast:
       return CheckICE(SubExpr, Ctx);
     default:
       return ICEDiag(IK_NotICE, E->getBeginLoc());
     }
   }

clang/lib/AST/Interp/ByteCodeExprGen.cpp

bool ByteCodeExprGen<Emitter>::VisitCastExpr(const CastExpr *CE) {
   }
 
   case CK_ArrayToPointerDecay:
   case CK_AtomicToNonAtomic:
   case CK_ConstructorConversion:
   case CK_FunctionToPointerDecay:
   case CK_NonAtomicToAtomic:
   case CK_NoOp:
+  case CK_ArrayBound:
   case CK_UserDefinedConversion:
     return this->Visit(SubExpr);
 
   case CK_ToVoid:
     return discard(SubExpr);
 
   default: {
     // TODO: implement other casts.

clang/lib/Analysis/ThreadSafetyCommon.cpp

if (const auto *DRE = dyn_cast<DeclRefExpr>(CE->getSubExpr())) {
         return E0;
     }
     til::SExpr *E0 = translate(CE->getSubExpr(), Ctx);
     return E0;
     // FIXME!! -- get Load working properly
     // return new (Arena) til::Load(E0);
   }
   case CK_NoOp:
+  case CK_ArrayBound:
   case CK_DerivedToBase:
   case CK_UncheckedDerivedToBase:
   case CK_ArrayToPointerDecay:
   case CK_FunctionToPointerDecay: {
     til::SExpr *E0 = translate(CE->getSubExpr(), Ctx);
     return E0;
   }
   default: {

clang/lib/CodeGen/CGDecl.cpp

 static bool tryEmitARCCopyWeakInit(CodeGenFunction &CGF,
                                    const LValue &destLV, const Expr *init) {
   bool needsCast = false;
 
   while (auto castExpr = dyn_cast<CastExpr>(init->IgnoreParens())) {
     switch (castExpr->getCastKind()) {
     // Look through casts that don't require representation changes.
     case CK_NoOp:
+    case CK_ArrayBound:
     case CK_BitCast:
     case CK_BlockPointerToObjCPointerCast:
       needsCast = true;
       break;
 
     // If we find an l-value to r-value cast from a __weak variable,
     // emit this operation as a copy or move.
     case CK_LValueToRValue: {

clang/lib/CodeGen/CGExpr.cpp

Address CodeGenFunction::EmitPointerWithAlignment(const Expr *E,
   if (const CastExpr *CE = dyn_cast<CastExpr>(E)) {
     if (const auto *ECE = dyn_cast<ExplicitCastExpr>(CE))
       CGM.EmitExplicitCastExprType(ECE, this);
 
     switch (CE->getCastKind()) {
     // Non-converting casts (but not C's implicit conversion from void*).
     case CK_BitCast:
     case CK_NoOp:
+    case CK_ArrayBound:
     case CK_AddressSpaceConversion:
       if (auto PtrTy = CE->getSubExpr()->getType()->getAs<PointerType>()) {
         if (PtrTy->getPointeeType()->isVoidType())
           break;
 
         LValueBaseInfo InnerBaseInfo;
         TBAAAccessInfo InnerTBAAInfo;
         Address Addr = EmitPointerWithAlignment(CE->getSubExpr(),
LValue CodeGenFunction::EmitCastLValue(const CastExpr *E) {
   case CK_ConstructorConversion:
   case CK_UserDefinedConversion:
   case CK_CPointerToObjCPointerCast:
   case CK_BlockPointerToObjCPointerCast:
   case CK_NoOp:
   case CK_LValueToRValue:
     return EmitLValue(E->getSubExpr());
 
+  case CK_ArrayBound: {
+    Address Addr = EmitLValue(E->getSubExpr()).getAddress(*this);
+    unsigned AddrSpace = Addr.getPointer()->getType()->getPointerAddressSpace();
+    llvm::Type *PtrTy = ConvertType(E->getType())->getPointerTo(AddrSpace);
+    return MakeAddrLValue(Builder.CreateBitCast(Addr, PtrTy), E->getType());
+  }
+
   case CK_UncheckedDerivedToBase:
   case CK_DerivedToBase: {
     const auto *DerivedClassTy =
         E->getSubExpr()->getType()->castAs<RecordType>();
     auto *DerivedClassDecl = cast<CXXRecordDecl>(DerivedClassTy->getDecl());
 
     LValue LV = EmitLValue(E->getSubExpr());
     Address This = LV.getAddress(*this);
case CK_BaseToDerived: {
 
     return MakeAddrLValue(Derived, E->getType(), LV.getBaseInfo(),
                           CGM.getTBAAInfoForSubobject(LV, E->getType()));
   }
   case CK_LValueBitCast: {
     // This must be a reinterpret_cast (or c-style equivalent).
     const auto *CE = cast<ExplicitCastExpr>(E);
 
