[Sema] Diagnose local variables and parameters captured by lambda and block expressions in a default argument

[ahatanak]

Summary

This patch fixes an assertion failure that occurs when compiling the following invalid code:

struct S {
  template<class T>
  S(T &&) {}
};

template<class T>
void foo1(int a0, S a1 = [](){ (void)&a0; } ) { // a0 cannot be used in the default argument for a1
}

void foo2() {
  foo1<int>(1);
}

$ clang++ -std=c++14 -c -o /dev/null test.cpp

Assertion failed: (isa<LabelDecl>(D) && "declaration not instantiated in this scope"), function findInstantiationOf, file llvm/tools/clang/lib/Sema/SemaTemplateInstantiate.cpp, line 2911.

The assertion fails when findInstantiationOf is called to find the instantiated decl of a0 when instantiating the lambda expression that is the default argument for a1.

To prevent the assertion failure, this patch makes CheckDefaultArgumentVisitor visit all subexpressions belonging to a default argument expression and detect local variables and parameters (that are external to the default argument) referenced in the default argument expression after the template definition is parsed. This patch also removes the diagnostic that is printed in test p7.cpp when a local variable is referenced inside a unevaluated default argument expression, which I think conforms to c++14 or later.

Also, with this patch, clang prints diagnostics when local variables or parameters are referenced inside a block expression that is used as a default argument. I wasn't 100% sure it is legal to use blocks for default arguments (I found that compiling the code below causes clang to segfault), but it seems to me that we want to handle blocks in default arguments the same way we handle lambdas.

void logRange(id i = [](){}) {
}

void foo1() {
  logRange();
}

$ clang++ -std=c++14 -c -o /dev/null -fobjc-arc test.mm

rdar://problem/33239958

[faisalv]

I don't think this approach is entirely correct for at least the following reasons:

1. in the lambda case the machinery that diagnoses capture failures should be the machinery erroring on the lambda (when the parameter is odr-used)
2. in the unevaluated case, once you disable the error, the instantiation machinery will fail to find the corresponding instantiated parmvardecl.

I think - in addition to allowing unevaluated uses of parmvardecls by tweaking the DefaultArgumentChecker, you would also need to add the instantiated mappings of the parameters, prior to instantiating the default argument (to avoid the assertion) and perhaps need to tweak DoMarkVarDeclReferenced and/or tryCaptureVariable to make sure such cases for lambdas produce errors (if they don't, w the above fix).

Thanks for working on this!

[ahatanak]

In D36915#849622, @faisalv wrote:

I don't think this approach is entirely correct for at least the following reasons:

1. in the lambda case the machinery that diagnoses capture failures should be the machinery erroring on the lambda (when the parameter is odr-used)
2. in the unevaluated case, once you disable the error, the instantiation machinery will fail to find the corresponding instantiated parmvardecl.

Oh right, it stills assert in the unevaluated case. I should have a test case for that too.

I also found that the following code, which has a lambda that doesn't capture anything, asserts (in IRGen):

struct S {
  template<class T>
  S(T&&) {}
};

template<class T>
void foo1() {
  struct S2 {
    void foo2(S s = [](){}) {
    }
  };

  S2 s2;
  s2.foo2();
}

void foo3() {
  foo1<int>();
}

[ahatanak]

In D36915#849622, @faisalv wrote:

I don't think this approach is entirely correct for at least the following reasons:

1. in the lambda case the machinery that diagnoses capture failures should be the machinery erroring on the lambda (when the parameter is odr-used)

Does this mean that it is OK to have a parameter or local variable appear in a potentially-evaluated expression as long as it is not odr-used? I think this is slightly different from the standard, which says a parameter or local variable cannot appear as a potentially-evaluated expression in a default argument.

For example:

void foo2(int);

void func() {
  const int a = 1;
  void foo1(S s = [](){ foo2(a); }); // "a" is not in an unevaluated context and is not odr-used.
}

I think I need clarification as it will affect how or where we detect this error.

