Arrays of unknown bound in constant expressions

[Arcoth]

Summary

Arrays of unknown bound are subject to some bugs in constant expressions.

const extern int arr[];
constexpr int f(int i) {return arr[i];}
constexpr int arr[] {1, 2, 3};
int main() {constexpr int x = f(2);}

This is spuriously rejected. On the other hand,

extern const int arr[];
constexpr int const* p = arr + 2;

compiles. The standard will presumably incorporate a rule that forbids array-to-pointer conversions on arrays of unknown bound (unless they are completed at the point of evaluation, as in the first
example). The proposed changes reflect this idea.

[rsmith]

This needs testcases (the one from your summary plus the ones in my comments above would be good).

lib/AST/ExprConstant.cpp

2636

I think this should be named ArrayBound or similar.

2639–2640

Use line comments, start with capital letter, end with period, please.

2641

This will not be the correct bound in general. This field is the array size of the *innermost* non-base-class subobject described by the designator, not the outermost one.

You could compute the correct bound here by going back to the ValueDecl* in the CompleteObject and checking its most recent declaration, but I think it would be preferable to do that when computing the type in findCompleteObject instead.

(It might seem possible to map to the most recent VarDecl when evaluating the DeclRefExpr instead, but that actually won't work in general, for cases like:

extern int arr[];
constexpr int *p = arr; // computes APValue referring to first declaration of 'arr'
int arr[3];
constexpr int *q = p + 1; // should be accepted

... but findCompleteObject will happen late enough.)

5661–5662

Per LLVM coding style, else goes on the same line as }.

5672–5678

We should produce a CCEDiag along this path too. (This happens for VLAs.)

5675

Comments should start with a capital letter.

5679–5682

Please suppress this diagnostic when Info.checkingPotentialConstantExpression(), since the expression is still potentially a constant expression. Example:

extern int arr[];
constexpr int *f() { return arr + 3; }
int arr[5];
constexpr int *p = f();

Here, when we check that the body of f() is valid, we need to ignore the fact that we don't know the array bound, since it could become known later.

[Arcoth]

Adjusted.

Implemented the changes suggested by Richard. The array-to-pointer decay
is now well-formed; the check was instead moved to the pointer
arithmetic facility.

[Arcoth]

Small fix.

[rsmith]

The change in direction from diagnosing the lvalue-to-rvalue conversion to diagnosing the pointer arithmetic seems fine to me (and is likely a better approach overall), but this means we should now treat a designator referring to element 0 of an array of unknown / runtime bound as being valid. We have minimal support for this already for __builtin_object_size evaluation, which you should be able to generalize to support arbitrary designators ending with such a value.

lib/AST/ExprConstant.cpp

2970

This path fails without producing a diagnostic (a default-constructed CompleteObject() is an error return). I think we should instead treat this as a valid CompleteObject with a type that simply can't be further decomposed.

5570–5578

I think this should be handled in SubobjectDesignator::adjustIndex instead; there are other ways to get to the pointer arithmetic logic (such as array indexing and the implicit indexing we do in some builtins).

5680–5681

We should never set a designator invalid without issuing a diagnostic. If you want to defer the diagnostic until pointer arithmetic happens, you need to be able to represent that situation in a valid designator. Perhaps generalizing the existing support for isMostDerivedAnUnsizedArray would be a path forward.

[Arcoth]

Updated SubobjectDesignator to hold MostDerivedIsAnUnsizedArray instead of FirstEntryIsAnUnsizedArray. Consequently, we cannot know whether the first element is an unsized array; please see line 7352 in particular, where the check for isMostDerivedAnUnsizedArrayhad to be removed (is this fine? All regression tests pass), due to a testcase in CogeGen/alloc-size.c:

void *my_malloc(size_t) __attribute__((alloc_size(1)));

struct Data {
  int t[10];
};

void test5() {
  Data *const data = (Data*)my_malloc(sizeof(*data));
  __builtin_object_size(&data->t[1], 1);
}

The first entry in the Designator for &data->t[1] is an unsized array, since data points to what has been allocated via an allocation function, but the most derived object is not a member of an unsized array; it's a member of t. I.e. my change is not a strict extension.

Furthermore, I addressed the previous review's comments. No invalid designators are returned in the array-to-pointer decay case anymore, we simply use addUnsizedArray instead. This also enables stuff like arr + 0 out of the box.

[Arcoth]

Simplified array-to-pointer conversion (simply add the array as unsized; let findCompleteObject and the SubobjectDesignator ctor do the work).

[Arcoth]

(Just fixed a slip after typing with the wrong window in focus...)

[rsmith]

Thanks, this looks good, just a couple of minor things and then it should be ready to land.

Do you have commit access or will you need someone else to commit this for you?

lib/AST/ExprConstant.cpp

152

Please start variable names with an uppercase letter.

168

The other 'most derived' paths through here should set this back to false (a sized array in a field in an element of an unsized array does not give an unsized array).

1301

We should call checkSubobject here, for cases like:

void f(int n) {
  int arr[2][n];
  constexpr int *p = &arr[2][0];
}

... which we should reject because arr[2] is a one-past-the-end lvalue, so cannot be indexed (we reject this if n is instead a constant).

[Arcoth]

Applied the last review's suggestions.

