[clang] Fix overly aggressive lifetime checks for parenthesized aggregate initialization

[ayzhao]

Summary

Before this patch, initialized class members would have the LifetimeKind
LK_MemInitializer, which does not allow for binding a temporary to a
reference. Binding to a temporary however is allowed in parenthesized
aggregate initialization, even if it leads to a dangling reference. To
fix this, we create a new EntityKind, EK_ParenAggInitMember, which has
LifetimeKind LK_FullExpression.

This patch does *not* attempt to diagnose dangling references as a
result of using this feature.

This patch also refactors TryOrBuildParenListInitialization(...) to
accomodate creating different InitializedEntity objects.

Fixes #61567

[0]: https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2019/p0960r3.html

[ayzhao]

fix missing EOF newline

clang/include/clang/Basic/DiagnosticSemaKinds.td

2130

This was missing an entry for EK_BINDING, so I added one (otherwise, we hit an assertion failure).

clang/test/SemaCXX/paren-list-agg-init.cpp

132

This turned out to be a bug in the original implementation. Currently, diagnostics are only emitted for class members if we fail a parenthesized aggregate init. However, this used to not be the case with value initialized members, which emits the diagnostic for the class itself. Refactoring TryOrBuildParenListInit(...) fixes this and makes things consistent.

[shafik]

clang/include/clang/Sema/Initialization.h

400

509–510

Does this really apply? It looks like this function is only used in canPerformArrayCopy

clang/lib/Sema/SemaAccess.cpp

1657

It looks like don't have a test that triggers this diagnostic, I was looking for field of type.*has.*

clang/lib/Sema/SemaInit.cpp

583

I don't see a test triggering this diagnostic for parens init.

597

I don't see a test triggering this diagnostic for parens init.

[shafik]

clang/lib/Sema/SemaInit.cpp

5332

Do we have tests that trigger this diagnostic and the one right below?

9264

I don't see any tests that checks this set of diagnostics for parens init.

[ayzhao]

Address code review comments and (try) to fix Windows bot failure

clang/include/clang/Sema/Initialization.h

509–510

Reverted.

Also reverted isDefaultMemberInitializer since this is never true for EK_ParenAggInitMember

clang/lib/Sema/SemaInit.cpp

583

Removed since this is part of InitListChecker and InitializedEntity::EK_ParenAggInitMember does not get created when an InitListExpr is created.

597

Removed.

5332

Yes:

• For when Arg is non-null (failing to initializing members with provided argument): https://github.com/llvm/llvm-project/blob/af78197857115716802189ef073f83cdac9ede15/clang/test/SemaCXX/paren-list-agg-init.cpp#L96-L97
• For when Arg is null (failing to value or default-initialize a member): https://github.com/llvm/llvm-project/blob/af78197857115716802189ef073f83cdac9ede15/clang/test/SemaCXX/paren-list-agg-init.cpp#L132-L133 (diagnostics have been fixed in this patch, see my comment in SemaCXX/paren-list-agg-init.cpp).

[ayzhao]

fix comments

[ayzhao]

rebase

[shafik]

clang/lib/Sema/SemaInit.cpp

9723

This and the changes below looks like unrelated formatting changes.

[ayzhao]

remove unrelated formatting changes

[shafik]

I am mostly done but others should also look at this.

clang/lib/Sema/SemaInit.cpp

5348

Why not just use a conditional expression here or alternatively just turn it into an IIILE?

5381

5417

[ayzhao]

code review comments + rebase

[rsmith]

clang/lib/Sema/SemaInit.cpp

5362–5367

What happens if the array is of VariableArrayType or DependentSizedArrayType? I guess we shouldn't get here in the latter case, but the former case seems possible, and presumably shouldn't result in constructing a value of ConstantArrayType. Test:

constexpr int f(int n, int i) {
    int arr[n](1, 2, 3);
    return arr[i];
}

constexpr int a = f(1, 2);
constexpr int b = f(4, 3);

GCC appears to leave the type alone in this case, and treats the evaluation as UB if n is less than the number of initializers given. That matches what GCC does for a {...} initializer of a VLA. We should probably match what Clang does for {...} initialization of a VLA and reject.

5380–5382

It would be nice to use the original type here in the case where we didn't add an array bound, so we preserve type sugar (typedefs etc). Also, do we ever need to preserve type qualifiers from the original entity's type?

5399

Does this have the same wrong-lifetime-kind problem as members did?

5468

Does this entity kind do the right thing for lifetime warnings? (I'm not sure why this is a distinct kind of InitializedEntity; the thing that changes here is not the entity, it's how it's initialized.)

5478–5479

Is there any possibility of lifetime warnings here? I don't *think* value initialization can ever create problems, but it would seem more obviously right to use the parenthesized aggregate initialization entity kind here.

[ayzhao]

code review comments + rebase

clang/lib/Sema/SemaInit.cpp

5362–5367

Clang simply does not allow braced-initialization for VariableArrayType, even if n is greater than or equal to the number of initializers given: https://godbolt.org/z/MaPjvn694. I updated the patch to make parenthesized aggregate initialization do the same thing.

5380–5382

It would be nice to use the original type here in the case where we didn't add an array bound, so we preserve type sugar (typedefs etc).

Done

Also, do we ever need to preserve type qualifiers from the original entity's type?

I don't think so. In the case of IncompleteArrayType, which is the only situation where we would need to deduce the ConstantArrayType based on the number of arguments, the corresponding QualType object is always created with Quals = 0 [0].

[0]: https://github.com/llvm/llvm-project/blob/c95533a7be2858893ec32b8abaa37a2d912ebe63/clang/lib/AST/ASTContext.cpp#L3888

5399

I don't think so:

1. This will never initialize a reference because it's initializing a base class.
2. In the case where the constructor of a base class accepts a reference parameter, the lifetime is not extended: https://godbolt.org/z/MaqhTr1rP

5468

This now uses InitializeMemberFromParenAggInit(..) (before, it would emit the same error it emits for braced init lists). I also added a test for this.

5478–5479

GCC rejects value initialization of references: https://godbolt.org/z/nhhehrf7r

This patch currently rejects value initialization of references, but I updated the diagnostics to match those Clang emits with braced initialization: https://godbolt.org/z/rbh17ecqe

[ayzhao]

add another test and fix whitespace

[ayzhao]

add another test

[rsmith]

LGTM, I'll leave approval to @shafik :)

clang/lib/Sema/SemaInit.cpp

5366

Can we assert that we have an IncompleteArrayType here? (That is, that we don't have a DependentSizedArrayType.)