[faisalv]

In D36915#854317, @ahatanak wrote:

In D36915#849622, @faisalv wrote:

I don't think this approach is entirely correct for at least the following reasons:

1. in the lambda case the machinery that diagnoses capture failures should be the machinery erroring on the lambda (when the parameter is odr-used)

Does this mean that it is OK to have a parameter or local variable appear in a potentially-evaluated expression as long as it is not odr-used? I think this is slightly different from the standard, which says a parameter or local variable cannot appear as a potentially-evaluated expression in a default argument.

For example:

void foo2(int);

void func() {
  const int a = 1;
  void foo1(S s = [](){ foo2(a); }); // "a" is not in an unevaluated context and is not odr-used.
}

I think I need clarification as it will affect how or where we detect this error.

'a' is not captured (and does not need to be captured) above, so I think that code should be ok.

But I also think the following code should be ok at local scope within func.
void foo(int = a);

I thought there was a DR against the standard-draft with the intent of making these valid (if they are not already so)?

[ahatanak]

clang currently rejects "void foo(int = a);" and so does gcc.

I'm trying to search the defect reports, but it looks like the c++ standard's site is currently unreachable.

[ahatanak]

Address review comments.

• Detect invalid references to parameters or local variables by default arguments in tryCaptureVariable. Before parsing or instantiating the default argument expression, the enclosing DeclContext is saved to ParentOfDefaultArg, which tryCaptureVariable uses to detect invalid references (if the referenced variable belongs to ParentOfDefaultArg or an enclosing DeclContext, it is not valid).

• In CheckCXXDefaultArgExpr, save the parameters and their instantiations that appear before the parameter with default argument to the current LocalInstantiationScope so that findInstantiationOf doesn't assert when it tries to find the instantiation of a parameter that is referenced in the default arugment.

There are still cases where clang rejects references to local variables or parameters that shouldn't be rejected. For example:

• Local variables or parameters referenced in _Generic's controlling-expression or the expressions of the selections that are not chosen.
• The following code is rejected even though 'x' is not odr-used:

void func() {
  const int x = 1;
  void foo1(int a0 = x);
}

• dcl.fct.default/p7.cpp

I plan to work on a fix after this patch is committed.

[ahatanak]

ping

[ahatanak]

ping.

Any comments on this patch or alternate approaches?

[ahatanak]

ping

[rjmccall]

This looks good to me.

[aaron.ballman]

lib/Sema/Sema.cpp

1677–1684

Any reason not to inline this in the header file?

lib/Sema/SemaExpr.cpp

4523

const FunctionDecl *

4535

Is it possible for the Optional<> returned here to not hold a value?

13746–13751

Ternary operator in S.Diag() would be just as clear, I think.

Also, you should not need to call getDeclName() as the diagnostic engine will automatically do the right thing. As is stands, this won't properly quote the name in the diagnostic.

[rsmith]

Please take a look at http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2017/p0588r1.html, which respecifies the rules for lambda capture and its interaction with default arguments, and has been voted into the C++ working paper as a defect report resolution. The approach there is to use a purely syntactic, scope-based mechanism to detect problems such as this. (In dependent contexts, we can track on the DeclRefExpr whether the name is odr-usable, in case we can't tell whether it's odr-used from the template definition alone.)

include/clang/Sema/Sema.h

1062

There are lots of cases where we switch context in the middle of handling an expression, for instance to instantiate a template (or even *parse* a template in MSVC-compatible delayed template parsing mode). It's not reasonable to add a new form of state that all those places will need to save and restore themselves.

Please consider whether this would make sense as a member of the ExpressionEvaluationContextRecord or similar.

lib/Sema/SemaExpr.cpp

4520–4541

Use addInstantiatedParametersToScope for this.