     CGM.EmitExplicitCastExprType(CE, this);
     LValue LV = EmitLValue(E->getSubExpr());
     Address V = Builder.CreateBitCast(LV.getAddress(*this),
                                       ConvertType(CE->getTypeAsWritten()));
 
     if (SanOpts.has(SanitizerKind::CFIUnrelatedCast))
       EmitVTablePtrCheckForCast(E->getType(), V.getPointer(),
                                 /*MayBeNull=*/false, CFITCK_UnrelatedCast,
                                 E->getBeginLoc());

clang/lib/CodeGen/CGExprAgg.cpp

assert(CGF.getContext().hasSameUnqualifiedType(E->getSubExpr()->getType(),
                                                    E->getType()) &&
            "Implicit cast types must be compatible");
     Visit(E->getSubExpr());
     break;
 
   case CK_LValueBitCast:
     llvm_unreachable("should not be emitting lvalue bitcast as rvalue");
 
+  case CK_ArrayBound: // FIXME: check this is right categorization.
   case CK_Dependent:
   case CK_BitCast:
   case CK_ArrayToPointerDecay:
   case CK_FunctionToPointerDecay:
   case CK_NullToPointer:
   case CK_NullToMemberPointer:
   case CK_BaseToDerivedMemberPointer:
   case CK_DerivedToBaseMemberPointer:

 
 /// Determine whether the given cast kind is known to always convert values
 /// with all zero bits in their value representation to values with all zero
 /// bits in their value representation.
 static bool castPreservesZero(const CastExpr *CE) {
   switch (CE->getCastKind()) {
     // No-ops.
   case CK_NoOp:
+  case CK_ArrayBound:
   case CK_UserDefinedConversion:
   case CK_ConstructorConversion:
   case CK_BitCast:
   case CK_ToUnion:
   case CK_ToVoid:
     // Conversions between (possibly-complex) integral, (possibly-complex)
     // floating-point, and bool.
   case CK_BooleanToSignedIntegral:

clang/lib/CodeGen/CGExprComplex.cpp

case CK_LValueToRValueBitCast: {
     Address Addr = Builder.CreateElementBitCast(SourceLVal.getAddress(CGF),
                                                 CGF.ConvertTypeForMem(DestTy));
     LValue DestLV = CGF.MakeAddrLValue(Addr, DestTy);
     DestLV.setTBAAInfo(TBAAAccessInfo::getMayAliasInfo());
     return EmitLoadOfLValue(DestLV, Op->getExprLoc());
   }
 
   case CK_BitCast:
+  case CK_ArrayBound:
   case CK_BaseToDerived:
   case CK_DerivedToBase:
   case CK_UncheckedDerivedToBase:
   case CK_Dynamic:
   case CK_ToUnion:
   case CK_ArrayToPointerDecay:
   case CK_FunctionToPointerDecay:
   case CK_NullToPointer:

clang/lib/CodeGen/CGExprConstant.cpp

llvm::Constant *VisitCastExpr(CastExpr *E, QualType destType) {
     case CK_ARCReclaimReturnedObject:
     case CK_ARCExtendBlockObject:
     case CK_CopyAndAutoreleaseBlockObject:
       return nullptr;
 
     // These don't need to be handled here because Evaluate knows how to
     // evaluate them in the cases where they can be folded.
     case CK_BitCast:
+    case CK_ArrayBound: // FIXME: /Does/ Evaluate know?
     case CK_ToVoid:
     case CK_Dynamic:
     case CK_LValueBitCast:
     case CK_LValueToRValueBitCast:
     case CK_NullToMemberPointer:
     case CK_UserDefinedConversion:
     case CK_CPointerToObjCPointerCast:
     case CK_BlockPointerToObjCPointerCast:

clang/lib/CodeGen/CGExprScalar.cpp

case CK_LValueToRValueBitCast: {
     LValue DestLV = CGF.MakeAddrLValue(Addr, DestTy);
     DestLV.setTBAAInfo(TBAAAccessInfo::getMayAliasInfo());
     return EmitLoadOfLValue(DestLV, CE->getExprLoc());
   }
 
   case CK_CPointerToObjCPointerCast:
   case CK_BlockPointerToObjCPointerCast:
   case CK_AnyPointerToBlockPointerCast:
+  case CK_ArrayBound:
   case CK_BitCast: {
     Value *Src = Visit(const_cast<Expr*>(E));
     llvm::Type *SrcTy = Src->getType();
     llvm::Type *DstTy = ConvertType(DestTy);
     if (SrcTy->isPtrOrPtrVectorTy() && DstTy->isPtrOrPtrVectorTy() &&
         SrcTy->getPointerAddressSpace() != DstTy->getPointerAddressSpace()) {
       llvm_unreachable("wrong cast for pointers in different address spaces"
                        "(must be an address space cast)!");

clang/lib/CodeGen/CGObjC.cpp

if (const CastExpr *cast = dyn_cast<CastExpr>(e)) {
     case CK_LValueToRValue:
     case CK_ARCReclaimReturnedObject:
     case CK_ARCConsumeObject:
     case CK_ARCProduceObject:
       return false;
 
     // These operations preserve a block type.
     case CK_NoOp:
+    case CK_ArrayBound:
     case CK_BitCast:
       return shouldEmitSeparateBlockRetain(cast->getSubExpr());
 
     // These operations are known to be bad (or haven't been considered).
     case CK_AnyPointerToBlockPointerCast:
     default:
       return true;
     }
Result ARCExprEmitter<Impl,Result>::visitCastExpr(const CastExpr *e) {
   // No-op casts don't change the type, so we just ignore them.
   case CK_NoOp:
     return asImpl().visit(e->getSubExpr());
 