5498

Is there a reason to not use InitializeMemberFromParenAggInit here? That'd mean we use the same InitializedEntity for every case in this loop, and could pull it out of the individual if branches.

[ayzhao]

code review comments + pull in D149301

[shafik]

I need to look at this more carefully but can we add a release note in the meantime

[ayzhao]

add release note

[shafik]

LGTM

[ayzhao]

rebase + fix merge conflicts

clang/include/clang/Basic/DiagnosticSemaKinds.td

 
 // C++ initialization
 def err_init_conversion_failed : Error<
   "cannot initialize %select{a variable|a parameter|template parameter|"
   "return object|statement expression result|an "
   "exception object|a member subobject|an array element|a new value|a value|a "
   "base class|a constructor delegation|a vector element|a block element|a "
   "block element|a complex element|a lambda capture|a compound literal "
-  "initializer|a related result|a parameter of CF audited function}0 "
+  "initializer|a related result|a parameter of CF audited function|a "
+  "structured binding|a member subobject}0 "
   "%diff{of type $ with an %select{rvalue|lvalue}2 of type $|"
   "with an %select{rvalue|lvalue}2 of incompatible type}1,3"
   "%select{|: different classes%diff{ ($ vs $)|}5,6"
   "|: different number of parameters (%5 vs %6)"
   "|: type mismatch at %ordinal5 parameter%diff{ ($ vs $)|}6,7"
   "|: different return type%diff{ ($ vs $)|}5,6"
   "|: different qualifiers (%5 vs %6)"
   "|: different exception specifications}4">;

clang/include/clang/Sema/Initialization.h

enum EntityKind {
     /// The entity being initialized is a function parameter; function
     /// is member of group of audited CF APIs.
     EK_Parameter_CF_Audited,
 
     /// The entity being initialized is a structured binding of a
     /// decomposition declaration.
     EK_Binding,
 
+    /// The entity being initialized is a non-static data member subobject of an
+    /// object initialized via parenthesized aggregate initialization.
+    EK_ParenAggInitMember,
+
     // Note: err_init_conversion_failed in DiagnosticSemaKinds.td uses this
     // enum as an index for its first %select.  When modifying this list,
     // that diagnostic text needs to be updated as well.
   };
 
 private:
   /// The kind of entity being initialized.
   EntityKind Kind;
InitializedEntity(EntityKind Kind, SourceLocation Loc, QualType Type,
       : Kind(Kind), Type(Type) {
     new (&LocAndNRVO) LN;
     LocAndNRVO.Location = Loc;
     LocAndNRVO.NRVO = NRVO;
   }
 
   /// Create the initialization entity for a member subobject.
   InitializedEntity(FieldDecl *Member, const InitializedEntity *Parent,
-                    bool Implicit, bool DefaultMemberInit)
-      : Kind(EK_Member), Parent(Parent), Type(Member->getType()),
+                    bool Implicit, bool DefaultMemberInit,
+                    bool IsParenAggInit = false)
+      : Kind(IsParenAggInit ? EK_ParenAggInitMember : EK_Member),
+        Parent(Parent), Type(Member->getType()),
         Variable{Member, Implicit, DefaultMemberInit} {}
 
   /// Create the initialization entity for an array element.
   InitializedEntity(ASTContext &Context, unsigned Index,
                     const InitializedEntity &Parent);
 
   /// Create the initialization entity for a lambda capture.
   InitializedEntity(IdentifierInfo *VarID, QualType FieldType, SourceLocation Loc)
public:
   /// Create the initialization entity for a member subobject.
   static InitializedEntity
   InitializeMember(IndirectFieldDecl *Member,
                    const InitializedEntity *Parent = nullptr,
                    bool Implicit = false) {
     return InitializedEntity(Member->getAnonField(), Parent, Implicit, false);
   }
 
+  /// Create the initialization entity for a member subobject initialized via
+  /// parenthesized aggregate init.
+  static InitializedEntity InitializeMemberFromParenAggInit(FieldDecl *Member) {
+    return InitializedEntity(Member, nullptr, false, false, true);
+  }
+
   /// Create the initialization entity for a default member initializer.
   static InitializedEntity
   InitializeMemberFromDefaultMemberInitializer(FieldDecl *Member) {
     return InitializedEntity(Member, nullptr, false, true);
   }
 
   /// Create the initialization entity for an array element.
   static InitializedEntity InitializeElement(ASTContext &Context,
public:
   bool isVariableLengthArrayNew() const {
     return getKind() == EK_New && isa_and_nonnull<IncompleteArrayType>(
                                       getType()->getAsArrayTypeUnsafe());
   }
 
   /// Is this the implicit initialization of a member of a class from
   /// a defaulted constructor?
   bool isImplicitMemberInitializer() const {
-    return getKind() == EK_Member && Variable.IsImplicitFieldInit;
+    return (getKind() == EK_Member || getKind() == EK_ParenAggInitMember) &&
+           Variable.IsImplicitFieldInit;
   }
 
   /// Is this the default member initializer of a member (specified inside
   /// the class definition)?
   bool isDefaultMemberInitializer() const {
-    return getKind() == EK_Member && Variable.IsDefaultMemberInit;
+    return (getKind() == EK_Member || getKind() == EK_ParenAggInitMember) &&
+           Variable.IsDefaultMemberInit;
   }
 
   /// Determine the location of the 'return' keyword when initializing
   /// the result of a function call.
   SourceLocation getReturnLoc() const {
     assert(getKind() == EK_Result && "No 'return' location!");
     return LocAndNRVO.Location;
   }

clang/lib/Sema/SemaAccess.cpp

default:
     break;
 
   case InitializedEntity::EK_Base:
     PD = PDiag(diag::err_access_base_ctor);
     PD << Entity.isInheritedVirtualBase()
        << Entity.getBaseSpecifier()->getType() << getSpecialMember(Constructor);
     break;
 