[rsmith]

Committed as r301822.

lib/AST/ExprConstant.cpp

1301

Turns out this case is already failing before we get here: forming arr[2] requires determining the size of the array element type int[n], which fails.

include/clang/Basic/DiagnosticASTKinds.td

def note_constexpr_inherited_ctor_call_here : Note<
   "in implicit initialization for inherited constructor of %0">;
 def note_constexpr_baa_insufficient_alignment : Note<
   "%select{alignment of|offset of the aligned pointer from}0 the base pointee "
   "object (%1 %plural{1:byte|:bytes}1) is %select{less than|not a multiple of}0 the "
   "asserted %2 %plural{1:byte|:bytes}2">;
 def note_constexpr_baa_value_insufficient_alignment : Note<
   "value of the aligned pointer (%0) is not a multiple of the asserted %1 "
   "%plural{1:byte|:bytes}1">;
+def note_constexpr_array_unknown_bound_arithmetic : Note<
+  "cannot perform pointer arithmetic on pointer to array without constant bound">;
 
 def warn_integer_constant_overflow : Warning<
   "overflow in expression; result is %0 with type %1">,
   InGroup<DiagGroup<"integer-overflow">>;
 
-// This is a temporary diagnostic, and shall be removed once our 
+// This is a temporary diagnostic, and shall be removed once our
 // implementation is complete, and like the preceding constexpr notes belongs
 // in Sema.
 def note_unimplemented_constexpr_lambda_feature_ast : Note<
     "unimplemented constexpr lambda feature: %0 (coming soon!)">;
 
 // inline asm related.
 let CategoryName = "Inline Assembly Issue" in {
   def err_asm_invalid_escape : Error<

lib/AST/ExprConstant.cpp

namespace {
 
   /// Determines if an LValue with the given LValueBase will have an unsized
   /// array in its designator.
   /// Find the path length and type of the most-derived subobject in the given
   /// path, and find the size of the containing array, if any.
   static unsigned
   findMostDerivedSubobject(ASTContext &Ctx, APValue::LValueBase Base,
                            ArrayRef<APValue::LValuePathEntry> Path,
-                           uint64_t &ArraySize, QualType &Type, bool &IsArray) {
+                           uint64_t &ArraySize, QualType &Type, bool &IsArray,
+                           bool &isUnsizedArray) {
     // This only accepts LValueBases from APValues, and APValues don't support
     // arrays that lack size info.
     assert(!isBaseAnAllocSizeCall(Base) &&
            "Unsized arrays shouldn't appear here");
     unsigned MostDerivedLength = 0;
     Type = getType(Base);
 
     for (unsigned I = 0, N = Path.size(); I != N; ++I) {
-      if (Type->isArrayType()) {
-        const ConstantArrayType *CAT =
-            cast<ConstantArrayType>(Ctx.getAsArrayType(Type));
-        Type = CAT->getElementType();
-        ArraySize = CAT->getSize().getZExtValue();
+      if (auto AT = Ctx.getAsArrayType(Type)) {
         MostDerivedLength = I + 1;
         IsArray = true;
+        if (auto CAT = Ctx.getAsConstantArrayType(Type))
+          ArraySize = CAT->getSize().getZExtValue();
+        else {
+          ArraySize = 0;
+          isUnsizedArray = true;
+        }
+        Type = AT->getElementType();
       } else if (Type->isAnyComplexType()) {
         const ComplexType *CT = Type->castAs<ComplexType>();
         Type = CT->getElementType();
         ArraySize = 2;
         MostDerivedLength = I + 1;
         IsArray = true;
       } else if (const FieldDecl *FD = getAsField(Path[I])) {
         Type = FD->getType();
struct SubobjectDesignator {
     /// True if the subobject was named in a manner not supported by C++11. Such
     /// lvalues can still be folded, but they are not core constant expressions
     /// and we cannot perform lvalue-to-rvalue conversions on them.
     unsigned Invalid : 1;
 
     /// Is this a pointer one past the end of an object?
     unsigned IsOnePastTheEnd : 1;
 
-    /// Indicator of whether the first entry is an unsized array.
-    unsigned FirstEntryIsAnUnsizedArray : 1;
+    /// Indicator of whether the most-derived object is an unsized array (e.g.
+    /// of unknown bound).
+    unsigned MostDerivedIsAnUnsizedArray : 1;
 
     /// Indicator of whether the most-derived object is an array element.
     unsigned MostDerivedIsArrayElement : 1;
 
     /// The length of the path to the most-derived object of which this is a
     /// subobject.
     unsigned MostDerivedPathLength : 28;
 
struct SubobjectDesignator {
 
     /// The entries on the path from the glvalue to the designated subobject.
     SmallVector<PathEntry, 8> Entries;
 
     SubobjectDesignator() : Invalid(true) {}
 
     explicit SubobjectDesignator(QualType T)
         : Invalid(false), IsOnePastTheEnd(false),
-          FirstEntryIsAnUnsizedArray(false), MostDerivedIsArrayElement(false),
+          MostDerivedIsAnUnsizedArray(false), MostDerivedIsArrayElement(false),
           MostDerivedPathLength(0), MostDerivedArraySize(0),
           MostDerivedType(T) {}
 
     SubobjectDesignator(ASTContext &Ctx, const APValue &V)
         : Invalid(!V.isLValue() || !V.hasLValuePath()), IsOnePastTheEnd(false),
-          FirstEntryIsAnUnsizedArray(false), MostDerivedIsArrayElement(false),
+          MostDerivedIsAnUnsizedArray(false), MostDerivedIsArrayElement(false),
           MostDerivedPathLength(0), MostDerivedArraySize(0) {
       assert(V.isLValue() && "Non-LValue used to make an LValue designator?");
       if (!Invalid) {
         IsOnePastTheEnd = V.isLValueOnePastTheEnd();
         ArrayRef<PathEntry> VEntries = V.getLValuePath();
         Entries.insert(Entries.end(), VEntries.begin(), VEntries.end());
-        if (V.getLValueBase()) {
-          bool IsArray = false;
+        if (auto Base = V.getLValueBase()) {
+          if (auto Decl = Base.dyn_cast<ValueDecl const*>())
+            Base = cast<ValueDecl>(Decl->getMostRecentDecl());
+          bool IsArray = false, IsUnsizedArray = false;
           MostDerivedPathLength = findMostDerivedSubobject(
-              Ctx, V.getLValueBase(), V.getLValuePath(), MostDerivedArraySize,
-              MostDerivedType, IsArray);
+              Ctx, Base, V.getLValuePath(), MostDerivedArraySize,
+              MostDerivedType, IsArray, IsUnsizedArray);
               MostDerivedIsArrayElement = IsArray;
+              MostDerivedIsAnUnsizedArray = IsUnsizedArray;
         }
       }
     }
 
     void setInvalid() {
       Invalid = true;
       Entries.clear();
     }
 
     /// Determine whether the most derived subobject is an array without a
     /// known bound.
     bool isMostDerivedAnUnsizedArray() const {
       assert(!Invalid && "Calling this makes no sense on invalid designators");
-      return Entries.size() == 1 && FirstEntryIsAnUnsizedArray;
+      return MostDerivedIsAnUnsizedArray;
     }
 
