Sema: Disallow taking the address of a bitfield coming from preincrement

[majnemer]

Summary

Clang forgot that '++s.m' was a bitfield l-value and permit it's address
to be taken; this would crash at CodeGen-time.

Instead, propagate the object-kind when we see the prefix
increment/decrement.

[rsmith]

LGTM

[majnemer]

Closed by commit rL214386 (authored by @majnemer).

lib/Sema/SemaExpr.cpp

static QualType CheckCommaOperands(Sema &S, ExprResult &LHS, ExprResult &RHS,
 
   return RHS.get()->getType();
 }
 
 /// CheckIncrementDecrementOperand - unlike most "Check" methods, this routine
 /// doesn't need to call UsualUnaryConversions or UsualArithmeticConversions.
 static QualType CheckIncrementDecrementOperand(Sema &S, Expr *Op,
                                                ExprValueKind &VK,
+                                               ExprObjectKind &OK,
                                                SourceLocation OpLoc,
                                                bool IsInc, bool IsPrefix) {
   if (Op->isTypeDependent())
     return S.Context.DependentTy;
 
   QualType ResType = Op->getType();
   // Atomic types can be used for increment / decrement where the non-atomic
   // versions can, so ignore the _Atomic() specifier for the purpose of
if (checkArithmeticIncompletePointerType(S, OpLoc, Op) ||
       return QualType();    
   } else if (ResType->isAnyComplexType()) {
     // C99 does not support ++/-- on complex types, we allow as an extension.
     S.Diag(OpLoc, diag::ext_integer_increment_complex)
       << ResType << Op->getSourceRange();
   } else if (ResType->isPlaceholderType()) {
     ExprResult PR = S.CheckPlaceholderExpr(Op);
     if (PR.isInvalid()) return QualType();
-    return CheckIncrementDecrementOperand(S, PR.get(), VK, OpLoc,
+    return CheckIncrementDecrementOperand(S, PR.get(), VK, OK, OpLoc,
                                           IsInc, IsPrefix);
   } else if (S.getLangOpts().AltiVec && ResType->isVectorType()) {
     // OK! ( C/C++ Language Extensions for CBEA(Version 2.6) 10.3 )
   } else if(S.getLangOpts().OpenCL && ResType->isVectorType() &&
             ResType->getAs<VectorType>()->getElementType()->isIntegerType()) {
     // OpenCL V1.2 6.3 says dec/inc ops operate on integer vector types.
   } else {
     S.Diag(OpLoc, diag::err_typecheck_illegal_increment_decrement)
       << ResType << int(IsInc) << Op->getSourceRange();
     return QualType();
   }
   // At this point, we know we have a real, complex or pointer type.
   // Now make sure the operand is a modifiable lvalue.
   if (CheckForModifiableLvalue(Op, OpLoc, S))
     return QualType();
   // In C++, a prefix increment is the same type as the operand. Otherwise
   // (in C or with postfix), the increment is the unqualified type of the
   // operand.
   if (IsPrefix && S.getLangOpts().CPlusPlus) {
     VK = VK_LValue;
+    OK = Op->getObjectKind();
     return ResType;
   } else {
     VK = VK_RValue;
     return ResType.getUnqualifiedType();
   }
 }
   
 
ExprResult Sema::CreateBuiltinUnaryOp(SourceLocation OpLoc,
   ExprValueKind VK = VK_RValue;
   ExprObjectKind OK = OK_Ordinary;
   QualType resultType;
   switch (Opc) {
   case UO_PreInc:
   case UO_PreDec:
   case UO_PostInc:
   case UO_PostDec:
-    resultType = CheckIncrementDecrementOperand(*this, Input.get(), VK, OpLoc,
+    resultType = CheckIncrementDecrementOperand(*this, Input.get(), VK, OK,
+                                                OpLoc,
                                                 Opc == UO_PreInc ||
                                                 Opc == UO_PostInc,
                                                 Opc == UO_PreInc ||
                                                 Opc == UO_PreDec);
     break;
   case UO_AddrOf:
     resultType = CheckAddressOfOperand(Input, OpLoc);
     break;

test/CXX/drs/dr3xx.cpp

namespace dr324 { // dr324: yes
   int &a = s.n; // expected-error {{non-const reference cannot bind to bit-field}}
   int *b = &s.n; // expected-error {{address of bit-field}}
   int &c = (s.n = 0); // expected-error {{non-const reference cannot bind to bit-field}}
   int *d = &(s.n = 0); // expected-error {{address of bit-field}}
   int &e = true ? s.n : s.n; // expected-error {{non-const reference cannot bind to bit-field}}
   int *f = &(true ? s.n : s.n); // expected-error {{address of bit-field}}
   int &g = (void(), s.n); // expected-error {{non-const reference cannot bind to bit-field}}
   int *h = &(void(), s.n); // expected-error {{address of bit-field}}
+  int *i = &++s.n; // expected-error {{address of bit-field}}
 }
 
 namespace dr326 { // dr326: yes
   struct S {};
   int test[__is_trivially_constructible(S, const S&) ? 1 : -1];
 }
 
 namespace dr327 { // dr327: dup 538