This bugfix looks to be independent of the fix for lambdas; can you factor it out into a separate patch?

include/clang/Sema/Sema.h

SpecialMemberOverloadResultEntry(const llvm::FoldingSetNodeID &ID)
       : FastFoldingSetNode(ID)
     {}
   };
 
   /// \brief A cache of special member function overload resolution results
   /// for C++ records.
   llvm::FoldingSet<SpecialMemberOverloadResultEntry> SpecialMemberCache;
 
+  /// Parent DeclContext of the default argument expression that is currently
+  /// being parsed. This is used to detect invalid local variable references in
+  /// default argument expression. For example:
+  ///
+  /// void foo1() {
+  ///   int i;
+  ///
+  ///   // references to 'i' and 'a0' are invalid.
+  ///   void foo2(int a0, int a1 = i, int a2 = a0);
+  /// }
+
+  const DeclContext *ParentOfDefaultArg = nullptr;
+
+  void setParentOfDefaultArg(const DeclContext *P) {
+    ParentOfDefaultArg = P;
+  }
+
+  const DeclContext *getParentOfDefaultArg() const {
+    return ParentOfDefaultArg;
+  }
+
+  /// RAII class to save and restore ParentOfDefaultArg.
+  class DefaultArgRAII {
+  public:
+    DefaultArgRAII(Sema &S);
+    ~DefaultArgRAII();
+  private:
+    Sema &Actions;
+    const DeclContext *PrevParent;
+  };
+
   /// \brief A cache of the flags available in enumerations with the flag_bits
   /// attribute.
   mutable llvm::DenseMap<const EnumDecl*, llvm::APInt> FlagBitsCache;
 
   /// \brief The kind of translation unit we are processing.
   ///
   /// When we're processing a complete translation unit, Sema will perform
   /// end-of-translation-unit semantic tasks (such as creating

lib/Parse/ParseDecl.cpp

if (DS.isEmpty() && ParmDeclarator.getIdentifier() == nullptr &&
       Decl *Param = Actions.ActOnParamDeclarator(getCurScope(), ParmDeclarator);
       // Parse the default argument, if any. We parse the default
       // arguments in all dialects; the semantic analysis in
       // ActOnParamDefaultArgument will reject the default argument in
       // C.
       if (Tok.is(tok::equal)) {
         SourceLocation EqualLoc = Tok.getLocation();
 
+        Sema::DefaultArgRAII DefaultArgContext(Actions);
+
         // Parse the default argument
         if (D.getContext() == Declarator::MemberContext) {
           // If we're inside a class definition, cache the tokens
           // corresponding to the default argument. We'll actually parse
           // them when we see the end of the class definition.
           DefArgToks.reset(new CachedTokens);
 
           SourceLocation ArgStartLoc = NextToken().getLocation();

lib/Sema/Sema.cpp

 }
 
 IdentifierInfo *Sema::getFloat128Identifier() const {
   if (!Ident___float128)
     Ident___float128 = &Context.Idents.get("__float128");
   return Ident___float128;
 }
 
+Sema::DefaultArgRAII::DefaultArgRAII(Sema &S)
+    : Actions(S), PrevParent(S.getParentOfDefaultArg()) {
+  S.setParentOfDefaultArg(S.CurContext);
+}
+
+Sema::DefaultArgRAII::~DefaultArgRAII() {
+  Actions.setParentOfDefaultArg(PrevParent);
+}
+
 void Sema::PushCapturedRegionScope(Scope *S, CapturedDecl *CD, RecordDecl *RD,
                                    CapturedRegionKind K) {
   CapturingScopeInfo *CSI = new CapturedRegionScopeInfo(
       getDiagnostics(), S, CD, RD, CD->getContextParam(), K,
       (getLangOpts().OpenMP && K == CR_OpenMP) ? getOpenMPNestingLevel() : 0);
   CSI->ReturnType = Context.VoidTy;
   FunctionScopes.push_back(CSI);
 }

lib/Sema/SemaExpr.cpp

= UnresolvedLookupExpr::Create(Context, R.getNamingClass(),
                                    R.getLookupNameInfo(),
                                    NeedsADL, R.isOverloadedResult(),
                                    R.begin(), R.end());
 
   return ULE;
 }
 
 static void
-diagnoseUncapturableValueReference(Sema &S, SourceLocation loc,
-                                   ValueDecl *var, DeclContext *DC);
+diagnoseUncapturableValueReference(Sema &S, SourceLocation loc, ValueDecl *var,
+                                   bool InDefaultArgExpr = false);
 
