{"id":2223661,"url":"http://patchwork.ozlabs.org/api/1.1/patches/2223661/?format=json","web_url":"http://patchwork.ozlabs.org/project/gcc/patch/20260415224602.1507107-1-polacek@redhat.com/","project":{"id":17,"url":"http://patchwork.ozlabs.org/api/1.1/projects/17/?format=json","name":"GNU Compiler Collection","link_name":"gcc","list_id":"gcc-patches.gcc.gnu.org","list_email":"gcc-patches@gcc.gnu.org","web_url":null,"scm_url":null,"webscm_url":null},"msgid":"<20260415224602.1507107-1-polacek@redhat.com>","date":"2026-04-15T22:46:02","name":"c++/reflection: detect bad splices in class member access [PR124614]","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"2290270548af2dbcf71a7adef2c222e7493e53fb","submitter":{"id":14370,"url":"http://patchwork.ozlabs.org/api/1.1/people/14370/?format=json","name":"Marek Polacek","email":"polacek@redhat.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/gcc/patch/20260415224602.1507107-1-polacek@redhat.com/mbox/","series":[{"id":500050,"url":"http://patchwork.ozlabs.org/api/1.1/series/500050/?format=json","web_url":"http://patchwork.ozlabs.org/project/gcc/list/?series=500050","date":"2026-04-15T22:46:02","name":"c++/reflection: detect bad splices in class member access [PR124614]","version":1,"mbox":"http://patchwork.ozlabs.org/series/500050/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2223661/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2223661/checks/","tags":{},"headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","gcc-patches@gcc.gnu.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","gcc-patches@gcc.gnu.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (1024-bit key;\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=BIfiW269;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=gcc.gnu.org\n (client-ip=2620:52:6:3111::32; helo=vm01.sourceware.org;\n envelope-from=gcc-patches-bounces~incoming=patchwork.ozlabs.org@gcc.gnu.org;\n receiver=patchwork.ozlabs.org)","sourceware.org;\n\tdkim=pass (1024-bit key,\n unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256\n header.s=mimecast20190719 header.b=BIfiW269","sourceware.org; dmarc=pass (p=quarantine dis=none)\n header.from=redhat.com","sourceware.org; spf=pass smtp.mailfrom=redhat.com","server2.sourceware.org;\n arc=none smtp.remote-ip=170.10.129.124"],"Received":["from vm01.sourceware.org (vm01.sourceware.org\n [IPv6:2620:52:6:3111::32])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fwx8j6dV3z1yG9\n\tfor ; Thu, 16 Apr 2026 08:46:44 +1000 (AEST)","from vm01.sourceware.org (localhost [127.0.0.1])\n\tby sourceware.org (Postfix) with ESMTP id AB5FC4BA2E1F\n\tfor ; Wed, 15 Apr 2026 22:46:42 +0000 (GMT)","from us-smtp-delivery-124.mimecast.com\n (us-smtp-delivery-124.mimecast.com [170.10.129.124])\n by sourceware.org (Postfix) with ESMTP id 1F4CE4BA2E0E\n for ; Wed, 15 Apr 2026 22:46:14 +0000 (GMT)","from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com\n (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by\n relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3,\n cipher=TLS_AES_256_GCM_SHA384) id us-mta-169-85MbJYVwOA-ExJhp_4-C-Q-1; Wed,\n 15 Apr 2026 18:46:12 -0400","from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com\n (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS\n id 49C0C18003F6\n for ; Wed, 15 Apr 2026 22:46:11 +0000 (UTC)","from pdp-11.redhat.com (unknown [10.22.81.27])\n by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP\n id 77F7319560B1; Wed, 15 Apr 2026 22:46:10 +0000 (UTC)"],"DKIM-Filter":["OpenDKIM