   // These casts can change the type.
   case CK_CPointerToObjCPointerCast:
   case CK_BlockPointerToObjCPointerCast:
   case CK_AnyPointerToBlockPointerCast:
+  case CK_ArrayBound:
   case CK_BitCast: {
     llvm::Type *resultType = CGF.ConvertType(e->getType());
     assert(e->getSubExpr()->getType()->hasPointerRepresentation());
     Result result = asImpl().visit(e->getSubExpr());
     return asImpl().emitBitCast(result, resultType);
   }
 
   // Handle some casts specially.

clang/lib/Edit/RewriteObjCFoundationAPI.cpp

if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Arg)) {
     case CK_FloatingComplexToBoolean:
     case CK_IntegralComplexToReal:
     case CK_IntegralComplexToBoolean:
     case CK_AtomicToNonAtomic:
     case CK_AddressSpaceConversion:
       needsCast = true;
       break;
 
+    case CK_ArrayBound:
     case CK_Dependent:
     case CK_BitCast:
     case CK_LValueBitCast:
     case CK_LValueToRValueBitCast:
     case CK_BaseToDerived:
     case CK_DerivedToBase:
     case CK_UncheckedDerivedToBase:
     case CK_Dynamic:

clang/lib/Sema/SemaChecking.cpp

static getBaseAlignmentAndOffsetFromLValue(const Expr *E, ASTContext &Ctx) {
   case Stmt::CXXStaticCastExprClass:
   case Stmt::ImplicitCastExprClass: {
     auto *CE = cast<CastExpr>(E);
     const Expr *From = CE->getSubExpr();
     switch (CE->getCastKind()) {
     default:
       break;
     case CK_NoOp:
+    case CK_ArrayBound:
       return getBaseAlignmentAndOffsetFromLValue(From, Ctx);
     case CK_UncheckedDerivedToBase:
     case CK_DerivedToBase: {
       auto P = getBaseAlignmentAndOffsetFromLValue(From, Ctx);
       if (!P)
         break;
       return getDerivedToBaseAlignmentAndOffset(CE, From->getType(), P->first,
                                                 P->second, Ctx);
static getBaseAlignmentAndOffsetFromPtr(const Expr *E, ASTContext &Ctx) {
   case Stmt::CXXStaticCastExprClass:
   case Stmt::ImplicitCastExprClass: {
     auto *CE = cast<CastExpr>(E);
     const Expr *From = CE->getSubExpr();
     switch (CE->getCastKind()) {
     default:
       break;
     case CK_NoOp:
+    case CK_ArrayBound:
       return getBaseAlignmentAndOffsetFromPtr(From, Ctx);
     case CK_ArrayToPointerDecay:
       return getBaseAlignmentAndOffsetFromLValue(From, Ctx);
     case CK_UncheckedDerivedToBase:
     case CK_DerivedToBase: {
       auto P = getBaseAlignmentAndOffsetFromPtr(From, Ctx);
       if (!P)
         break;

clang/lib/Sema/SemaExpr.cpp

static ExprResult rebuildPotentialResultsAsNonOdrUsed(Sema &S, Expr *E,
   // casts, but not at the top level, so rebuild them here.
   case Expr::ImplicitCastExprClass: {
     auto *ICE = cast<ImplicitCastExpr>(E);
     // Only step through the narrow set of cast kinds we expect to encounter.
     // Anything else suggests we've left the region in which potential results
     // can be found.
     switch (ICE->getCastKind()) {
     case CK_NoOp:
+    case CK_ArrayBound:
     case CK_DerivedToBase:
     case CK_UncheckedDerivedToBase: {
       ExprResult Sub = Rebuild(ICE->getSubExpr());
       if (!Sub.isUsable())
         return Sub;
       CXXCastPath Path(ICE->path());
       return S.ImpCastExprToType(Sub.get(), ICE->getType(), ICE->getCastKind(),
                                  ICE->getValueKind(), &Path);

clang/lib/Sema/SemaExprCXX.cpp

if (ToType->isReferenceType() &&
             From->getType().getAddressSpace())
       CK = CK_AddressSpaceConversion;
 
     if (ToType->isPointerType() &&
         ToType->getPointeeType().getAddressSpace() !=
             From->getType()->getPointeeType().getAddressSpace())
       CK = CK_AddressSpaceConversion;
 
+    if (SCS.QualificationIncludesArrayBound)
+      CK = CK_ArrayBound;
+
     From = ImpCastExprToType(From, ToType.getNonLValueExprType(Context), CK, VK,
                              /*BasePath=*/nullptr, CCK)
                .get();
 
     if (SCS.DeprecatedStringLiteralToCharPtr &&
         !getLangOpts().WritableStrings) {
       Diag(From->getBeginLoc(),
            getLangOpts().CPlusPlus11
while (true) {
 
     const ObjCObjectPointerType *ObjPtr1, *ObjPtr2;
     if ((ObjPtr1 = Composite1->getAs<ObjCObjectPointerType>()) &&
         (ObjPtr2 = Composite2->getAs<ObjCObjectPointerType>())) {
       Composite1 = ObjPtr1->getPointeeType();
       Composite2 = ObjPtr2->getPointeeType();
       Steps.emplace_back(Step::ObjCPointer);
       continue;
     }
 
     const MemberPointerType *MemPtr1, *MemPtr2;
     if ((MemPtr1 = Composite1->getAs<MemberPointerType>()) &&
         (MemPtr2 = Composite2->getAs<MemberPointerType>())) {
       Composite1 = MemPtr1->getPointeeType();
       Composite2 = MemPtr2->getPointeeType();
 