 /// \brief Complete semantic analysis for a reference to the given declaration.
 ExprResult Sema::BuildDeclarationNameExpr(
     const CXXScopeSpec &SS, const DeclarationNameInfo &NameInfo, NamedDecl *D,
     NamedDecl *FoundD, const TemplateArgumentListInfo *TemplateArgs,
     bool AcceptInvalidDecl) {
   assert(D && "Cannot refer to a NULL declaration");
   assert(!isa<FunctionTemplateDecl>(D) &&
case Decl::Binding: {
       // These are always lvalues.
       valueKind = VK_LValue;
       type = type.getNonReferenceType();
       // FIXME: Support lambda-capture of BindingDecls, once CWG actually
       // decides how that's supposed to work.
       auto *BD = cast<BindingDecl>(VD);
       if (BD->getDeclContext()->isFunctionOrMethod() &&
           BD->getDeclContext() != CurContext)
-        diagnoseUncapturableValueReference(*this, Loc, BD, CurContext);
+        diagnoseUncapturableValueReference(*this, Loc, BD);
       break;
     }
         
     case Decl::Function: {
       if (unsigned BID = cast<FunctionDecl>(VD)->getBuiltinID()) {
         if (!Context.BuiltinInfo.isPredefinedLibFunction(BID)) {
           type = Context.BuiltinFnTy;
           valueKind = VK_RValue;
if (Param->hasUninstantiatedDefaultArg()) {
 
     ExprResult Result;
     {
       // C++ [dcl.fct.default]p5:
       //   The names in the [default argument] expression are bound, and
       //   the semantic constraints are checked, at the point where the
       //   default argument expression appears.
       ContextRAII SavedContext(*this, FD);
+      DefaultArgRAII DefaultArgContext(*this);
       LocalInstantiationScope Local(*this);
+
+      // Add mappings for instantiated parameters appearing before Param. This
+      // is needed to instantiate default argument expressions referencing
+      // other parameters in unevaluated contexts.
+      if (FunctionDecl *Pattern = FD->getTemplateInstantiationPattern()) {
+        auto I = FD->param_begin();
+        for (const auto *PVD : Pattern->parameters()) {
+          if (*I == Param)
+            break;
+
+          if (!PVD->isParameterPack()) {
+            CurrentInstantiationScope->InstantiatedLocal(PVD, *I++);
+            continue;
+          }
+
+          unsigned NumExpansions =
+              *getNumArgumentsInExpansion(PVD->getType(), MutiLevelArgList);
+          CurrentInstantiationScope->MakeInstantiatedLocalArgPack(PVD);
+          while (NumExpansions--)
+            CurrentInstantiationScope->InstantiatedLocalPackArg(PVD, *I++);
+        }
+      }
+
       Result = SubstInitializer(UninstExpr, MutiLevelArgList,
                                 /*DirectInit*/false);
     }
     if (Result.isInvalid())
       return true;
 
     // Check the expression as an initializer for the parameter.
     InitializedEntity Entity
else if (Func->getMostRecentDecl()->isInlined() &&
       UndefinedButUsed.insert(std::make_pair(Func->getCanonicalDecl(), Loc));
   }
 
   Func->markUsed(Context);
 }
 
 static void
 diagnoseUncapturableValueReference(Sema &S, SourceLocation loc,
-                                   ValueDecl *var, DeclContext *DC) {
+                                   ValueDecl *var, bool InDefaultArgExpr) {
   DeclContext *VarDC = var->getDeclContext();
 
   //  If the parameter still belongs to the translation unit, then
   //  we're actually just using one parameter in the declaration of
   //  the next.
-  if (isa<ParmVarDecl>(var) &&
+  if (!InDefaultArgExpr && isa<ParmVarDecl>(var) &&
       isa<TranslationUnitDecl>(VarDC))
     return;
 