     /// Determine what the most derived array's size is. Results in an assertion
     /// failure if the most derived array lacks a size.
     uint64_t getMostDerivedArraySize() const {
       assert(!isMostDerivedAnUnsizedArray() && "Unsized array has no size");
       return MostDerivedArraySize;
     }
struct SubobjectDesignator {
     void addArrayUnchecked(const ConstantArrayType *CAT) {
       PathEntry Entry;
       Entry.ArrayIndex = 0;
       Entries.push_back(Entry);
 
       // This is a most-derived object.
       MostDerivedType = CAT->getElementType();
       MostDerivedIsArrayElement = true;
+      MostDerivedIsAnUnsizedArray = false;
       MostDerivedArraySize = CAT->getSize().getZExtValue();
       MostDerivedPathLength = Entries.size();
     }
     /// Update this designator to refer to the first element within the array of
     /// elements of type T. This is an array of unknown size.
     void addUnsizedArrayUnchecked(QualType ElemTy) {
       PathEntry Entry;
       Entry.ArrayIndex = 0;
       Entries.push_back(Entry);
 
       MostDerivedType = ElemTy;
       MostDerivedIsArrayElement = true;
+      MostDerivedIsAnUnsizedArray = true;
       // The value in MostDerivedArraySize is undefined in this case. So, set it
       // to an arbitrary value that's likely to loudly break things if it's
       // used.
       MostDerivedArraySize = std::numeric_limits<uint64_t>::max() / 2;
       MostDerivedPathLength = Entries.size();
     }
     /// Update this designator to refer to the given base or member of this
     /// object.
     void addDeclUnchecked(const Decl *D, bool Virtual = false) {
       PathEntry Entry;
       APValue::BaseOrMemberType Value(D, Virtual);
       Entry.BaseOrMember = Value.getOpaqueValue();
       Entries.push_back(Entry);
 
       // If this isn't a base class, it's a new most-derived object.
       if (const FieldDecl *FD = dyn_cast<FieldDecl>(D)) {
         MostDerivedType = FD->getType();
         MostDerivedIsArrayElement = false;
+        MostDerivedIsAnUnsizedArray = false;
         MostDerivedArraySize = 0;
         MostDerivedPathLength = Entries.size();
       }
     }
     /// Update this designator to refer to the given complex component.
     void addComplexUnchecked(QualType EltTy, bool Imag) {
       PathEntry Entry;
       Entry.ArrayIndex = Imag;
       Entries.push_back(Entry);
 
       // This is technically a most-derived object, though in practice this
       // is unlikely to matter.
       MostDerivedType = EltTy;
       MostDerivedIsArrayElement = true;
+      MostDerivedIsAnUnsizedArray = false;
       MostDerivedArraySize = 2;
       MostDerivedPathLength = Entries.size();
     }
     void diagnosePointerArithmetic(EvalInfo &Info, const Expr *E,
                                    const APSInt &N);
     /// Add N to the address of this subobject.
-    void adjustIndex(EvalInfo &Info, const Expr *E, APSInt N) {
-      if (Invalid || !N) return;
-      uint64_t TruncatedN = N.extOrTrunc(64).getZExtValue();
-      if (isMostDerivedAnUnsizedArray()) {
-        // Can't verify -- trust that the user is doing the right thing (or if
-        // not, trust that the caller will catch the bad behavior).
-        // FIXME: Should we reject if this overflows, at least?
-        Entries.back().ArrayIndex += TruncatedN;
-        return;
-      }
-
-      // [expr.add]p4: For the purposes of these operators, a pointer to a
-      // nonarray object behaves the same as a pointer to the first element of
-      // an array of length one with the type of the object as its element type.
-      bool IsArray = MostDerivedPathLength == Entries.size() &&
-                     MostDerivedIsArrayElement;
-      uint64_t ArrayIndex =
-          IsArray ? Entries.back().ArrayIndex : (uint64_t)IsOnePastTheEnd;
-      uint64_t ArraySize =
-          IsArray ? getMostDerivedArraySize() : (uint64_t)1;
-
-      if (N < -(int64_t)ArrayIndex || N > ArraySize - ArrayIndex) {
-        // Calculate the actual index in a wide enough type, so we can include
-        // it in the note.
-        N = N.extend(std::max<unsigned>(N.getBitWidth() + 1, 65));
-        (llvm::APInt&)N += ArrayIndex;
-        assert(N.ugt(ArraySize) && "bounds check failed for in-bounds index");
-        diagnosePointerArithmetic(Info, E, N);
-        setInvalid();
-        return;
-      }
-
-      ArrayIndex += TruncatedN;
-      assert(ArrayIndex <= ArraySize &&
-             "bounds check succeeded for out-of-bounds index");
-
-      if (IsArray)
-        Entries.back().ArrayIndex = ArrayIndex;
-      else
-        IsOnePastTheEnd = (ArrayIndex != 0);
-    }
+    void adjustIndex(EvalInfo &Info, const Expr *E, APSInt N);
   };
 
   /// A stack frame in the constexpr call stack.
   struct CallStackFrame {
     EvalInfo &Info;
 
     /// Parent - The caller of this stack frame.
     CallStackFrame *Caller;
OptionalDiagnostic &operator<<(const APSInt &I) {
       return *this;
     }
 