       // At the top level, we can perform a base-to-derived pointer-to-member

clang/lib/Sema/SemaExprObjC.cpp

public:
 
     /// Look through certain implicit and explicit casts.
     ACCResult VisitCastExpr(CastExpr *e) {
       switch (e->getCastKind()) {
         case CK_NullToPointer:
           return ACC_bottom;
 
         case CK_NoOp:
+        case CK_ArrayBound:
         case CK_LValueToRValue:
         case CK_BitCast:
         case CK_CPointerToObjCPointerCast:
         case CK_BlockPointerToObjCPointerCast:
         case CK_AnyPointerToBlockPointerCast:
           return Visit(e->getSubExpr());
 
         default:

clang/lib/Sema/SemaInit.cpp

void InitializationSequence::Step::Destroy() {
   case SK_CastDerivedToBaseRValue:
   case SK_CastDerivedToBaseXValue:
   case SK_CastDerivedToBaseLValue:
   case SK_BindReference:
   case SK_BindReferenceToTemporary:
   case SK_FinalCopy:
   case SK_ExtraneousCopyToTemporary:
   case SK_UserConversion:
+  case SK_ArrayBoundConversion:
   case SK_QualificationConversionRValue:
   case SK_QualificationConversionXValue:
   case SK_QualificationConversionLValue:
   case SK_FunctionReferenceConversion:
   case SK_AtomicConversion:
   case SK_ListInitialization:
   case SK_UnwrapInitList:
   case SK_RewrapInitList:

 
 void InitializationSequence::AddFunctionReferenceConversionStep(QualType Ty) {
   Step S;
   S.Kind = SK_FunctionReferenceConversion;
   S.Type = Ty;
   Steps.push_back(S);
 }
 
+void InitializationSequence::AddArrayBoundConversionStep(QualType Ty) {
+  Step S;
+  S.Kind = SK_ArrayBoundConversion;
+  S.Type = Ty;
+  Steps.push_back(S);
+}
+
 void InitializationSequence::AddAtomicConversionStep(QualType Ty) {
   Step S;
   S.Kind = SK_AtomicConversion;
   S.Type = Ty;
   Steps.push_back(S);
 }
 
 void InitializationSequence::AddConversionSequenceStep(
if (InitCategory.isLValue() && !isNonReferenceableGLValue(Initializer) &&
          (Kind.isCStyleOrFunctionalCast() &&
           RefRelationship == Sema::Ref_Related))) {
       //   - is an lvalue (but is not a bit-field), and "cv1 T1" is
       //     reference-compatible with "cv2 T2," or
       if (RefConv & (Sema::ReferenceConversions::DerivedToBase |
                      Sema::ReferenceConversions::ObjC)) {
         // If we're converting the pointee, add any qualifiers first;
         // these qualifiers must all be top-level, so just convert to "cv1 T2".
-        if (RefConv & (Sema::ReferenceConversions::Qualification))
+        if (RefConv & Sema::ReferenceConversions::Qualification)
           Sequence.AddQualificationConversionStep(
               S.Context.getQualifiedType(T2, T1Quals),
               Initializer->getValueKind());
         if (RefConv & Sema::ReferenceConversions::DerivedToBase)
           Sequence.AddDerivedToBaseCastStep(cv1T1, VK_LValue);
         else
           Sequence.AddObjCObjectConversionStep(cv1T1);
+      } else if (RefConv & Sema::ReferenceConversions::ArrayBound) {
+        Sequence.AddArrayBoundConversionStep(cv1T1);
       } else if (RefConv & Sema::ReferenceConversions::Qualification) {
         // Perform a (possibly multi-level) qualification conversion.
         Sequence.AddQualificationConversionStep(cv1T1,
                                                 Initializer->getValueKind());
       } else if (RefConv & Sema::ReferenceConversions::Function) {
         Sequence.AddFunctionReferenceConversionStep(cv1T1);
       }
 
static InvalidICRKind isInvalidICRSource(ASTContext &C, Expr *e,
 
   // Skip certain casts.
   } else if (CastExpr *ce = dyn_cast<CastExpr>(e)) {
     switch (ce->getCastKind()) {
     case CK_Dependent:
     case CK_BitCast:
     case CK_LValueBitCast:
     case CK_NoOp:
+    case CK_ArrayBound:
       return isInvalidICRSource(C, ce->getSubExpr(), isAddressOf, isWeakAccess);
 
     case CK_ArrayToPointerDecay:
       return IIK_nonscalar;
 
     case CK_NullToPointer:
       return IIK_okay;
 
if (auto *CE = dyn_cast<CastExpr>(Init)) {
           return false;
         }, EnableLifetimeWarnings);
 