-  case InitializedEntity::EK_Member: {
+  case InitializedEntity::EK_Member:
+  case InitializedEntity::EK_ParenAggInitMember: {
     const FieldDecl *Field = cast<FieldDecl>(Entity.getDecl());
     PD = PDiag(diag::err_access_field_ctor);
     PD << Field->getType() << getSpecialMember(Constructor);
     break;
   }
 
   case InitializedEntity::EK_LambdaCapture: {
     StringRef VarName = Entity.getCapturedVarName();
     PD = PDiag(diag::err_access_lambda_capture);
     PD << VarName << Entity.getType() << getSpecialMember(Constructor);

clang/lib/Sema/SemaInit.cpp

if (CtorDecl->getMinRequiredArguments() == 0 &&
             InitializationKind::CreateValue(Loc, Loc, Loc, true),
             MultiExprArg(), /*TopLevelOfInitList=*/false,
             TreatUnavailableAsInvalid);
         // Emit a warning for this.  System header warnings aren't shown
         // by default, but people working on system headers should see it.
         if (!VerifyOnly) {
           SemaRef.Diag(CtorDecl->getLocation(),
                        diag::warn_invalid_initializer_from_system_header);
-          if (Entity.getKind() == InitializedEntity::EK_Member)
+          if (InitializedEntity::EntityKind EK = Entity.getKind();
+              EK == InitializedEntity::EK_Member ||
+              EK == InitializedEntity::EK_ParenAggInitMember)
             SemaRef.Diag(Entity.getDecl()->getLocation(),
                          diag::note_used_in_initialization_here);
           else if (Entity.getKind() == InitializedEntity::EK_ArrayElement)
             SemaRef.Diag(Loc, diag::note_used_in_initialization_here);
         }
       }
     }
   }
   if (!InitSeq) {
     if (!VerifyOnly) {
       InitSeq.Diagnose(SemaRef, Entity, Kind, SubInit);
-      if (Entity.getKind() == InitializedEntity::EK_Member)
+      if (InitializedEntity::EntityKind EK = Entity.getKind();
+          EK == InitializedEntity::EK_Member ||
+          EK == InitializedEntity::EK_ParenAggInitMember)
         SemaRef.Diag(Entity.getDecl()->getLocation(),
                      diag::note_in_omitted_aggregate_initializer)
           << /*field*/1 << Entity.getDecl();
       else if (Entity.getKind() == InitializedEntity::EK_ArrayElement) {
         bool IsTrailingArrayNewMember =
             Entity.getParent() &&
             Entity.getParent()->isVariableLengthArrayNew();
         SemaRef.Diag(Loc, diag::note_in_omitted_aggregate_initializer)
static void warnBracedScalarInit(Sema &S, const InitializedEntity &Entity,
 
   case InitializedEntity::EK_Exception:
   case InitializedEntity::EK_Base:
   case InitializedEntity::EK_Delegating:
   case InitializedEntity::EK_BlockElement:
   case InitializedEntity::EK_LambdaToBlockConversionBlockElement:
   case InitializedEntity::EK_Binding:
   case InitializedEntity::EK_StmtExprResult:
+  case InitializedEntity::EK_ParenAggInitMember:
     llvm_unreachable("unexpected braced scalar init");
   }
 
   if (DiagID) {
     S.Diag(Braces.getBegin(), DiagID)
         << Entity.getType()->isSizelessBuiltinType() << Braces
         << FixItHint::CreateRemoval(Braces.getBegin())
         << FixItHint::CreateRemoval(Braces.getEnd());
DeclarationName InitializedEntity::getName() const {
   case EK_Parameter:
   case EK_Parameter_CF_Audited: {
     ParmVarDecl *D = Parameter.getPointer();
     return (D ? D->getDeclName() : DeclarationName());
   }
 
   case EK_Variable:
   case EK_Member:
+  case EK_ParenAggInitMember:
   case EK_Binding:
   case EK_TemplateParameter:
     return Variable.VariableOrMember->getDeclName();
 
   case EK_LambdaCapture:
     return DeclarationName(Capture.VarID);
 
   case EK_Result:
DeclarationName InitializedEntity::getName() const {
 
   llvm_unreachable("Invalid EntityKind!");
 }
 
 ValueDecl *InitializedEntity::getDecl() const {
   switch (getKind()) {
   case EK_Variable:
   case EK_Member:
+  case EK_ParenAggInitMember:
   case EK_Binding:
   case EK_TemplateParameter:
     return Variable.VariableOrMember;
 
   case EK_Parameter:
   case EK_Parameter_CF_Audited:
     return Parameter.getPointer();
 
case EK_Exception:
     return LocAndNRVO.NRVO;
 
   case EK_StmtExprResult:
   case EK_Variable:
   case EK_Parameter:
   case EK_Parameter_CF_Audited:
   case EK_TemplateParameter:
   case EK_Member:
+  case EK_ParenAggInitMember:
   case EK_Binding:
   case EK_New:
   case EK_Temporary:
   case EK_CompoundLiteralInit:
   case EK_Base:
   case EK_Delegating:
   case EK_ArrayElement:
   case EK_VectorElement:
unsigned InitializedEntity::dumpImpl(raw_ostream &OS) const {
   case EK_Variable: OS << "Variable"; break;
   case EK_Parameter: OS << "Parameter"; break;
   case EK_Parameter_CF_Audited: OS << "CF audited function Parameter";
     break;
   case EK_TemplateParameter: OS << "TemplateParameter"; break;
   case EK_Result: OS << "Result"; break;
   case EK_StmtExprResult: OS << "StmtExprResult"; break;
   case EK_Exception: OS << "Exception"; break;
-  case EK_Member: OS << "Member"; break;
+  case EK_Member:
+  case EK_ParenAggInitMember:
+    OS << "Member";
+    break;
   case EK_Binding: OS << "Binding"; break;
   case EK_New: OS << "New"; break;
   case EK_Temporary: OS << "Temporary"; break;
   case EK_CompoundLiteralInit: OS << "CompoundLiteral";break;
   case EK_RelatedResult: OS << "RelatedResult"; break;
   case EK_Base: OS << "Base"; break;
   case EK_Delegating: OS << "Delegating"; break;
   case EK_ArrayElement: OS << "ArrayElement " << Index; break;
if (DestType.getQualifiers().hasObjCLifetime()) {
     return;
   }
 }
 
 static void TryOrBuildParenListInitialization(
     Sema &S, const InitializedEntity &Entity, const InitializationKind &Kind,
     ArrayRef<Expr *> Args, InitializationSequence &Sequence, bool VerifyOnly,
     ExprResult *Result = nullptr) {
-  unsigned ArgIndexToProcess = 0;
+  unsigned EntityIndexToProcess = 0;
   SmallVector<Expr *, 4> InitExprs;
   QualType ResultType;
   Expr *ArrayFiller = nullptr;
   FieldDecl *InitializedFieldInUnion = nullptr;
 