   // For C code, don't diagnose about capture if we're not actually in code
   // right now; it's impossible to write a non-constant expression outside of
   // function context, so we'll get other (more useful) diagnostics later.
   //
   // For C++, things get a bit more nasty... it would be nice to suppress this
   // diagnostic for certain cases like using a local variable in an array bound
   // for a member of a local class, but the correct predicate is not obvious.
   if (!S.getLangOpts().CPlusPlus && !S.CurContext->isFunctionOrMethod())
     return;
 
   unsigned ValueKind = isa<BindingDecl>(var) ? 1 : 0;
   unsigned ContextKind = 3; // unknown
   if (isa<CXXMethodDecl>(VarDC) &&
       cast<CXXRecordDecl>(VarDC->getParent())->isLambda()) {
     ContextKind = 2;
   } else if (isa<FunctionDecl>(VarDC)) {
     ContextKind = 0;
   } else if (isa<BlockDecl>(VarDC)) {
     ContextKind = 1;
   }
 
+  if (InDefaultArgExpr) {
+    unsigned DiagID;
+    if (isa<ParmVarDecl>(var))
+      DiagID = diag::err_param_default_argument_references_param;
+    else
+      DiagID = diag::err_param_default_argument_references_local;
+    S.Diag(loc, DiagID) << var->getDeclName();
+  } else {
     S.Diag(loc, diag::err_reference_to_local_in_enclosing_context)
         << var << ValueKind << ContextKind << VarDC;
     S.Diag(var->getLocation(), diag::note_entity_declared_at)
         << var;
+  }
 
   // FIXME: Add additional diagnostic info about class etc. which prevents
   // capture.
 }
 
  
 static bool isVariableAlreadyCapturedInScopeInfo(CapturingScopeInfo *CSI, VarDecl *Var, 
                                       bool &SubCapturesAreNested,
if (Cap.isCopyCapture() &&
         !(isa<CapturedRegionScopeInfo>(CSI) &&
           cast<CapturedRegionScopeInfo>(CSI)->CapRegionKind == CR_OpenMP))
       DeclRefType.addConst();
     return true;
   }
   return false;
 }
 
+static bool invalidLocalVarReferenceInDefaultArg(VarDecl *Var, DeclContext *DC,
+                                                 Sema &S) {
+  return Var->hasLocalStorage() && DC == S.getParentOfDefaultArg();
+}
+
 // Only block literals, captured statements, and lambda expressions can
 // capture; other scopes don't work.
 static DeclContext *getParentOfCapturingContextOrNull(DeclContext *DC, VarDecl *Var, 
                                  SourceLocation Loc, 
                                  const bool Diagnose, Sema &S) {
-  if (isa<BlockDecl>(DC) || isa<CapturedDecl>(DC) || isLambdaCallOperator(DC))
-    return getLambdaAwareParentOfDeclContext(DC);
-  else if (Var->hasLocalStorage()) {
+  bool InDefaultArgExpr = false;
+
+  if (isa<BlockDecl>(DC) || isa<CapturedDecl>(DC) || isLambdaCallOperator(DC)) {
+    DeclContext *ParentContext = getLambdaAwareParentOfDeclContext(DC);
+    if (!invalidLocalVarReferenceInDefaultArg(Var, ParentContext, S))
+      return ParentContext;
+    InDefaultArgExpr = true;
+  }
+
+  if (Var->hasLocalStorage()) {
     if (Diagnose)
-       diagnoseUncapturableValueReference(S, Loc, Var, DC);
+       diagnoseUncapturableValueReference(S, Loc, Var, InDefaultArgExpr);
   }
   return nullptr;
 }
 
 // Certain capturing entities (lambdas, blocks etc.) are not allowed to capture 
 // certain types of variables (unnamed, variably modified types etc.)
 // so check for eligibility.
 static bool isVariableCapturable(CapturingScopeInfo *CSI, VarDecl *Var, 
while (FSIndex != MaxFunctionScopesIndex) {
       DC = getLambdaAwareParentOfDeclContext(DC);
       --FSIndex;
     }
   }
 
   
   // If the variable is declared in the current context, there is no need to
   // capture it.
-  if (VarDC == DC) return true;
+  if (VarDC == DC) {
+    // Emit diagnositics if Var is a local variable defined in a DeclContext
+    // enclosing a default argument.
+    if (BuildAndDiagnose &&
+        invalidLocalVarReferenceInDefaultArg(Var, DC, *this))
+      diagnoseUncapturableValueReference(*this, ExprLoc, Var, true);
+    return true;
+  }
 