         // We assume that objects can be retained by pointers cast to integers,
         // but not if the integer is cast to floating-point type or to _Complex.
         // We assume that casts to 'bool' do not preserve enough information to
         // retain a local object.
       case CK_NoOp:
+      case CK_ArrayBound:
       case CK_BitCast:
       case CK_BaseToDerived:
       case CK_DerivedToBase:
       case CK_UncheckedDerivedToBase:
       case CK_Dynamic:
       case CK_ToUnion:
       case CK_UserDefinedConversion:
       case CK_ConstructorConversion:
ExprResult InitializationSequence::Perform(Sema &S,
   case SK_CastDerivedToBaseRValue:
   case SK_CastDerivedToBaseXValue:
   case SK_CastDerivedToBaseLValue:
   case SK_BindReference:
   case SK_BindReferenceToTemporary:
   case SK_FinalCopy:
   case SK_ExtraneousCopyToTemporary:
   case SK_UserConversion:
+  case SK_ArrayBoundConversion:
   case SK_QualificationConversionLValue:
   case SK_QualificationConversionXValue:
   case SK_QualificationConversionRValue:
   case SK_FunctionReferenceConversion:
   case SK_AtomicConversion:
   case SK_ConversionSequence:
   case SK_ConversionSequenceNoNarrowing:
   case SK_ListInitialization:
case SK_BindReferenceToTemporary: {
       // Check exception specifications
       if (S.CheckExceptionSpecCompatibility(CurInit.get(), DestType))
         return ExprError();
 
       QualType MTETy = Step->Type;
 
       // When this is an incomplete array type (such as when this is
       // initializing an array of unknown bounds from an init list), use THAT
       // type instead so that we propogate the array bounds.
       if (MTETy->isIncompleteArrayType() &&
           !CurInit.get()->getType()->isIncompleteArrayType() &&
           S.Context.hasSameType(
               MTETy->getPointeeOrArrayElementType(),
               CurInit.get()->getType()->getPointeeOrArrayElementType()))
         MTETy = CurInit.get()->getType();
 
       // Materialize the temporary into memory.
case SK_UserConversion: {
           S.MarkFunctionReferenced(CurInit.get()->getBeginLoc(), Destructor);
           if (S.DiagnoseUseOfDecl(Destructor, CurInit.get()->getBeginLoc()))
             return ExprError();
         }
       }
       break;
     }
 
+    case SK_ArrayBoundConversion:
+      // Perform an array bound conversion.
+      // FIXME: If pointer to array not LValue?
+      CurInit = S.ImpCastExprToType(CurInit.get(), Step->Type, CK_ArrayBound,
+                                    VK_LValue);
+      break;
+
     case SK_QualificationConversionLValue:
     case SK_QualificationConversionXValue:
     case SK_QualificationConversionRValue: {
       // Perform a qualification conversion; these can never go wrong.
       ExprValueKind VK =
           Step->Kind == SK_QualificationConversionLValue
               ? VK_LValue
               : (Step->Kind == SK_QualificationConversionXValue ? VK_XValue
for (step_iterator S = step_begin(), SEnd = step_end(); S != SEnd; ++S) {
     case SK_ExtraneousCopyToTemporary:
       OS << "extraneous C++03 copy to temporary";
       break;
 
     case SK_UserConversion:
       OS << "user-defined conversion via " << *S->Function.Function;
       break;
 
+    case SK_ArrayBoundConversion:
+      OS << "array bound conversion";
+      break;
+
     case SK_QualificationConversionRValue:
       OS << "qualification conversion (rvalue)";
       break;
 
     case SK_QualificationConversionXValue:
       OS << "qualification conversion (xvalue)";
       break;
 

clang/lib/Sema/SemaOverload.cpp

 /// StandardConversionSequence - Set the standard conversion
 /// sequence to the identity conversion.
 void StandardConversionSequence::setAsIdentityConversion() {
   First = ICK_Identity;
   Second = ICK_Identity;
   Third = ICK_Identity;
   DeprecatedStringLiteralToCharPtr = false;
   QualificationIncludesObjCLifetime = false;
+  QualificationIncludesArrayBound = false;
   ReferenceBinding = false;
   DirectBinding = false;
   IsLvalueReference = true;
   BindsToFunctionLvalue = false;
   BindsToRvalue = false;
   BindsImplicitObjectArgumentWithoutRefQualifier = false;
   ObjCLifetimeConversionBinding = false;
   CopyConstructor = nullptr;
while (auto *ICE = dyn_cast<ImplicitCastExpr>(Converted)) {
     case CK_IntegralToFloating:
     case CK_BooleanToSignedIntegral:
     case CK_FloatingToIntegral:
     case CK_FloatingToBoolean:
     case CK_FloatingCast:
       Converted = ICE->getSubExpr();
       continue;
 
+    case CK_ArrayBound: // FIXME: Right categorization?
     default:
       return Converted;
     }
   }
 
   return Converted;
 }
 
static bool IsStandardConversion(Sema &S, Expr* From, QualType ToType,
   } else {
     // No second conversion required.
     SCS.Second = ICK_Identity;
   }
   SCS.setToType(1, FromType);
 