-  // Process entities (i.e. array members, base classes, or class fields) by
-  // adding an initialization expression to InitExprs for each entity to
-  // initialize.
-  auto ProcessEntities = [&](auto Range) -> bool {
-    bool IsUnionType = Entity.getType()->isUnionType();
-    for (InitializedEntity SubEntity : Range) {
-      // Unions should only have one initializer expression.
-      // If there are more initializers than it will be caught when we check
-      // whether Index equals Args.size().
-      if (ArgIndexToProcess == 1 && IsUnionType)
-        return true;
+  auto HandleInitializedEntity = [&](const InitializedEntity &SubEntity,
+                                     const InitializationKind &SubKind,
+                                     Expr *Arg, Expr **InitExpr = nullptr) {
+    InitializationSequence IS =
+        Arg ? InitializationSequence(S, SubEntity, SubKind, Arg)
+            : InitializationSequence(S, SubEntity, SubKind, std::nullopt);
+    if (IS.Failed()) {
+      if (!VerifyOnly) {
+        if (Arg)
+          IS.Diagnose(S, SubEntity, SubKind, Arg);
+        else
+          IS.Diagnose(S, SubEntity, SubKind, std::nullopt);
+      } else {
+        Sequence.SetFailed(
+            InitializationSequence::FK_ParenthesizedListInitFailed);
+      }
+
+      return false;
+    }
+    if (!VerifyOnly) {
+      ExprResult ER = Arg ? IS.Perform(S, SubEntity, SubKind, Arg)
+                          : IS.Perform(S, SubEntity, SubKind, std::nullopt);
+      if (InitExpr)
+        *InitExpr = ER.get();
+      else
+        InitExprs.push_back(ER.get());
+    }
+  };
+
+  if (const ArrayType *AT =
+          S.getASTContext().getAsArrayType(Entity.getType())) {
+    SmallVector<InitializedEntity, 4> ElementEntities;
+    uint64_t ArrayLength;
+    // C++ [dcl.init]p17.5
+    //   if the destination type is an array, the object is initialized as
+    //   follows. Let x1, . . . , xk be the elements of the expression-list. If
+    //   the destination type is an array of unknown bound, it is defined as
+    //   having k elements.
+    if (const ConstantArrayType *CAT =
+            S.getASTContext().getAsConstantArrayType(Entity.getType()))
+      ArrayLength = CAT->getSize().getZExtValue();
+    else
+      ArrayLength = Args.size();
+    EntityIndexToProcess = ArrayLength;
+
+    //   ...the ith array element is copy-initialized with xi for each
+    //   1 <= i <= k
+    for (Expr *E : Args) {
+      InitializedEntity SubEntity = InitializedEntity::InitializeElement(
+          S.getASTContext(), EntityIndexToProcess, Entity);
+      InitializationKind SubKind = InitializationKind::CreateForInit(
+          E->getExprLoc(), /*isDirectInit=*/false, E);
+      if (!HandleInitializedEntity(SubEntity, SubKind, E))
+        return;
+    }
+    //   ...and value-initialized for each k < i <= n;
+    if (ArrayLength > Args.size()) {
+      InitializedEntity SubEntity = InitializedEntity::InitializeElement(
+          S.getASTContext(), Args.size(), Entity);
+      InitializationKind SubKind = InitializationKind::CreateValue(
+          Kind.getLocation(), Kind.getLocation(), Kind.getLocation(), true);
+      if (!HandleInitializedEntity(SubEntity, SubKind, nullptr, &ArrayFiller))
+        return;
+    }
+
+    ResultType = S.Context.getConstantArrayType(
+        AT->getElementType(), llvm::APInt(/*numBits=*/32, ArrayLength), nullptr,
+        ArrayType::Normal, 0);
+  } else if (auto *RT = Entity.getType()->getAs<RecordType>()) {
+    bool IsUnion = RT->isUnionType();
+    const CXXRecordDecl *RD = cast<CXXRecordDecl>(RT->getDecl());
 
-      bool IsMember = SubEntity.getKind() == InitializedEntity::EK_Member;
+    if (!IsUnion) {
+      for (const CXXBaseSpecifier &Base : RD->bases()) {
+        InitializedEntity SubEntity =
+            InitializedEntity::InitializeBase(S.getASTContext(), &Base, false);
+        if (EntityIndexToProcess < Args.size()) {
+          // There are still expressions in Args that haven't been proceessed
+          // Let's match them to the current base to initialize.
+          Expr *E = Args[EntityIndexToProcess];
+          InitializationKind SubKind = InitializationKind::CreateForInit(
+              E->getExprLoc(), /*isDirectInit=*/false, E);
+          if (!HandleInitializedEntity(SubEntity, SubKind, E))
+            return;
+        } else {
+          //
+          InitializationKind SubKind = InitializationKind::CreateValue(
+              Kind.getLocation(), Kind.getLocation(), Kind.getLocation(), true);
+          if (!HandleInitializedEntity(SubEntity, SubKind, nullptr))
+            return;
+        }
+        EntityIndexToProcess++;
+      }
+    }
 
+    for (FieldDecl *FD : RD->fields()) {
       // Unnamed bitfields should not be initialized at all, either with an arg
       // or by default.
-      if (IsMember && cast<FieldDecl>(SubEntity.getDecl())->isUnnamedBitfield())
+      if (FD->isUnnamedBitfield())
         continue;
 
-      if (ArgIndexToProcess < Args.size()) {
-        // There are still expressions in Args that haven't been processed.
-        // Let's match them to the current entity to initialize.
-        Expr *E = Args[ArgIndexToProcess++];
+      if (EntityIndexToProcess < Args.size()) {
+        // There are still expressions in Args that haven't been proceessed
+        // Let's match them to the current field to initialize.
+        Expr *E = Args[EntityIndexToProcess];
 