     OptionalDiagnostic &operator<<(const APFloat &F) {
       if (Diag) {
         // FIXME: Force the precision of the source value down so we don't
         // print digits which are usually useless (we don't really care here if
         // we truncate a digit by accident in edge cases).  Ideally,
-        // APFloat::toString would automatically print the shortest 
+        // APFloat::toString would automatically print the shortest
         // representation which rounds to the correct value, but it's a bit
         // tricky to implement.
         unsigned precision =
             llvm::APFloat::semanticsPrecision(F.getSemantics());
         precision = (precision * 59 + 195) / 196;
         SmallVector<char, 32> Buffer;
         F.toString(Buffer, precision);
         *Diag << StringRef(Buffer.data(), Buffer.size());
private:
     }
 
     /// Add notes containing a call stack to the current point of evaluation.
     void addCallStack(unsigned Limit);
 
   private:
     OptionalDiagnostic Diag(SourceLocation Loc, diag::kind DiagId,
                             unsigned ExtraNotes, bool IsCCEDiag) {
-    
       if (EvalStatus.Diag) {
         // If we have a prior diagnostic, it will be noting that the expression
         // isn't a constant expression. This diagnostic is more important,
         // unless we require this evaluation to produce a constant expression.
         //
         // FIXME: We might want to show both diagnostics to the user in
         // EM_ConstantFold mode.
         if (!EvalStatus.Diag->empty()) {
namespace {
   public:
     // Diagnose that the evaluation could not be folded (FF => FoldFailure)
     OptionalDiagnostic
     FFDiag(SourceLocation Loc,
           diag::kind DiagId = diag::note_invalid_subexpr_in_const_expr,
           unsigned ExtraNotes = 0) {
       return Diag(Loc, DiagId, ExtraNotes, false);
     }
-    
     OptionalDiagnostic FFDiag(const Expr *E, diag::kind DiagId
                               = diag::note_invalid_subexpr_in_const_expr,
                             unsigned ExtraNotes = 0) {
       if (EvalStatus.Diag)
         return Diag(E->getExprLoc(), DiagId, ExtraNotes, /*IsCCEDiag*/false);
       HasActiveDiagnostic = false;
       return OptionalDiagnostic();
     }
Info.CCEDiag(E, diag::note_constexpr_array_index)
       << N << /*array*/ 0
       << static_cast<unsigned>(getMostDerivedArraySize());
   else
     Info.CCEDiag(E, diag::note_constexpr_array_index)
       << N << /*non-array*/ 1;
   setInvalid();
 }
 
+void SubobjectDesignator::adjustIndex(EvalInfo &Info, const Expr *E, APSInt N) {
+  if (Invalid || !N) return;
+
+  uint64_t TruncatedN = N.extOrTrunc(64).getZExtValue();
+  if (isMostDerivedAnUnsizedArray()) {
+    // If we're dealing with an array without constant bound, the expression is
+    // not a constant expression.
+    if (!Info.checkingPotentialConstantExpression())
+      Info.CCEDiag(E, diag::note_constexpr_array_unknown_bound_arithmetic);
+    // Can't verify -- trust that the user is doing the right thing (or if
+    // not, trust that the caller will catch the bad behavior).
+    // FIXME: Should we reject if this overflows, at least?
+    Entries.back().ArrayIndex += TruncatedN;
+    return;
+  }
+
+  // [expr.add]p4: For the purposes of these operators, a pointer to a
+  // nonarray object behaves the same as a pointer to the first element of
+  // an array of length one with the type of the object as its element type.
+  bool IsArray = MostDerivedPathLength == Entries.size() &&
+                 MostDerivedIsArrayElement;
+  uint64_t ArrayIndex =
+      IsArray ? Entries.back().ArrayIndex : (uint64_t)IsOnePastTheEnd;
+  uint64_t ArraySize =
+      IsArray ? getMostDerivedArraySize() : (uint64_t)1;
+
+  if (N < -(int64_t)ArrayIndex || N > ArraySize - ArrayIndex) {
+    // Calculate the actual index in a wide enough type, so we can include
+    // it in the note.
+    N = N.extend(std::max<unsigned>(N.getBitWidth() + 1, 65));
+    (llvm::APInt&)N += ArrayIndex;
+    assert(N.ugt(ArraySize) && "bounds check failed for in-bounds index");
+    diagnosePointerArithmetic(Info, E, N);
+    setInvalid();
+    return;
+  }
+
+  ArrayIndex += TruncatedN;
+  assert(ArrayIndex <= ArraySize &&
+         "bounds check succeeded for out-of-bounds index");
+
+  if (IsArray)
+    Entries.back().ArrayIndex = ArrayIndex;
+  else
+    IsOnePastTheEnd = (ArrayIndex != 0);
+}
+
 CallStackFrame::CallStackFrame(EvalInfo &Info, SourceLocation CallLoc,
                                const FunctionDecl *Callee, const LValue *This,
                                APValue *Arguments)
     : Info(Info), Caller(Info.CurrentCall), Callee(Callee), This(This),
       Arguments(Arguments), CallLoc(CallLoc), Index(Info.NextCallIndex++) {
   Info.CurrentCall = this;
   ++Info.CallStackDepth;
 }
struct LValue {
     bool isNullPointer() const { return IsNullPtr;}
 
     void moveInto(APValue &V) const {
       if (Designator.Invalid)
         V = APValue(Base, Offset, APValue::NoLValuePath(), CallIndex,
                     IsNullPtr);
       else {
         assert(!InvalidBase && "APValues can't handle invalid LValue bases");
-        assert(!Designator.FirstEntryIsAnUnsizedArray &&
-               "Unsized array with a valid base?");
         V = APValue(Base, Offset, Designator.Entries,
                     Designator.IsOnePastTheEnd, CallIndex, IsNullPtr);
       }
     }
     void setFrom(ASTContext &Ctx, const APValue &V) {
       assert(V.isLValue() && "Setting LValue from a non-LValue?");
       Base = V.getLValueBase();
       Offset = V.getLValueOffset();
#endif
     }
 