   // The third conversion can be a function pointer conversion or a
   // qualification conversion (C++ [conv.fctptr], [conv.qual]).
-  bool ObjCLifetimeConversion;
+  bool ObjCLifetimeConversion, ArrayBoundConversion = false;
   if (S.IsFunctionConversion(FromType, ToType, FromType)) {
     // Function pointer conversions (removing 'noexcept') including removal of
     // 'noreturn' (Clang extension).
     SCS.Third = ICK_Function_Conversion;
   } else if (S.IsQualificationConversion(FromType, ToType, CStyle,
-                                         ObjCLifetimeConversion)) {
+                                         ObjCLifetimeConversion,
+                                         &ArrayBoundConversion)) {
     SCS.Third = ICK_Qualification;
     SCS.QualificationIncludesObjCLifetime = ObjCLifetimeConversion;
+    SCS.QualificationIncludesArrayBound = ArrayBoundConversion;
     FromType = ToType;
   } else {
     // No conversion required
     SCS.Third = ICK_Identity;
   }
 
   // C++ [over.best.ics]p6:
   //   [...] Any difference in top-level cv-qualification is

 }
 
 /// Perform a single iteration of the loop for checking if a qualification
 /// conversion is valid.
 ///
 /// Specifically, check whether any change between the qualifiers of \p
 /// FromType and \p ToType is permissible, given knowledge about whether every
 /// outer layer is const-qualified.
+/// This does not handle C++20 bounded->unbounded array conversion
 static bool isQualificationConversionStep(QualType FromType, QualType ToType,
                                           bool CStyle, bool IsTopLevel,
                                           bool &PreviousToQualsIncludeConst,
                                           bool &ObjCLifetimeConversion) {
   Qualifiers FromQuals = FromType.getQualifiers();
   Qualifiers ToQuals = ToType.getQualifiers();
 
   // Ignore __unaligned qualifier if this type is void.
static bool isQualificationConversionStep(QualType FromType, QualType ToType,
   // include const.
   PreviousToQualsIncludeConst =
       PreviousToQualsIncludeConst && ToQuals.hasConst();
   return true;
 }
 
 /// IsQualificationConversion - Determines whether the conversion from
 /// an rvalue of type FromType to ToType is a qualification conversion
 /// (C++ 4.4).
 ///
 /// \param ObjCLifetimeConversion Output parameter that will be set to indicate
 /// when the qualification conversion involves a change in the Objective-C
 /// object lifetime.
-bool
-Sema::IsQualificationConversion(QualType FromType, QualType ToType,
-                                bool CStyle, bool &ObjCLifetimeConversion) {
+bool Sema::IsQualificationConversion(QualType FromType, QualType ToType,
+                                     bool CStyle, bool &ObjCLifetimeConversion,
+                                     // FIXME: should this be CastKind? ref?
+                                     bool *ArrayBoundConversion) {
   FromType = Context.getCanonicalType(FromType);
   ToType = Context.getCanonicalType(ToType);
   ObjCLifetimeConversion = false;
 
   // If FromType and ToType are the same type, this is not a
   // qualification conversion.
   if (FromType.getUnqualifiedType() == ToType.getUnqualifiedType())
     return false;
 
   // (C++ 4.4p4):
   //   A conversion can add cv-qualifiers at levels other than the first
   //   in multi-level pointers, subject to the following rules: [...]
   bool PreviousToQualsIncludeConst = true;
-  bool UnwrappedAnyPointer = false;
-  while (Context.UnwrapSimilarTypes(FromType, ToType)) {
+  bool UnwrappedAnything = false;
+  for (;;) {
+    if (getLangOpts().CPlusPlus20)
+      // C++20, p0388, T1 can be unbounded array and T2 bounded array
+      if (auto AT1 = Context.getAsArrayType(ToType))
+        if (isa<IncompleteArrayType>(AT1))
+          if (auto AT2 = Context.getAsArrayType(FromType))
+            if (isa<ConstantArrayType>(AT2)) {
+              ToType = AT1->getElementType();
+              FromType = AT2->getElementType();
+              if (ArrayBoundConversion)
+                *ArrayBoundConversion = true;
+              UnwrappedAnything = true;
+            }
+
+    if (!Context.UnwrapSimilarTypes(FromType, ToType))
+      break;
+
     if (!isQualificationConversionStep(
-            FromType, ToType, CStyle, !UnwrappedAnyPointer,
+            FromType, ToType, CStyle, !UnwrappedAnything,
             PreviousToQualsIncludeConst, ObjCLifetimeConversion))
       return false;
-    UnwrappedAnyPointer = true;
+    UnwrappedAnything = true;
   }
 
   // We are left with FromType and ToType being the pointee types
   // after unwrapping the original FromType and ToType the same number
   // of times. If we unwrapped any pointers, and if FromType and
   // ToType have the same unqualified type (since we checked
   // qualifiers above), then this is a qualification conversion.
-  return UnwrappedAnyPointer && Context.hasSameUnqualifiedType(FromType,ToType);
+  return UnwrappedAnything && Context.hasSameUnqualifiedType(FromType,ToType);
 }
 
 /// - Determine whether this is a conversion from a scalar type to an
 /// atomic type.
 ///
 /// If successful, updates \c SCS's second and third steps in the conversion
 /// sequence to finish the conversion.
 static bool tryAtomicConversion(Sema &S, Expr *From, QualType ToType,
if (!IsStandardConversion(S, From, ToAtomic->getValueType(),
                             CStyle, /*AllowObjCWritebackConversion=*/false))
     return false;
 