         // Incomplete array types indicate flexible array members. Do not allow
         // paren list initializations of structs with these members, as GCC
         // doesn't either.
-        if (IsMember) {
-          auto *FD = cast<FieldDecl>(SubEntity.getDecl());
-          if (FD->getType()->isIncompleteArrayType()) {
-            if (!VerifyOnly) {
-              S.Diag(E->getBeginLoc(), diag::err_flexible_array_init)
-                  << SourceRange(E->getBeginLoc(), E->getEndLoc());
-              S.Diag(FD->getLocation(), diag::note_flexible_array_member) << FD;
-            }
-            Sequence.SetFailed(
-                InitializationSequence::FK_ParenthesizedListInitFailed);
-            return false;
-          }
+          return;
         }
 
         InitializationKind SubKind = InitializationKind::CreateForInit(
             E->getExprLoc(), /*isDirectInit=*/false, E);
-        InitializationSequence SubSeq(S, SubEntity, SubKind, E);
-
-        if (SubSeq.Failed()) {
-          if (!VerifyOnly)
-            SubSeq.Diagnose(S, SubEntity, SubKind, E);
-          else
-            Sequence.SetFailed(
-                InitializationSequence::FK_ParenthesizedListInitFailed);
+        InitializedEntity SubEntity =
+            InitializedEntity::InitializeMemberFromParenAggInit(FD);
+        if (!HandleInitializedEntity(SubEntity, SubKind, E))
+          return;
 
-          return false;
-        }
-        if (!VerifyOnly) {
-          ExprResult ER = SubSeq.Perform(S, SubEntity, SubKind, E);
-          InitExprs.push_back(ER.get());
-          if (IsMember && IsUnionType)
-            InitializedFieldInUnion = cast<FieldDecl>(SubEntity.getDecl());
+        // Unions should have only one initializer expression, so we bail out
+        // after processing the first field. If there are more initializers then
+        // it will be caught when we later check whether EntityIndexToProcess is
+        // less than Args.size();
+        if (IsUnion) {
+          InitializedFieldInUnion = FD;
+          EntityIndexToProcess = 1;
+          break;
         }
       } else {
         // We've processed all of the args, but there are still entities that
         // have to be initialized.
-        if (IsMember) {
+        if (Expr *ICE = FD->getInClassInitializer(); ICE && !VerifyOnly) {
           // C++ [dcl.init]p17.6.2.2
           //   The remaining elements are initialized with their default member
           //   initializers, if any
-          auto *FD = cast<FieldDecl>(SubEntity.getDecl());
-          if (Expr *ICE = FD->getInClassInitializer(); ICE && !VerifyOnly) {
-            ExprResult DIE = S.BuildCXXDefaultInitExpr(FD->getLocation(), FD);
-            if (DIE.isInvalid())
-              return false;
-            S.checkInitializerLifetime(SubEntity, DIE.get());
-            InitExprs.push_back(DIE.get());
-            continue;
-          };
-        }
-        // Remaining class elements without default member initializers and
-        // array elements are value initialized:
-        //
+          InitializedEntity SubEntity =
+              InitializedEntity::InitializeMemberFromDefaultMemberInitializer(
+                  FD);
+            return;
+        } else {
           // C++ [dcl.init]p17.6.2.2
           //   The remaining elements...otherwise are value initialzed
-        //
-        // C++ [dcl.init]p17.5
-        //   if the destination type is an array, the object is initialized as
-        // . follows. Let x1, . . . , xk be the elements of the expression-list
-        //   ...Let n denote the array size...the ith array element is...value-
-        //   initialized for each k < i <= n.
+          InitializedEntity SubEntity =
+              InitializedEntity::InitializeMember(FD, &Entity);
           InitializationKind SubKind = InitializationKind::CreateValue(
               Kind.getLocation(), Kind.getLocation(), Kind.getLocation(), true);
-        InitializationSequence SubSeq(S, SubEntity, SubKind, std::nullopt);
-        if (SubSeq.Failed()) {
-          if (!VerifyOnly)
-            SubSeq.Diagnose(S, SubEntity, SubKind, std::nullopt);
-          return false;
-        }
-        if (!VerifyOnly) {
-          ExprResult ER = SubSeq.Perform(S, SubEntity, SubKind, std::nullopt);
-          if (SubEntity.getKind() == InitializedEntity::EK_ArrayElement) {
-            ArrayFiller = ER.get();
-            return true;
-          }
-          InitExprs.push_back(ER.get());
-        }
+          if (!HandleInitializedEntity(SubEntity, SubKind, nullptr))
+            return;
         }
       }
-    return true;
-  };
-
-  if (const ArrayType *AT =
-          S.getASTContext().getAsArrayType(Entity.getType())) {
-
-    SmallVector<InitializedEntity, 4> ElementEntities;
-    uint64_t ArrayLength;
-    // C++ [dcl.init]p17.5
-    //   if the destination type is an array, the object is initialized as
-    //   follows. Let x1, . . . , xk be the elements of the expression-list. If
-    //   the destination type is an array of unknown bound, it is define as
-    //   having k elements.
-    if (const ConstantArrayType *CAT =
-            S.getASTContext().getAsConstantArrayType(Entity.getType()))
-      ArrayLength = CAT->getSize().getZExtValue();
-    else
-      ArrayLength = Args.size();
-
-    if (ArrayLength >= Args.size()) {
-      for (uint64_t I = 0; I < ArrayLength; ++I)
-        ElementEntities.push_back(
-            InitializedEntity::InitializeElement(S.getASTContext(), I, Entity));
-
-      if (!ProcessEntities(ElementEntities))
-        return;
-
-      ResultType = S.Context.getConstantArrayType(
-          AT->getElementType(), llvm::APInt(/*numBits=*/32, ArrayLength),
-          nullptr, ArrayType::Normal, 0);
+      EntityIndexToProcess++;
     }
-  } else if (auto *RT = Entity.getType()->getAs<RecordType>()) {
-    const CXXRecordDecl *RD = cast<CXXRecordDecl>(RT->getDecl());
-
-    auto BaseRange = map_range(RD->bases(), [&S](auto &base) {
-      return InitializedEntity::InitializeBase(S.getASTContext(), &base, false);
-    });
-    auto FieldRange = map_range(RD->fields(), [](auto *field) {
-      return InitializedEntity::InitializeMember(field);
-    });
-
-    if (!ProcessEntities(BaseRange))
-      return;
-
-    if (!ProcessEntities(FieldRange))
-      return;
-
     ResultType = Entity.getType();
   }
 