     void addDecl(EvalInfo &Info, const Expr *E,
                  const Decl *D, bool Virtual = false) {
       if (checkSubobject(Info, E, isa<FieldDecl>(D) ? CSK_Field : CSK_Base))
         Designator.addDeclUnchecked(D, Virtual);
     }
     void addUnsizedArray(EvalInfo &Info, QualType ElemTy) {
-      assert(Designator.Entries.empty() && getType(Base)->isPointerType());
-      assert(isBaseAnAllocSizeCall(Base) &&
-             "Only alloc_size bases can have unsized arrays");
-      Designator.FirstEntryIsAnUnsizedArray = true;
       Designator.addUnsizedArrayUnchecked(ElemTy);
     }
     void addArray(EvalInfo &Info, const Expr *E, const ConstantArrayType *CAT) {
       if (checkSubobject(Info, E, CSK_ArrayToPointer))
         Designator.addArrayUnchecked(CAT);
     }
     void addComplex(EvalInfo &Info, const Expr *E, QualType EltTy, bool Imag) {
       if (checkSubobject(Info, E, Imag ? CSK_Imag : CSK_Real))
         Designator.addComplexUnchecked(EltTy, Imag);
if (I == N) {
 
       return true;
     }
 
     LastField = nullptr;
     if (ObjType->isArrayType()) {
       // Next subobject is an array element.
       const ConstantArrayType *CAT = Info.Ctx.getAsConstantArrayType(ObjType);
       assert(CAT && "vla in literal type?");
       uint64_t Index = Sub.Entries[I].ArrayIndex;
       if (CAT->getSize().ule(Index)) {
         // Note, it should not be possible to form a pointer with a valid
         // designator which points more than one past the end of the array.
         if (Info.getLangOpts().CPlusPlus11)
           Info.FFDiag(E, diag::note_constexpr_access_past_end)
             << handler.AccessKind;
         else
           Info.FFDiag(E);
         return handler.failed();
       }
 
       ObjType = CAT->getElementType();
if (const ValueDecl *D = LVal.Base.dyn_cast<const ValueDecl*>()) {
     // Accesses of volatile-qualified objects are not allowed.
     if (BaseType.isVolatileQualified()) {
       if (Info.getLangOpts().CPlusPlus) {
         Info.FFDiag(E, diag::note_constexpr_access_volatile_obj, 1)
           << AK << 1 << VD;
         Info.Note(VD->getLocation(), diag::note_declared_at);
       } else {
         Info.FFDiag(E);
       }
       return CompleteObject();
     }
 
     // Unless we're looking at a local variable or argument in a constexpr call,
     // the variable we're reading must be const.
     if (!Frame) {
       if (Info.getLangOpts().CPlusPlus14 &&
           VD == Info.EvaluatingDecl.dyn_cast<const ValueDecl *>()) {
if (!Frame) {
           Info.FFDiag(E);
         }
         return CompleteObject();
       }
     }
 
     if (!evaluateVarDeclInit(Info, E, VD, Frame, BaseVal))
       return CompleteObject();
+
+    // The complete object can be an array of unknown bound, in which case we
+    // have to find the most recent declaration and adjust the type accordingly.
+    if (Info.Ctx.getAsIncompleteArrayType(BaseType)) {
+      QualType MostRecentType =
+         cast<ValueDecl const>(D->getMostRecentDecl())->getType();
+      if (auto CAT = Info.Ctx.getAsConstantArrayType(MostRecentType))
+        BaseType = MostRecentType;
+    }
   } else {
     const Expr *Base = LVal.Base.dyn_cast<const Expr*>();
 
     if (!Frame) {
       if (const MaterializeTemporaryExpr *MTE =
               dyn_cast<MaterializeTemporaryExpr>(Base)) {
         assert(MTE->getStorageDuration() == SD_Static &&
                "should have a frame for a non-global materialized temporary");
static bool CheckConstexprFunction(EvalInfo &Info, SourceLocation CallLoc,
 
   // Can we evaluate this function call?
   if (Definition && Definition->isConstexpr() &&
       !Definition->isInvalidDecl() && Body)
     return true;
 
   if (Info.getLangOpts().CPlusPlus11) {
     const FunctionDecl *DiagDecl = Definition ? Definition : Declaration;
-    
     // If this function is not constexpr because it is an inherited
     // non-constexpr constructor, diagnose that directly.
     auto *CD = dyn_cast<CXXConstructorDecl>(DiagDecl);
     if (CD && CD->isInheritingConstructor()) {
       auto *Inherited = CD->getInheritedConstructor().getConstructor();
-      if (!Inherited->isConstexpr()) 
+      if (!Inherited->isConstexpr())
         DiagDecl = CD = Inherited;
     }
 
     // FIXME: If DiagDecl is an implicitly-declared special member function
     // or an inheriting constructor, we should be much more explicit about why
     // it's not constexpr.
     if (CD && CD->isInheritingConstructor())
       Info.FFDiag(CallLoc, diag::note_constexpr_invalid_inhctor, 1)
if (CalleeType->isSpecificBuiltinType(BuiltinType::BoundMember)) {
         // operators without a 'this' parameter!
         if (Args.empty())
           return Error(E);
 
         if (!EvaluateObjectArgument(Info, Args[0], ThisVal))
           return false;
         This = &ThisVal;
         Args = Args.slice(1);
-      } else if (MD && MD->isLambdaStaticInvoker()) {   
+      } else if (MD && MD->isLambdaStaticInvoker()) {
         // Map the static invoker for the lambda back to the call operator.
         // Conveniently, we don't have to slice out the 'this' argument (as is
         // being done for the non-static case), since a static member function
         // doesn't have an implicit argument passed in.
         const CXXRecordDecl *ClosureClass = MD->getParent();
         assert(
             ClosureClass->captures_begin() == ClosureClass->captures_end() &&
             "Number of captures must be zero for conversion to function-ptr");
if (CalleeType->isSpecificBuiltinType(BuiltinType::BoundMember)) {
           assert(CorrespondingCallOpSpecialization &&
                  "We must always have a function call operator specialization "
                  "that corresponds to our static invoker specialization");
           FD = cast<CXXMethodDecl>(CorrespondingCallOpSpecialization);
         } else
           FD = LambdaCallOp;
       }
 