   // Capture global variables if it is required to use private copy of this
   // variable.
   bool IsGlobal = !Var->hasLocalStorage();
   if (IsGlobal && !(LangOpts.OpenMP && IsOpenMPCapturedDecl(Var)))
     return true;
   Var = Var->getCanonicalDecl();
 
if (isGenericLambdaCallOperatorSpecialization(DC)) {
       if (BuildAndDiagnose) {
         LambdaScopeInfo *LSI = cast<LambdaScopeInfo>(CSI);   
         if (LSI->ImpCaptureStyle == CapturingScopeInfo::ImpCap_None) {
           Diag(ExprLoc, diag::err_lambda_impcap) << Var->getDeclName();
           Diag(Var->getLocation(), diag::note_previous_decl) 
              << Var->getDeclName();
           Diag(LSI->Lambda->getLocStart(), diag::note_lambda_decl);          
         } else
-          diagnoseUncapturableValueReference(*this, ExprLoc, Var, DC);
+          diagnoseUncapturableValueReference(*this, ExprLoc, Var);
       }
       return true;
     }
     // Certain capturing entities (lambdas, blocks etc.) are not allowed to capture 
     // certain types of variables (unnamed, variably modified types etc.)
     // so check for eligibility.
     if (!isVariableCapturable(CSI, Var, ExprLoc, BuildAndDiagnose, *this))
        return true;

test/CXX/dcl.decl/dcl.meaning/dcl.fct.default/p7.cpp

 // RUN: %clang_cc1 -fsyntax-only -verify %s
 
 void h()
 {
   int i;
+  // FIXME: There should be no warnings here. 'i' is referenced in an unevaluated
+  //        expression.
   extern void h2(int x = sizeof(i)); // expected-error {{default argument references local variable 'i' of enclosing function}}
 }

test/CXX/expr/expr.prim/expr.prim.lambda/p13.cpp

 // RUN: %clang_cc1 -std=c++11 %s -Wunused -Wno-unused-lambda-capture -verify
 
 void f2() {
   int i = 1;
-  void g1(int = ([i]{ return i; })()); // expected-error{{lambda expression in default argument cannot capture any entity}}
-  void g2(int = ([i]{ return 0; })()); // expected-error{{lambda expression in default argument cannot capture any entity}}
-  void g3(int = ([=]{ return i; })()); // expected-error{{lambda expression in default argument cannot capture any entity}}
+  void g1(int = ([i]{ return i; })()); // expected-error 2{{default argument references local variable 'i' of enclosing function}}
+  void g2(int = ([i]{ return 0; })()); // expected-error{{default argument references local variable 'i' of enclosing function}}
+  void g3(int = ([=]{ return i; })()); // expected-error{{default argument references local variable 'i' of enclosing function}}
   void g4(int = ([=]{ return 0; })());
   void g5(int = ([]{ return sizeof i; })());
 }
 
 namespace lambda_in_default_args {
   int f(int = [] () -> int { int n; return ++n; } ());
   template<typename T> T g(T = [] () -> T { T n; return ++n; } ());
   int k = f() + g<int>();
 }

test/SemaCXX/default1.cpp

 int pr20055_f(int x = 0, int y = UNDEFINED); // expected-error{{use of undeclared identifier}}
 int pr20055_v = pr20055_f(0);
 
 void PR20769() { void PR20769(int = 1); }
 void PR20769(int = 2);
 