   // Not all of the args have been processed, so there must've been more args
   // than were required to initialize the element.
-  if (ArgIndexToProcess < Args.size()) {
+  if (EntityIndexToProcess < Args.size()) {
     Sequence.SetFailed(InitializationSequence::FK_ParenthesizedListInitFailed);
     if (!VerifyOnly) {
       QualType T = Entity.getType();
       int InitKind = T->isArrayType() ? 0 : T->isUnionType() ? 3 : 4;
-      SourceRange ExcessInitSR(Args[ArgIndexToProcess]->getBeginLoc(),
+      SourceRange ExcessInitSR(Args[EntityIndexToProcess]->getBeginLoc(),
                                Args.back()->getEndLoc());
       S.Diag(Kind.getLocation(), diag::err_excess_initializers)
           << InitKind << ExcessInitSR;
     }
     return;
   }
 
   if (VerifyOnly) {
case InitializedEntity::EK_RelatedResult:
     return Sema::AA_Casting;
 
   case InitializedEntity::EK_TemplateParameter:
     // This is really initialization, but refer to it as conversion for
     // consistency with CheckConvertedConstantExpression.
     return Sema::AA_Converting;
 
   case InitializedEntity::EK_Member:
+  case InitializedEntity::EK_ParenAggInitMember:
   case InitializedEntity::EK_Binding:
   case InitializedEntity::EK_ArrayElement:
   case InitializedEntity::EK_VectorElement:
   case InitializedEntity::EK_ComplexElement:
   case InitializedEntity::EK_BlockElement:
   case InitializedEntity::EK_LambdaToBlockConversionBlockElement:
   case InitializedEntity::EK_LambdaCapture:
   case InitializedEntity::EK_CompoundLiteralInit:
     return Sema::AA_Initializing;
   }
 
   llvm_unreachable("Invalid EntityKind!");
 }
 
 /// Whether we should bind a created object as a temporary when
 /// initializing the given entity.
 static bool shouldBindAsTemporary(const InitializedEntity &Entity) {
   switch (Entity.getKind()) {
   case InitializedEntity::EK_ArrayElement:
   case InitializedEntity::EK_Member:
+  case InitializedEntity::EK_ParenAggInitMember:
   case InitializedEntity::EK_Result:
   case InitializedEntity::EK_StmtExprResult:
   case InitializedEntity::EK_New:
   case InitializedEntity::EK_Variable:
   case InitializedEntity::EK_Base:
   case InitializedEntity::EK_Delegating:
   case InitializedEntity::EK_VectorElement:
   case InitializedEntity::EK_ComplexElement:
switch (Entity.getKind()) {
     case InitializedEntity::EK_VectorElement:
     case InitializedEntity::EK_ComplexElement:
     case InitializedEntity::EK_BlockElement:
     case InitializedEntity::EK_LambdaToBlockConversionBlockElement:
     case InitializedEntity::EK_LambdaCapture:
       return false;
 
     case InitializedEntity::EK_Member:
+    case InitializedEntity::EK_ParenAggInitMember:
     case InitializedEntity::EK_Binding:
     case InitializedEntity::EK_Variable:
     case InitializedEntity::EK_Parameter:
     case InitializedEntity::EK_Parameter_CF_Audited:
     case InitializedEntity::EK_TemplateParameter:
     case InitializedEntity::EK_Temporary:
     case InitializedEntity::EK_ArrayElement:
     case InitializedEntity::EK_Exception:
static SourceLocation getInitializationLoc(const InitializedEntity &Entity,
   case InitializedEntity::EK_Binding:
     return Entity.getDecl()->getLocation();
 
   case InitializedEntity::EK_LambdaCapture:
     return Entity.getCaptureLoc();
 
   case InitializedEntity::EK_ArrayElement:
   case InitializedEntity::EK_Member:
+  case InitializedEntity::EK_ParenAggInitMember:
   case InitializedEntity::EK_Parameter:
   case InitializedEntity::EK_Parameter_CF_Audited:
   case InitializedEntity::EK_TemplateParameter:
   case InitializedEntity::EK_Temporary:
   case InitializedEntity::EK_New:
   case InitializedEntity::EK_Base:
   case InitializedEntity::EK_Delegating:
   case InitializedEntity::EK_VectorElement:
static LifetimeResult getEntityLifetime(
   case InitializedEntity::EK_LambdaCapture:
   case InitializedEntity::EK_VectorElement:
   case InitializedEntity::EK_ComplexElement:
     return {nullptr, LK_FullExpression};
 
   case InitializedEntity::EK_Exception:
     // FIXME: Can we diagnose lifetime problems with exceptions?
     return {nullptr, LK_FullExpression};
+
+  case InitializedEntity::EK_ParenAggInitMember:
+    //   -- A temporary object bound to a reference element of an aggregate of
+    //      class type initialized from a parenthesized expression-list
+    //      [dcl.init, 9.3] persists until the completion of the full-expression
+    //      containing the expression-list.
+    return {nullptr, LK_FullExpression};
   }
+
   llvm_unreachable("unknown entity kind");
 }
 
 namespace {
 enum ReferenceKind {
   /// Lifetime would be extended by a reference binding to a temporary.
   RK_ReferenceBinding,
   /// Lifetime would be extended by a std::initializer_list object binding to
ExprResult InitializationSequence::Perform(Sema &S,
   }
 
   // Check whether the initializer has a shorter lifetime than the initialized
   // entity, and if not, either lifetime-extend or warn as appropriate.
   if (auto *Init = CurInit.get())
     S.checkInitializerLifetime(Entity, Init);
 
   // Diagnose non-fatal problems with the completed initialization.
-  if (Entity.getKind() == InitializedEntity::EK_Member &&
+  if (InitializedEntity::EntityKind EK = Entity.getKind();
+      (EK == InitializedEntity::EK_Member ||
+       EK == InitializedEntity::EK_ParenAggInitMember) &&
       cast<FieldDecl>(Entity.getDecl())->isBitField())
     S.CheckBitFieldInitialization(Kind.getLocation(),
                                   cast<FieldDecl>(Entity.getDecl()),
                                   CurInit.get());
 