Filter v2.11.0 sourceware.org AB5FC4BA2E1F","OpenDKIM Filter v2.11.0 sourceware.org 1F4CE4BA2E0E"],"DMARC-Filter":"OpenDMARC Filter v1.4.2 sourceware.org 1F4CE4BA2E0E","ARC-Filter":"OpenARC Filter v1.0.0 sourceware.org 1F4CE4BA2E0E","ARC-Seal":"i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1776293174; cv=none;\n b=S/jJy/UEigxNSqk3ipBCvyMzwO1Lc8Wqt9xAkZoK5VwhoGw2UOnwydy11V1bS864nBe513nbyK2VOEACLfiP+cwoHlwG9GY2mMTxxFdBIXg/MhjnQe9YfQC+zwpT60l1L8mGZyVaFV9ND6rV295lwPnU9PWUCe+Yayc7vghDpCw=","ARC-Message-Signature":"i=1; a=rsa-sha256; d=sourceware.org; s=key;\n t=1776293174; c=relaxed/simple;\n bh=pyc5eFn/ILNaa0IgGZUjru9jMIkHQqioiif0ObVcgpY=;\n h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version;\n b=YwxpAA+hDN2UjkNYV9gT3x2UBlkFZs02W4GBXzlfjplkM3MVTZuSIse38ePPbwpMtSqsIGchEhEKZ8R0Bxx+b+Wq+GwjS2TqDa++oI/gONcPqikBbXOkWYQ+k+TH8OITrLzCUyOq+wx9Uk/ju8HyPSzOgc60e7jYVsDeF8g4Zpk=","ARC-Authentication-Results":"i=1; server2.sourceware.org","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com;\n s=mimecast20190719; t=1776293173;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:mime-version:mime-version:content-type:content-type:\n content-transfer-encoding:content-transfer-encoding;\n bh=9zESVZMVhPRX7eLS3J4OVXzjdl4KCltA03bB6ReiByg=;\n b=BIfiW269bEz1HEoO3uU97oITSmkadrETs+NB+8izU/uLpAKRytkL1h6RW07zkLxfU2xm78\n QehL5yzABuMIPGoibPiQZJCwpRb8/xHjJB+afQDBJoiSo+du9MjL2Gdcv2WNZadJw7ASIy\n Y6CnONMSOANk8W4WnI+XlXW4+dQ2tp4=","X-MC-Unique":"85MbJYVwOA-ExJhp_4-C-Q-1","X-Mimecast-MFC-AGG-ID":"85MbJYVwOA-ExJhp_4-C-Q_1776293171","From":"Marek Polacek ","To":"GCC Patches , Jason Merrill ,\n Jakub Jelinek ","Subject":"[PATCH] c++/reflection: detect bad splices in class member access\n [PR124614]","Date":"Wed, 15 Apr 2026 18:46:02 -0400","Message-ID":"<20260415224602.1507107-1-polacek@redhat.com>","MIME-Version":"1.0","X-Scanned-By":"MIMEDefang 3.0 on 10.30.177.12","X-Mimecast-Spam-Score":"0","X-Mimecast-MFC-PROC-ID":"NbXjln0dJfiBXTTBQmpPyYqSBGOg9JALyhzMVuo9aRY_1776293171","X-Mimecast-Originator":"redhat.com","Content-Transfer-Encoding":"8bit","content-type":"text/plain; charset=\"US-ASCII\"; x-default=true","X-BeenThere":"gcc-patches@gcc.gnu.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Gcc-patches mailing list ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"gcc-patches-bounces~incoming=patchwork.ozlabs.org@gcc.gnu.org"},"content":"Bootstrapped/regtested on x86_64-pc-linux-gnu, ok for trunk?\n\n-- >8 --\nThis testcase shows that we still don't detect some invalid splices\nused in a class member access. E.g. in,\n\n b.[:reflect_constant (^^B::id):];\n\nthe splice designates a reflection which cannot be used in obj.[:R:].\nWe can enhance check_splice_expr to check for exactly those codes\nthat can be handled. This is also an opportunity to finally factor\nour the long splice_p checks into a helper.\n\nIt can also be something like\n\n b.[:reflect_constant (data_member_spec (^^int, { .name = \"i\" })):];\n\nwhere we don't correctly print the RHS, thus the dump_data_member_spec\naddition.\n\n\tPR c++/124614\n\ngcc/cp/ChangeLog:\n\n\t* cp-tree.h (valid_splice_for_member_access_p): Declare.\n\t(dump_data_member_spec): Declare.\n\t* error.cc (dump_expr) : Print a data member\n\tdescription.\n\t* pt.cc (tsubst_splice_expr): Use valid_splice_for_member_access_p.\n\t* reflect.cc (dump_data_member_spec): New.\n\t(eval_display_string_of): Use it.\n\t(valid_splice_for_member_access_p): New.\n\t(check_splice_expr): Check that we got\n\tvalid_splice_for_member_access_p for a member access.