-      
     } else
       return Error(E);
 
     if (This && !This->checkSubobject(Info, E, CSK_This))
       return false;
 
     // DR1358 allows virtual constexpr functions in some cases. Don't allow
     // calls to such functions in constant expressions.
bool VisitCXXThisExpr(const CXXThisExpr *E) {
     // If we are inside a lambda's call operator, the 'this' expression refers
     // to the enclosing '*this' object (either by value or reference) which is
     // either copied into the closure object's field that represents the '*this'
     // or refers to '*this'.
     if (isLambdaCallOperator(Info.CurrentCall->Callee)) {
       // Update 'Result' to refer to the data member/field of the closure object
       // that represents the '*this' capture.
       if (!HandleLValueMember(Info, E, Result,
-                             Info.CurrentCall->LambdaThisCaptureField)) 
+                             Info.CurrentCall->LambdaThisCaptureField))
         return false;
       // If we captured '*this' by reference, replace the field with its referent.
       if (Info.CurrentCall->LambdaThisCaptureField->getType()
               ->isPointerType()) {
         APValue RVal;
         if (!handleLValueToRValueConversion(Info, E, E->getType(), Result,
                                             RVal))
           return false;
bool PointerExprEvaluator::VisitBinaryOperator(const BinaryOperator *E) {
   bool EvalPtrOK = evaluatePointer(PExp, Result);
   if (!EvalPtrOK && !Info.noteFailure())
     return false;
 
   llvm::APSInt Offset;
   if (!EvaluateInteger(IExp, Offset, Info) || !EvalPtrOK)
     return false;
 
   if (E->getOpcode() == BO_Sub)
     negateAsSigned(Offset);
 
   QualType Pointee = PExp->getType()->castAs<PointerType>()->getPointeeType();
   return HandleLValueArrayAdjustment(Info, E, Result, Pointee, Offset);
 }
 
 bool PointerExprEvaluator::VisitUnaryAddrOf(const UnaryOperator *E) {
   return evaluateLValue(E->getSubExpr(), Result);
 }
 
 bool PointerExprEvaluator::VisitCastExpr(const CastExpr* E) {
   const Expr* SubExpr = E->getSubExpr();
 
   switch (E->getCastKind()) {
   default:
     break;
if (Value.isInt()) {
       Result.setFrom(Info.Ctx, Value);
       return true;
     }
   }
   case CK_ArrayToPointerDecay:
     if (SubExpr->isGLValue()) {
       if (!evaluateLValue(SubExpr, Result))
         return false;
     } else {
       Result.set(SubExpr, Info.CurrentCall->Index);
       if (!EvaluateInPlace(Info.CurrentCall->createTemporary(SubExpr, false),
                            Info, Result, SubExpr))
         return false;
     }
+
     // The result is a pointer to the first element of the array.
     if (const ConstantArrayType *CAT
           = Info.Ctx.getAsConstantArrayType(SubExpr->getType()))
       Result.addArray(Info, E, CAT);
-    else
-      Result.Designator.setInvalid();
+    // If the array hasn't been given a bound yet, add it as an unsized one.
+    else {
+      auto AT = Info.Ctx.getAsArrayType(SubExpr->getType());
+      assert(AT && "Array to pointer decay on non-array object?");
+      Result.addUnsizedArray(Info, AT->getElementType());
+    }
+
     return true;
 
   case CK_FunctionToPointerDecay:
     return evaluateLValue(SubExpr, Result);
 
   case CK_LValueToRValue: {
     LValue LVal;
     if (!evaluateLValue(E->getSubExpr(), LVal))
       return false;
 
     APValue RVal;
     // Note, we use the subexpression's type in order to retain cv-qualifiers.
bool RecordExprEvaluator::VisitCXXStdInitializerListExpr(
   return true;
 }
 
 bool RecordExprEvaluator::VisitLambdaExpr(const LambdaExpr *E) {
   const CXXRecordDecl *ClosureClass = E->getLambdaClass();
   if (ClosureClass->isInvalidDecl()) return false;
 
   if (Info.checkingPotentialConstantExpression()) return true;
-  
   const size_t NumFields =
       std::distance(ClosureClass->field_begin(), ClosureClass->field_end());
 
   assert(NumFields == (size_t)std::distance(E->capture_init_begin(),
                                             E->capture_init_end()) &&
          "The number of lambda capture initializers should equal the number of "
          "fields within the closure type");
 
   Result = APValue(APValue::UninitStruct(), /*NumBases*/0, NumFields);
   // Iterate through all the lambda's closure object's fields and initialize
   // them.
   auto *CaptureInitIt = E->capture_init_begin();
   const LambdaCapture *CaptureIt = ClosureClass->captures_begin();
   bool Success = true;
   for (const auto *Field : ClosureClass->fields()) {
     assert(CaptureInitIt != E->capture_init_end());
     // Get the initializer for this field
     Expr *const CurFieldInit = *CaptureInitIt++;
-    
     // If there is no initializer, either this is a VLA or an error has
     // occurred.
     if (!CurFieldInit)
       return Error(E);
 
     APValue &FieldVal = Result.getStructField(Field->getFieldIndex());
     if (!EvaluateInPlace(FieldVal, Info, This, CurFieldInit)) {
       if (!Info.keepEvaluatingAfterFailure())
VectorExprEvaluator::VisitInitListExpr(const InitListExpr *E) {
   unsigned NumInits = E->getNumInits();
   unsigned NumElements = VT->getNumElements();
 
   QualType EltTy = VT->getElementType();
   SmallVector<APValue, 4> Elements;
 