   // Check for std::move on construction.
   if (const Expr *E = CurInit.get()) {
     CheckMoveOnConstruction(S, E,
                             Entity.getKind() == InitializedEntity::EK_Result);
   }
switch (FailedOverloadResult) {
                                 S.PDiag(diag::err_ovl_ambiguous_init)
                                     << DestType << ArgsRange),
             S, OCD_AmbiguousCandidates, Args);
         break;
 
       case OR_No_Viable_Function:
         if (Kind.getKind() == InitializationKind::IK_Default &&
             (Entity.getKind() == InitializedEntity::EK_Base ||
-             Entity.getKind() == InitializedEntity::EK_Member) &&
+             Entity.getKind() == InitializedEntity::EK_Member ||
+             Entity.getKind() == InitializedEntity::EK_ParenAggInitMember) &&
             isa<CXXConstructorDecl>(S.CurContext)) {
-          // This is implicit default initialization of a member or
-          // base within a constructor. If no viable function was
-          // found, notify the user that they need to explicitly
-          // initialize this base/member.
-          CXXConstructorDecl *Constructor
-            = cast<CXXConstructorDecl>(S.CurContext);
-          const CXXRecordDecl *InheritedFrom = nullptr;
-          if (auto Inherited = Constructor->getInheritedConstructor())
-            InheritedFrom = Inherited.getShadowDecl()->getNominatedBaseClass();
-          if (Entity.getKind() == InitializedEntity::EK_Base) {
-            S.Diag(Kind.getLocation(), diag::err_missing_default_ctor)
-              << (InheritedFrom ? 2 : Constructor->isImplicit() ? 1 : 0)
+        CXXConstructorDecl *Constructor =
+            cast<CXXConstructorDecl>(S.CurContext);
+              << (InheritedFrom               ? 2
+                  : Constructor->isImplicit() ? 1
+                                              : 0)
               << S.Context.getTypeDeclType(Constructor->getParent())
-              << /*base=*/0
-              << Entity.getType()
-              << InheritedFrom;
+              << /*base=*/0 << Entity.getType() << InheritedFrom;
 
-            RecordDecl *BaseDecl
-              = Entity.getBaseSpecifier()->getType()->castAs<RecordType>()
-                                                                  ->getDecl();
-            S.Diag(BaseDecl->getLocation(), diag::note_previous_decl)
+          RecordDecl *BaseDecl = Entity.getBaseSpecifier()
+                                     ->getType()
+                                     ->castAs<RecordType>()
               << S.Context.getTagDeclType(BaseDecl);
-          } else {
-            S.Diag(Kind.getLocation(), diag::err_missing_default_ctor)
-              << (InheritedFrom ? 2 : Constructor->isImplicit() ? 1 : 0)
+              << (InheritedFrom               ? 2
+                  : Constructor->isImplicit() ? 1
+                                              : 0)
               << S.Context.getTypeDeclType(Constructor->getParent())
-              << /*member=*/1
-              << Entity.getName()
-              << InheritedFrom;
-            S.Diag(Entity.getDecl()->getLocation(),
-                   diag::note_member_declared_at);
+              << /*member=*/1 << Entity.getName() << InheritedFrom;
 
-            if (const RecordType *Record
-                                 = Entity.getType()->getAs<RecordType>())
-              S.Diag(Record->getDecl()->getLocation(),
-                     diag::note_previous_decl)
+          if (const RecordType *Record = Entity.getType()->getAs<RecordType>())
+            S.Diag(Record->getDecl()->getLocation(), diag::note_previous_decl)
                 << S.Context.getTagDeclType(Record->getDecl());
-          }
-          break;
         }
 
         FailedCandidateSet.NoteCandidates(
             PartialDiagnosticAt(
                 Kind.getLocation(),
                 S.PDiag(diag::err_ovl_no_viable_function_in_init)
                     << DestType << ArgsRange),
             S, OCD_AllCandidates, Args);

clang/test/CodeGen/paren-list-agg-init.cpp

namespace gh61145 {
 
   // CHECK-DAG: [[STRUCT_S2:%.*]] = type { [[STRUCT_VEC]], i8 }
   struct S2 {
     Vec v;
     char c;
   };
 }
 
+namespace gh61567 {
+  // CHECK-DAG: [[STRUCT_H:%.*H.*]] = type { i32, ptr }
+  struct H {
+    int a;
+    int&& r;
+  };
+}
+
 // CHECK-DAG: [[A1:@.*a1.*]] = internal constant [[STRUCT_A]] { i8 3, double 2.000000e+00 }, align 8
 constexpr A a1(3.1, 2.0);
 // CHECK-DAG: [[A2:@.*a2.*]] = internal constant [[STRUCT_A]] { i8 99, double 0.000000e+00 }, align 8
 constexpr auto a2 = static_cast<A>('c');
 // CHECK-DAG: [[B1:@.*b1.*]] = internal constant [[STRUCT_B]] { [[STRUCT_A]] { i8 99, double 0.000000e+00 }, i32 0 }, align 8
 constexpr B b1(A('c'));
 // CHECK-DAG: [[C1:@.*c1.*]] = internal constant { [[STRUCT_A]], i32, [4 x i8], i8, double, i32 } { [[STRUCT_A]] { i8 99, double 0.000000e+00 }, i32 0, [4 x i8] undef, i8 3, double 2.000000e+00, i32 0 }, align
 constexpr C c1(b1, a1);
void make2() {
     S2((Vec&&) v, 0);
   }
 