 void PR20769_b(int = 1);
 void PR20769_b() { void PR20769_b(int = 2); }
+
+#if __cplusplus >= 201103L // C++11 or later
+struct S2 {
+  template<class T>
+  S2(T&&) {}
+};
+
+template<class T>
+void func0(int a0, S2 a1 = [](){ (void)&a0; }); // expected-error {{default argument references parameter 'a0'}}
+
+// FIXME: There shouldn't be any warnings about variables referenced in the
+//        controlling-expression or the expressions of the selections that are
+//        not chosen.
+template<class T>
+void func1(T a0, int a1, S2 a2 = _Generic((a0), default: [](){ (void)&a1; }, int: 0)); // expected-error {{default argument references parameter 'a0'}}
+
+template<class T>
+void func2(S2 a0 = [](){
+  int t; [&t](){ (void)&t;}();
+});
+
+template<class T>
+void func3(int a0, S2 a1 = [](){
+  [=](){ (void)&a0;}(); // expected-error {{default argument references parameter 'a0'}}
+});
+
+void func4(int, int);
+
+template<class...Ts>
+void func5(Ts...a0, S2 a1 = [](){ func4(a0...); }) { // expected-error 2 {{default argument references parameter 'a0'}}
+}
+
+template<class...Ts>
+void func6(Ts...a0, S2 a1 = [](){ (void)sizeof...(a0); }) {
+}
+
+double d;
+
+void test1() {
+  int i;
+  float f;
+  // FIXME: There shouldn't be any warnings about variables referenced in the
+  //        controlling-expression or the expressions of the selections that are
+  //        not chosen.
+  void foo0(int a0 = _Generic((f), double: d, float: f)); // expected-error 2 {{default argument references local variable 'f' of enclosing function}}
+  void foo1(int a0 = _Generic((d), double: d, float: f)); // expected-error {{default argument references local variable 'f' of enclosing function}}
+  void foo2(int a0 = _Generic((i), int: d, float: f)); // expected-error {{default argument references local variable 'i' of enclosing function}} expected-error {{default argument references local variable 'f' of enclosing function}}
+  void foo3(int a0 = _Generic((i), default: d, float: f)); // expected-error {{default argument references local variable 'i' of enclosing function}} expected-error {{default argument references local variable 'f' of enclosing function}}
+
+  void foo4(S2 a0 = [&](){ (void)&i; }); // expected-error {{default argument references local variable 'i' of enclosing function}}
+  void foo5(S2 a0 = [](){
+    // No warning about capture list of a lambda expression defined in a block scope.
+    int t; [&t](){ (void)&t;}();
+  });
+  void foo6(int a0, S2 a1 = [](){
+    // No warning about local variables or parameters referenced by an
+    // unevaluated expression.
+    int t = sizeof({i, a0, a1;});
+  });
+  void foo6(S2 a0 = [](){
+    int i;
+    void foo7(int a0,
+              S2 a1 = [](){ (void)&a0; }); // expected-error {{default argument references parameter 'a0'}}
+    void foo8(S2 a0 = [](){ (void)&i; }); // expected-error {{default argument references local variable 'i' of enclosing function}}
+  });
+
+  func0<int>(1); // expected-note {{in instantiation of default function argument expression for 'func0<int>' required here}}
+  func1<int>(1); // expected-error {{no matching function for call to 'func1'}}
+  func2<int>();
+  func3<int>(1); // expected-note {{in instantiation of default function argument expression for 'func3<int>' required}}
+  func5<int, int>(1, 2); // expected-note {{in instantiation of default function argument expression for 'func5<int, int>' required here}}
+  func6<int, int>(1, 2);
+
+}
+
+#endif

test/SemaObjCXX/blocks.mm

struct B1 { // expected-note 2 {{candidate constructor (the implicit}}
   B1(B0&&); // expected-note {{candidate constructor not viable}}
 };
 
 B1 test_move() {
   __block B0 b;
   return b; // expected-error {{no viable conversion from returned value of type 'MoveBlockVariable::B0' to function return type 'MoveBlockVariable::B1'}}
 }
 }
+
+namespace DefaultArg {
+void test() {
+  id x;
+  void func0(id a0, id a1 = ^{ (void)&a0; }); // expected-error {{default argument references parameter 'a0'}}
+  void func1(id a0, id a1 = ^{ (void)&x; }); // expected-error {{default argument references local variable 'x' of enclosing function}}
+  void func2(id a0, id a1 = ^{ (void)sizeof(a0); });
+  void func3(id a0 = ^{ (void)sizeof(x); });
+  void func4(id a0, id a1 = ^{
+    ^{ (void)&a0; }(); // expected-error {{default argument references parameter 'a0'}}
+    [=](){ (void)&a0; }(); // expected-error {{default argument references parameter 'a0'}}
+  });
+}
+}