   SCS.Second = InnerSCS.Second;
   SCS.setToType(1, InnerSCS.getToType(1));
   SCS.Third = InnerSCS.Third;
   SCS.QualificationIncludesObjCLifetime
     = InnerSCS.QualificationIncludesObjCLifetime;
+  SCS.QualificationIncludesArrayBound =
+      InnerSCS.QualificationIncludesArrayBound;
   SCS.setToType(2, InnerSCS.getToType(2));
   return true;
 }
 
 static bool isFirstArgumentCompatibleWithType(ASTContext &Context,
                                               CXXConstructorDecl *Constructor,
                                               QualType Type) {
   const auto *CtorType = Constructor->getType()->castAs<FunctionProtoType>();
CompareQualificationConversions(Sema &S,
   if (SCS1.QualificationIncludesObjCLifetime !=
                                       SCS2.QualificationIncludesObjCLifetime) {
     Result = SCS1.QualificationIncludesObjCLifetime
                ? ImplicitConversionSequence::Worse
                : ImplicitConversionSequence::Better;
   }
 
   while (S.Context.UnwrapSimilarTypes(T1, T2)) {
+    // FIXME: Array bound conversion comparison?
     // Within each iteration of the loop, we check the qualifiers to
     // determine if this still looks like a qualification
     // conversion. Then, if all is well, we unwrap one more level of
     // pointers or pointers-to-members and do it all again
     // until there are no more pointers or pointers-to-members left
     // to unwrap. This essentially mimics what
     // IsQualificationConversion does, but here we're checking for a
     // strict subset of qualifiers.
do {
     // overload resolution.
     if (!TopLevel)
       Conv |= ReferenceConversions::NestedQualification;
 
     // MS compiler ignores __unaligned qualifier for references; do the same.
     T1 = withoutUnaligned(Context, T1);
     T2 = withoutUnaligned(Context, T2);
 
+    if (getLangOpts().CPlusPlus20)
+      // C++20, p0388, T1 can be incomplete array and T2 bounded array
+      // FIXME: We have canonical types here, so may not need getAsArrayType?
+      if (auto AT1 = Context.getAsArrayType(T1))
+        if (isa<IncompleteArrayType>(AT1))
+          if (auto AT2 = Context.getAsArrayType(T2))
+            if (isa<ConstantArrayType>(AT2)) {
+              T1 = AT1->getElementType();
+              T2 = AT2->getElementType();
+              Conv |= ReferenceConversions::ArrayBound;
+            }
     // If we find a qualifier mismatch, the types are not reference-compatible,
     // but are still be reference-related if they're similar.
     bool ObjCLifetimeConversion = false;
     if (!isQualificationConversionStep(T2, T1, /*CStyle=*/false, TopLevel,
                                        PreviousToQualsIncludeConst,
                                        ObjCLifetimeConversion))
       return (ConvertedReferent || Context.hasSimilarType(T1, T2))
                  ? Ref_Related
                  : Ref_Incompatible;
 
     // FIXME: Should we track this for any level other than the first?
     if (ObjCLifetimeConversion)
       Conv |= ReferenceConversions::ObjCLifetime;
 
     TopLevel = false;
   } while (Context.UnwrapSimilarTypes(T1, T2));
 
   // At this point, if the types are reference-related, we must either have the
   // same inner type (ignoring qualifiers), or must have already worked out how
   // to convert the referent.
-  return (ConvertedReferent || Context.hasSameUnqualifiedType(T1, T2))
-             ? Ref_Compatible
-             : Ref_Incompatible;
+  if (ConvertedReferent)
+    return Ref_Compatible;
+
+  if (Context.hasSameUnqualifiedType(T1, T2))
+    return Ref_Compatible;
+
+  return Ref_Incompatible;
 }
 
 /// Look for a user-defined conversion to a value reference-compatible
 ///        with DeclType. Return true if something definite is found.
 static bool
 FindConversionForRefInit(Sema &S, ImplicitConversionSequence &ICS,
                          QualType DeclType, SourceLocation DeclLoc,
                          Expr *Init, QualType T2, bool AllowRvalues,

 /// \param ConvType The return type of the conversion function.
 ///
 /// \param ToType The type we are converting to.
 ///
 /// \param AllowObjCPointerConversion Allow a conversion from one
 /// Objective-C pointer to another.
 ///
 /// \returns true if the conversion is allowable, false otherwise.
+// FIXME: Should this return arraybound flag?
 static bool isAllowableExplicitConversion(Sema &S,
                                           QualType ConvType, QualType ToType,
                                           bool AllowObjCPointerConversion) {
   QualType ToNonRefType = ToType.getNonReferenceType();
 
   // Easy case: the types are the same.
   if (S.Context.hasSameUnqualifiedType(ConvType, ToNonRefType))
     return true;

clang/lib/StaticAnalyzer/Core/ExprEngineC.cpp

switch (CastE->getCastKind()) {
           Bldr.generateNode(CastE, Pred, state);
           continue;
         }
         // Explicitly proceed with default handler for this case cascade.
         state =
             handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
         continue;
       }
+      case CK_ArrayBound: // FIXME: is this the best categorization?
       case CK_Dependent:
       case CK_ArrayToPointerDecay:
       case CK_BitCast:
       case CK_LValueToRValueBitCast:
       case CK_AddressSpaceConversion:
       case CK_BooleanToSignedIntegral:
       case CK_IntegralToPointer:
       case CK_PointerToIntegral: {