   void foo() {
     make1<0>();
     make2<0>();
   }
 }
+
+namespace gh61567 {
+  int foo20();
+
+  // CHECK: define {{.*}} void @{{.*foo21.*}} {
+  // CHECK-NEXT: entry
+  // CHECK-NEXT: [[AGG_TMP_ENSURED:%.*]] = alloca [[STRUCT_H]], align 8
+  // CHECK-NEXT: [[REF_TMP:%.*]] = alloca i32, align 4
+  // CHECK-NEXT: [[A:%.*a.*]] = getelementptr inbounds [[STRUCT_H]], ptr [[AGG_TMP_ENSURED]], i32 0, i32 0
+  // CHECK-NEXT: store i32 0, ptr [[A]], align 8
+  // CHECK-NEXT: [[R:%.*r.*]] = getelementptr inbounds [[STRUCT_H]], ptr [[AGG_TMP_ENSURED]], i32 0, i32 1
+  // CHECK-NEXT: store i32 1, ptr [[REF_TMP]], align 4
+  // CHECK-NEXT: store ptr [[REF_TMP]], ptr [[R]], align 8
+  // CHECK-NEXT: ret void
+  void foo21() {
+    H(0, 1);
+  }
+
+  // CHECK: define {{.*}} void @{{.*foo22.*}} {
+  // CHECK-NEXT: entry
+  // CHECK-NEXT: [[AGG_TMP_ENSURED:%.*]] = alloca [[STRUCT_H]], align 8
+  // CHECK-NEXT: [[REF_TMP:%.*]] = alloca i32, align 4
+  // CHECK-NEXT: [[A:%.*a.*]] = getelementptr inbounds [[STRUCT_H]], ptr [[AGG_TMP_ENSURED]], i32 0, i32 0
+  // CHECK-NEXT: store i32 0, ptr [[A]], align 8
+  // CHECK-NEXT: [[R:%.*r.*]] = getelementptr inbounds [[STRUCT_H]], ptr [[AGG_TMP_ENSURED]], i32 0, i32 1
+  // CHECK-NEXT: [[CALL:%.*call*]] = call noundef i32 @{{.*foo20.*}}
+  // CHECK-NEXT: store i32 [[CALL]], ptr [[REF_TMP]], align 4
+  // CHECK-NEXT: store ptr [[REF_TMP]], ptr [[R]], align 8
+  // CHECK-NEXT: ret void
+  void foo22() {
+    H(0, foo20());
+  }
+
+  // CHECK: define {{.*}} void @{{.*foo23.*}}(i32 noundef [[I:%.*i.*]])
+  // CHECK-NEXT: entry
+  // CHECK-NEXT: [[I_ADDR:%.*i.*]] = alloca i32, align 4
+  // CHECK-NEXT: [[AGG_TMP_ENSURED:%.*]] = alloca [[STRUCT_H]], align 8
+  // CHECK-NEXT: store i32 [[I]], ptr [[I_ADDR]], align 4
+  // CHECK-NEXT: [[A:%.*a.*]] = getelementptr inbounds [[STRUCT_H]], ptr [[AGG_TMP_ENSURED]], i32 0, i32 0
+  // CHECK-NEXT: store i32 0, ptr [[A]], align 8
+  // CHECK-NEXT: [[R:%.*r.*]] = getelementptr inbounds [[STRUCT_H]], ptr [[AGG_TMP_ENSURED]], i32 0, i32 1
+  // CHECK-NEXT: store ptr [[I_ADDR]], ptr [[R]], align 8
+  // CHECK-NEXT: ret void
+  void foo23(int i) {
+    H(0, static_cast<int&&>(i));
+  }
+}
 No newline at end of file

clang/test/SemaCXX/paren-list-agg-init.cpp

 // RUN: %clang_cc1 -verify -std=c++20 %s -fsyntax-only
 // RUN: %clang_cc1 -verify=expected,beforecxx20 -Wc++20-extensions -std=c++20 %s -fsyntax-only
 
 struct A { // expected-note 4{{candidate constructor}}
   char i;
   double j;
 };
 
 struct B {
   A a;
   int b[20];
-  int &&c; // expected-note {{reference member declared here}}
+  int &&c;
 };
 
 struct C { // expected-note 5{{candidate constructor}}
   A a;
   int b[20];
 };
 
 struct D : public C, public A {
   int a;
 };
 
-struct E { // expected-note 3{{candidate constructor}}
-  struct F {
-    F(int, int);
+struct E {
+  struct F { // expected-note 2{{candidate constructor}}
+    F(int, int); // expected-note {{candidate constructor}}
   };
   int a;
   F f;
 };
 
 int getint(); // expected-note {{declared here}}
 
 struct F {
void foo() {
   // beforecxx20-warning@-2 {{aggregate initialization of type 'A' from a parenthesized list of values is a C++20 extension}}
   A a6 = A(8.7);
   // expected-warning@-1 {{implicit conversion from 'double' to 'char'}}
   // beforecxx20-warning@-2 {{aggregate initialization of type 'A' from a parenthesized list of values is a C++20 extension}}
 
   B b1(2022, {7, 8});
   // expected-error@-1 {{no viable conversion from 'int' to 'A'}}
   B b2(A(1), {}, 1);
-  // expected-error@-1 {{reference member 'c' binds to a temporary object whose lifetime would be shorter than the lifetime of the constructed object}}
-  // beforecxx20-warning@-2 {{aggregate initialization of type 'A' from a parenthesized list of values is a C++20 extension}}
-  // beforecxx20-warning@-3 {{aggregate initialization of type 'B' from a parenthesized list of values is a C++20 extension}}
+  // beforecxx20-warning@-1 {{aggregate initialization of type 'A' from a parenthesized list of values is a C++20 extension}}
+  // beforecxx20-warning@-2 {{aggregate initialization of type 'B' from a parenthesized list of values is a C++20 extension}}
 
   C c(A(1), 1, 2, 3, 4);
   // expected-error@-1 {{array initializer must be an initializer list}}
   // beforecxx20-warning@-2 {{aggregate initialization of type 'A' from a parenthesized list of values is a C++20 extension}}
   D d1(1);
   // expected-error@-1 {{no viable conversion from 'int' to 'C'}}
   D d2(C(1));
   // expected-error@-1 {{no matching conversion for functional-style cast from 'int' to 'C'}}
void foo() {
   // expected-error@-1 {{array initializer must be an initializer list}}
 
   U u1("abcd");
   // expected-error@-1 {{cannot initialize a member subobject of type 'int' with an lvalue of type 'const char[5]'}}
   U u2(1, "efgh");
   // expected-error@-1 {{excess elements in union initializer}}
 
   E e1(1);
-  // expected-error@-1 {{no matching constructor for initialization of 'E'}}
+  // expected-error@-1 {{no matching constructor for initialization of 'F'}}
 
   constexpr F f1(1);
   // expected-error@-1 {{constexpr variable 'f1' must be initialized by a constant expression}}
   // beforecxx20-warning@-2 {{aggregate initialization of type 'const F' from a parenthesized list of values is a C++20 extension}}
 
   constexpr F f2(1, 1); // OK: f2.b is initialized by a constant expression.
   // beforecxx20-warning@-1 {{aggregate initialization of type 'const F' from a parenthesized list of values is a C++20 extension}}