   // The number of initializers can be less than the number of
   // vector elements. For OpenCL, this can be due to nested vector
-  // initialization. For GCC compatibility, missing trailing elements 
+  // initialization. For GCC compatibility, missing trailing elements
   // should be initialized with zeroes.
   unsigned CountInits = 0, CountElts = 0;
   while (CountElts < NumElements) {
     // Handle nested vector initialization.
-    if (CountInits < NumInits 
+    if (CountInits < NumInits
         && E->getInit(CountInits)->getType()->isVectorType()) {
       APValue v;
       if (!EvaluateVector(E->getInit(CountInits), v, Info))
         return Error(E);
       unsigned vlen = v.getVectorLength();
-      for (unsigned j = 0; j < vlen; j++) 
+      for (unsigned j = 0; j < vlen; j++)
         Elements.push_back(v.getVectorElt(j));
       CountElts += vlen;
     } else if (EltTy->isIntegerType()) {
       llvm::APSInt sInt(32);
       if (CountInits < NumInits) {
         if (!EvaluateInteger(E->getInit(CountInits), sInt, Info))
           return false;
       } else // trailing integer zero.
bool Success(const llvm::APSInt &SI, const Expr *E, APValue &Result) {
     Result = APValue(SI);
     return true;
   }
   bool Success(const llvm::APSInt &SI, const Expr *E) {
     return Success(SI, E, Result);
   }
 
   bool Success(const llvm::APInt &I, const Expr *E, APValue &Result) {
-    assert(E->getType()->isIntegralOrEnumerationType() && 
+    assert(E->getType()->isIntegralOrEnumerationType() &&
            "Invalid evaluation result.");
     assert(I.getBitWidth() == Info.Ctx.getIntWidth(E->getType()) &&
            "Invalid evaluation result.");
     Result = APValue(APSInt(I));
     Result.getInt().setIsUnsigned(
                             E->getType()->isUnsignedIntegerOrEnumerationType());
     return true;
   }
   bool Success(const llvm::APInt &I, const Expr *E) {
     return Success(I, E, Result);
   }
 
   bool Success(uint64_t Value, const Expr *E, APValue &Result) {
-    assert(E->getType()->isIntegralOrEnumerationType() && 
+    assert(E->getType()->isIntegralOrEnumerationType() &&
            "Invalid evaluation result.");
     Result = APValue(Info.Ctx.MakeIntValue(Value, E->getType()));
     return true;
   }
   bool Success(uint64_t Value, const Expr *E) {
     return Success(Value, E, Result);
   }
 
bool VisitArrayInitIndexExpr(const ArrayInitIndexExpr *E) {
     if (Info.ArrayInitIndex == uint64_t(-1)) {
       // We were asked to evaluate this subexpression independent of the
       // enclosing ArrayInitLoopExpr. We can't do that.
       Info.FFDiag(E);
       return false;
     }
     return Success(Info.ArrayInitIndex, E);
   }
-    
   // Note, GNU defines __null as an integer, not a pointer.
   bool VisitGNUNullExpr(const GNUNullExpr *E) {
     return ZeroInitialization(E);
   }
 
   bool VisitTypeTraitExpr(const TypeTraitExpr *E) {
     return Success(E->getValue(), E);
   }
if (auto *FD = dyn_cast<FieldDecl>(ME->getMemberDecl())) {
         if (!IsLastOrInvalidFieldDecl(cast<FieldDecl>(FD), Invalid))
           return Invalid;
       }
     }
   }
 
   unsigned I = 0;
   QualType BaseType = getType(Base);
-  if (LVal.Designator.FirstEntryIsAnUnsizedArray) {
-    assert(isBaseAnAllocSizeCall(Base) &&
-           "Unsized array in non-alloc_size call?");
-    // If this is an alloc_size base, we should ignore the initial array index
+  if (isBaseAnAllocSizeCall(Base)) {
     ++I;
     BaseType = BaseType->castAs<PointerType>()->getPointeeType();
   }
 
   for (unsigned E = LVal.Designator.Entries.size(); I != E; ++I) {
     const auto &Entry = LVal.Designator.Entries[I];
     if (BaseType->isArrayType()) {
       // Because __builtin_object_size treats arrays as objects, we can ignore
bool DataRecursiveIntBinOpEvaluator::
        VisitBinOp(const EvalResult &LHSResult, const EvalResult &RHSResult,
                   const BinaryOperator *E, APValue &Result) {
   if (E->getOpcode() == BO_Comma) {
     if (RHSResult.Failed)
       return false;
     Result = RHSResult.Val;
     return true;
   }
-  
   if (E->isLogicalOp()) {
     bool lhsResult, rhsResult;
     bool LHSIsOK = HandleConversionToBool(LHSResult.Val, lhsResult);
     bool RHSIsOK = HandleConversionToBool(RHSResult.Val, rhsResult);
-    
     if (LHSIsOK) {
       if (RHSIsOK) {
         if (E->getOpcode() == BO_LOr)
           return Success(lhsResult || rhsResult, E, Result);
         else
           return Success(lhsResult && rhsResult, E, Result);
       }
     } else {
       if (RHSIsOK) {
         // We can't evaluate the LHS; however, sometimes the result
         // is determined by the RHS: X && 0 -> 0, X || 1 -> 1.
         if (rhsResult == (E->getOpcode() == BO_LOr))
           return Success(rhsResult, E, Result);
       }
     }
-    
     return false;
   }
-  
   assert(E->getLHS()->getType()->isIntegralOrEnumerationType() &&
          E->getRHS()->getType()->isIntegralOrEnumerationType());
-  
   if (LHSResult.Failed || RHSResult.Failed)
     return false;
-  
   const APValue &LHSVal = LHSResult.Val;
   const APValue &RHSVal = RHSResult.Val;
-  
   // Handle cases like (unsigned long)&a + 4.
   if (E->isAdditiveOp() && LHSVal.isLValue() && RHSVal.isInt()) {
     Result = LHSVal;
     addOrSubLValueAsInteger(Result, RHSVal.getInt(), E->getOpcode() == BO_Sub);
     return true;
   }
-  
   // Handle cases like 4 + (unsigned long)&a
   if (E->getOpcode() == BO_Add &&
       RHSVal.isLValue() && LHSVal.isInt()) {
     Result = RHSVal;
     addOrSubLValueAsInteger(Result, LHSVal.getInt(), /*IsSub*/false);
     return true;
   }
-  
   if (E->getOpcode() == BO_Sub && LHSVal.isLValue() && RHSVal.isLValue()) {
     // Handle (intptr_t)&&A - (intptr_t)&&B.
     if (!LHSVal.getLValueOffset().isZero() ||
         !RHSVal.getLValueOffset().isZero())
       return false;
     const Expr *LHSExpr = LHSVal.getLValueBase().dyn_cast<const Expr*>();
     const Expr *RHSExpr = RHSVal.getLValueBase().dyn_cast<const Expr*>();
     if (!LHSExpr || !RHSExpr)
bool DataRecursiveIntBinOpEvaluator::
   if (!handleIntIntBinOp(Info, E, LHSVal.getInt(), E->getOpcode(),
                          RHSVal.getInt(), Value))
     return false;
   return Success(Value, E, Result);
 }
 