clang/lib/StaticAnalyzer/Core/SValBuilder.cpp

Optional<SVal> SValBuilder::getConstantVal(const Expr *E) {
   case Stmt::ImplicitCastExprClass: {
     const auto *CE = cast<CastExpr>(E);
     switch (CE->getCastKind()) {
     default:
       break;
     case CK_ArrayToPointerDecay:
     case CK_IntegralToPointer:
     case CK_NoOp:
+    case CK_ArrayBound:
     case CK_BitCast: {
       const Expr *SE = CE->getSubExpr();
       Optional<SVal> Val = getConstantVal(SE);
       if (!Val)
         return None;
       return evalCast(*Val, CE->getType(), SE->getType());
     }
     }

clang/test/CXX/drs/dr3xx.cpp

namespace dr330 { // dr330: 7
   typedef Qinner const *Q2; // same as Q, but 'const' written outside the array type
   typedef const int *const (*R)[4];
   typedef const int *const (*S)[];
   typedef const int *(*T)[];
   void f(P p, Q q, Q2 q2, R r, S s, T t) {
     q = p; // ok
     q2 = p; // ok
     r = p; // expected-error {{incompatible}}
-    s = p; // expected-error {{incompatible}} (for now)
+    s = p;
+#if __cplusplus < 202002
+    // expected-error@-2 {{incompatible}} (fixed by p0388)
+#endif
     t = p; // expected-error {{incompatible}}
-    s = q; // expected-error {{incompatible}}
-    s = q2; // expected-error {{incompatible}}
+    s = q;
+#if __cplusplus < 202002
+    // expected-error@-2 {{incompatible}} (fixed by p0388)
+#endif
+    s = q2;
+#if __cplusplus < 202002
+    // expected-error@-2 {{incompatible}} (fixed by p0388)
+#endif
     s = t; // ok, adding const
     t = s; // expected-error {{discards qualifiers}}
     (void) const_cast<P>(q);
     (void) const_cast<P>(q2);
     (void) const_cast<Q>(p);
     (void) const_cast<Q2>(p);
     (void) const_cast<S>(p); // expected-error {{not allowed}} (for now)
     (void) const_cast<P>(s); // expected-error {{not allowed}} (for now)

clang/test/CodeGenCXX/cxx20-p0388-unbound-ary.cpp

+// RUN: %clang_cc1 %s -triple %itanium_abi_triple -std=c++20 -emit-llvm -O2 -o - | FileCheck %s
+
+// p0388 conversions to unbounded array
+// dcl.init.list/3
+
+namespace One {
+int ga[1];
+
+// CHECK-LABEL: @_ZN3One5frob1Ev
+// CHECK-NEXT: entry:
+// CHECK-NEXT: ret [0 x i32]* bitcast ([1 x i32]* @_ZN3One2gaE to [0 x i32]*)
+auto &frob1() {
+  int(&r1)[] = ga;
+
+  return r1;
+}
+
+// CHECK-LABEL: @_ZN3One5frob2ERA1_i
+// CHECK-NEXT: entry:
+// CHECK-NEXT: %0 = bitcast [1 x i32]* %arp to [0 x i32]*
+// CHECK-NEXT: ret [0 x i32]* %0
+auto &frob2(int (&arp)[1]) {
+  int(&r2)[] = arp;
+
+  return r2;
+}
+} // namespace One

clang/test/SemaCXX/cxx20-p0388-unbound-ary.cpp

+// RUN: %clang_cc1 -std=c++20 -verify %s
+// RUN: %clang_cc1 -std=c++17 -verify %s
+
+// p0388 conversions to unbounded array
+// dcl.init.list/3
+
+#if __cplusplus >= 202002
+// expected-no-diagnostics
+#endif
+
+namespace One {
+int ga[1];
+
+auto &frob1() {
+  int(&r1)[] = ga;
+#if __cplusplus < 202002
+  // expected-error@-2{{cannot bind to a value of unrelated type}}
+#endif
+
+  return r1;
+}
+
+auto &frob2(int (&arp)[1]) {
+  int(&r2)[] = arp;
+#if __cplusplus < 202002
+  // expected-error@-2{{cannot bind to a value of unrelated type}}
+#endif
+
+  return r2;
+}
+} // namespace One
+
+namespace Two {
+int ga[1];
+
+auto *frob1() {
+  int(*r1)[] = &ga;
+#if __cplusplus < 202002
+  // expected-error@-2{{with an rvalue of type}}
+#endif
+
+  return r1;
+}
+
+auto *frob2(int (*arp)[1]) {
+  int(*r2)[] = arp;
+#if __cplusplus < 202002
+  // expected-error@-2{{with an lvalue of type}}
+#endif
+
+  return r2;
+}
+} // namespace Two
+
+namespace Four {
+using Mat = int[1][2];
+using Inc = int[][2];
+Mat *ga[1];
+
+auto *frob1() {
+  Inc *(*r1)[] = &ga;
+#if __cplusplus < 202002
+  // expected-error@-2{{with an rvalue of type}}
+#endif
+
+  return r1;
+}
+
+auto *frob2(Mat *(*arp)[1]) {
+  Inc *(*r2)[] = arp;
+#if __cplusplus < 202002
+  // expected-error@-2{{with an lvalue of type}}
+#endif
+
+  return r2;
+}
+
+} // namespace Four