\n\t* typeck.cc (finish_class_member_access_expr): Use\n\tvalid_splice_for_member_access_p.\n\ngcc/testsuite/ChangeLog:\n\n\t* g++.dg/reflect/member23.C: New test.\n---\n gcc/cp/cp-tree.h | 3 ++\n gcc/cp/error.cc | 7 ++++\n gcc/cp/pt.cc | 10 +----\n gcc/cp/reflect.cc | 56 ++++++++++++++++++++-----\n gcc/cp/typeck.cc | 24 ++---------\n gcc/testsuite/g++.dg/reflect/member23.C | 24 +++++++++++\n 6 files changed, 84 insertions(+), 40 deletions(-)\n create mode 100644 gcc/testsuite/g++.dg/reflect/member23.C\n\n\nbase-commit: 77d4080e1e5f9d467816e2e2e878edbfbb7ee1c1","diff":"diff --git a/gcc/cp/cp-tree.h b/gcc/cp/cp-tree.h\nindex c5a3a6bd39b..47e4dd27e90 100644\n--- a/gcc/cp/cp-tree.h\n+++ b/gcc/cp/cp-tree.h\n@@ -9436,6 +9436,8 @@ extern bool consteval_only_p (tree) ATTRIBUTE_PURE;\n extern bool compare_reflections (tree, tree) ATTRIBUTE_PURE;\n extern bool valid_splice_type_p (const_tree) ATTRIBUTE_PURE;\n extern bool valid_splice_scope_p (const_tree) ATTRIBUTE_PURE;\n+extern bool valid_splice_for_member_access_p (const_tree, bool = true)\n+ ATTRIBUTE_PURE;\n extern bool check_splice_expr (location_t, location_t, tree, bool, bool, bool,\n \t\t\t bool, bool) ATTRIBUTE_PURE;\n extern tree make_splice_scope (tree, bool);\n@@ -9443,6 +9445,7 @@ extern bool dependent_splice_p (const_tree) ATTRIBUTE_PURE;\n extern tree reflection_mangle_prefix (tree, char [3]);\n extern void check_consteval_only_fn (tree);\n extern bool reflection_function_template_p (tree) ATTRIBUTE_PURE;\n+extern void dump_data_member_spec (pretty_printer *, tree);\n \n /* Inline bodies. */\n \ndiff --git a/gcc/cp/error.cc b/gcc/cp/error.cc\nindex b3e66924e31..e7121dc1017 100644\n--- a/gcc/cp/error.cc\n+++ b/gcc/cp/error.cc\n@@ -3337,6 +3337,13 @@ dump_expr (cxx_pretty_printer *pp, tree t, int flags)\n \t dump_decl (pp, h, flags);\n \telse if (TYPE_P (h))\n \t dump_type (pp, h, flags);\n+\telse if (TREE_CODE (h) == TREE_VEC)\n+\t {\n+\t pp_format_decoder (pp) = cp_printer;\n+\t pp->set_format_postprocessor\n+\t (std::make_unique ());\n+\t dump_data_member_spec (pp, h);\n+\t }\n \telse\n \t dump_expr (pp, h, flags);\n \tbreak;\ndiff --git a/gcc/cp/pt.cc b/gcc/cp/pt.cc\nindex 6fb26cd9777..2828f87f12a 100644\n--- a/gcc/cp/pt.cc\n+++ b/gcc/cp/pt.cc\n@@ -16969,15 +16969,7 @@ tsubst_splice_expr (tree t, tree args, tsubst_flags_t complain, tree in_decl)\n cp_parser_postfix_dot_deref_expression wants to see only\n certain kind of entities. */\n if (SPLICE_EXPR_MEMBER_ACCESS_P (t))\n- gcc_assert (TREE_CODE (op) == FIELD_DECL\n-\t\t|| VAR_P (op)\n-\t\t|| TREE_CODE (op) == CONST_DECL\n-\t\t|| TREE_CODE (op) == FUNCTION_DECL\n-\t\t|| DECL_FUNCTION_TEMPLATE_P (OVL_FIRST (op))\n-\t\t|| variable_template_p (op)\n-\t\t|| BASELINK_P (op)\n-\t\t|| TREE_CODE (op) == TEMPLATE_ID_EXPR\n-\t\t|| TREE_CODE (op) == TREE_BINFO);\n+ gcc_assert (valid_splice_for_member_access_p (op, /*decls_only_p=*/false));\n \n return op;\n }\ndiff --git a/gcc/cp/reflect.cc b/gcc/cp/reflect.cc\nindex f06353305a5..2b7e7033953 100644\n--- a/gcc/cp/reflect.cc\n+++ b/gcc/cp/reflect.cc\n@@ -3679,6 +3679,21 @@ eval_identifier_of (location_t loc, const constexpr_ctx *ctx, tree r,\n return build_cplus_new (ret_type, ret, tf_warning_or_error);\n }\n \n+/* Display R, which is a data member description. */\n+\n+void\n+dump_data_member_spec (pretty_printer *pp, tree r)\n+{\n+ pp_printf (pp, \"(%T, %E, %E, %E, %s, {\", TREE_VEC_ELT (r, 0),\n+\t TREE_VEC_ELT (r, 1), TREE_VEC_ELT (r, 2), TREE_VEC_ELT (r, 3),\n+\t TREE_VEC_ELT (r, 4) == boolean_true_node\n+\t ? \"true\" : \"false\");\n+ for (int i = 5; i < TREE_VEC_LENGTH (r); ++i)\n+ pp_printf (pp, \"%s%E\", i == 5 ? \"\" : \", \",\n+\t REFLECT_EXPR_HANDLE (TREE_VEC_ELT (r, i)));\n+ pp_printf (pp, \"})\");\n+}\n+\n /* Process std::meta::{,u8}display_string_of.