 void DataRecursiveIntBinOpEvaluator::process(EvalResult &Result) {
   Job &job = Queue.back();
-  
   switch (job.Kind) {
     case Job::AnyExprKind: {
       if (const BinaryOperator *Bop = dyn_cast<BinaryOperator>(job.E)) {
         if (shouldEnqueue(Bop)) {
           job.Kind = Job::BinOpKind;
           enqueue(Bop->getLHS());
           return;
         }
       }
-      
       EvaluateExpr(job.E, Result);
       Queue.pop_back();
       return;
     }
-      
     case Job::BinOpKind: {
       const BinaryOperator *Bop = cast<BinaryOperator>(job.E);
       bool SuppressRHSDiags = false;
       if (!VisitBinOpLHSOnly(Result, Bop, SuppressRHSDiags)) {
         Queue.pop_back();
         return;
       }
       if (SuppressRHSDiags)
         job.startSpeculativeEval(Info);
       job.LHSResult.swap(Result);
       job.Kind = Job::BinOpVisitedLHSKind;
       enqueue(Bop->getRHS());
       return;
     }
-      
     case Job::BinOpVisitedLHSKind: {
       const BinaryOperator *Bop = cast<BinaryOperator>(job.E);
       EvalResult RHS;
       RHS.swap(Result);
       Result.Failed = !VisitBinOp(job.LHSResult, RHS, Bop, Result.Val);
       Queue.pop_back();
       return;
     }
   }
-  
   llvm_unreachable("Invalid Job::Kind!");
 }
 
 namespace {
 /// Used when we determine that we should fail, but can keep evaluating prior to
 /// noting that we had a failure.
 class DelayedNoteFailureRAII {
   EvalInfo &Info;
case OffsetOfNode::Base: {
       if (RD->isInvalidDecl()) return false;
       const ASTRecordLayout &RL = Info.Ctx.getASTRecordLayout(RD);
 
       // Find the base class itself.
       CurrentType = BaseSpec->getType();
       const RecordType *BaseRT = CurrentType->getAs<RecordType>();
       if (!BaseRT)
         return Error(OOE);
-      
       // Add the offset to the base.
       Result += RL.getBaseClassOffset(cast<CXXRecordDecl>(BaseRT->getDecl()));
       break;
     }
     }
   }
   return Success(Result, OOE);
 }
static bool FastEvaluateAsRValue(const Expr *Exp, Expr::EvalResult &Result,
   }
 
   // This case should be rare, but we need to check it before we check on
   // the type below.
   if (Exp->getType().isNull()) {
     IsConst = false;
     return true;
   }
-  
   // FIXME: Evaluating values of large array and record types can cause
   // performance problems. Only do so in C++11 for now.
   if (Exp->isRValue() && (Exp->getType()->isArrayType() ||
                           Exp->getType()->isRecordType()) &&
       !Ctx.getLangOpts().CPlusPlus11) {
     IsConst = false;
     return true;
   }
   return false;
 }
 
 
 /// EvaluateAsRValue - Return true if this is a constant which we can fold using
 /// any crazy technique (that has nothing to do with language standards) that
 /// we want to.  If this function returns true, it returns the folded constant
 /// in Result. If this expression is a glvalue, an lvalue-to-rvalue conversion
 /// will be applied to the result.
 bool Expr::EvaluateAsRValue(EvalResult &Result, const ASTContext &Ctx) const {
   bool IsConst;
   if (FastEvaluateAsRValue(this, Result, Ctx, IsConst))
     return IsConst;
-  
   EvalInfo Info(Ctx, Result, EvalInfo::EM_IgnoreSideEffects);
   return ::EvaluateAsRValue(Info, this, Result.Val);
 }
 
 bool Expr::EvaluateAsBooleanCondition(bool &Result,
                                       const ASTContext &Ctx) const {
   EvalResult Scratch;
   return EvaluateAsRValue(Scratch, Ctx) &&

test/SemaCXX/constexpr-array-unknown-bound.cpp

+// RUN: %clang_cc1 %s -Wno-uninitialized -std=c++1z -fsyntax-only -verify
+
+const extern int arr[];
+constexpr auto p = arr; // ok
+constexpr int f(int i) {return p[i];} // expected-note {{read of dereferenced one-past-the-end pointer}}
+
+constexpr int arr[] {1, 2, 3};
+constexpr auto p2 = arr + 2; // ok
+constexpr int x = f(2); // ok
+constexpr int y = f(3); // expected-error {{constant expression}}
+// expected-note-re@-1 {{in call to 'f({{.*}})'}}
+
+struct A {int m[];} a;
+constexpr auto p3 = a.m; // ok
+constexpr auto p4 = a.m + 1; // expected-error {{constant expression}} expected-note {{constant bound}}
+
+void g(int i) {
+  int arr[i];
+  constexpr auto p = arr + 2; // expected-error {{constant expression}} expected-note {{constant bound}}
+}