\n Returns: An implementation-defined string_view or u8string_view,\n respectively.\n@@ -3738,16 +3753,7 @@ eval_display_string_of (location_t loc, const constexpr_ctx *ctx, tree r,\n pp_printf (&pp, \"%T: %T\", d, BINFO_TYPE (r));\n }\n else if (kind == REFLECT_DATA_MEMBER_SPEC)\n- {\n- pp_printf (&pp, \"(%T, %E, %E, %E, %s, {\", TREE_VEC_ELT (r, 0),\n-\t\t TREE_VEC_ELT (r, 1), TREE_VEC_ELT (r, 2), TREE_VEC_ELT (r, 3),\n-\t\t TREE_VEC_ELT (r, 4) == boolean_true_node\n-\t\t ? \"true\" : \"false\");\n- for (int i = 5; i < TREE_VEC_LENGTH (r); ++i)\n-\tpp_printf (&pp, \"%s%E\", i == 5 ? \"\" : \", \",\n-\t\t REFLECT_EXPR_HANDLE (TREE_VEC_ELT (r, i)));\n- pp_printf (&pp, \"})\");\n- }\n+ dump_data_member_spec (&pp, r);\n else if (eval_is_annotation (r, kind) == boolean_true_node)\n pp_printf (&pp, \"[[=%E]]\",\n \t tree_strip_any_location_wrapper (TREE_VALUE (TREE_VALUE (r))));\n@@ -8874,6 +8880,28 @@ valid_splice_scope_p (const_tree t)\n \t || TREE_CODE (t) == NAMESPACE_DECL);\n }\n \n+/* Return true if T is a valid result of the splice in a class member access,\n+ as in obj.[:R:]. If DECLS_ONLY_P, only certain decls are OK. */\n+\n+bool\n+valid_splice_for_member_access_p (const_tree t, bool decls_only_p/*=true*/)\n+{\n+ if (TREE_CODE (t) == FIELD_DECL\n+ || VAR_P (t)\n+ || TREE_CODE (t) == CONST_DECL\n+ || TREE_CODE (t) == FUNCTION_DECL\n+ || DECL_FUNCTION_TEMPLATE_P (OVL_FIRST (const_cast (t)))\n+ || variable_template_p (const_cast (t)))\n+ return true;\n+\n+ if (decls_only_p)\n+ return false;\n+\n+ return (BASELINK_P (t)\n+\t || TREE_CODE (t) == TEMPLATE_ID_EXPR\n+\t || TREE_CODE (t) == TREE_BINFO);\n+}\n+\n /* Check a function DECL for CWG 3115: Every function of consteval-only\n type shall be an immediate function. */\n \n@@ -8974,6 +9002,14 @@ check_splice_expr (location_t loc, location_t start_loc, tree t,\n return false;\n }\n \n+ if (member_access_p\n+ && !valid_splice_for_member_access_p (t, /*decls_only_p=*/false))\n+ {\n+ if (complain_p)\n+\terror_at (loc, \"cannot use %qE to access a class member\", t);\n+ return false;\n+ }\n+\n /* [expr.unary.op]/3.1 \"If the operand [of unary &] is a qualified-id or\n splice-expression designating a non-static member m, other than an\n explicit object member function, m shall be a direct member of some\ndiff --git a/gcc/cp/typeck.cc b/gcc/cp/typeck.cc\nindex c241721832c..dcc35ae28a2 100644\n--- a/gcc/cp/typeck.cc\n+++ b/gcc/cp/typeck.cc\n@@ -3594,13 +3594,7 @@ finish_class_member_access_expr (cp_expr object, tree name, bool template_p,\n \t return error_mark_node;\n \t }\n \t}\n- else if (splice_p\n-\t && (TREE_CODE (name) == FIELD_DECL\n-\t\t || VAR_P (name)\n-\t\t || TREE_CODE (name) == CONST_DECL\n-\t\t || TREE_CODE (name) == FUNCTION_DECL\n-\t\t || DECL_FUNCTION_TEMPLATE_P (OVL_FIRST (name))\n-\t\t || variable_template_p (name)))\n+ else if (splice_p && valid_splice_for_member_access_p (name))\n \t{\n \t scope = context_for_name_lookup (OVL_FIRST (name));\n \t if (!CLASS_TYPE_P (scope))\n@@ -3664,14 +3658,7 @@ finish_class_member_access_expr (cp_expr object, tree name, bool template_p,\n \t gcc_assert (CLASS_TYPE_P (scope));\n \t gcc_assert (identifier_p (name)\n \t\t || TREE_CODE (name) == BIT_NOT_EXPR\n-\t\t || (splice_p\n-\t\t\t && (TREE_CODE (name) == FIELD_DECL\n-\t\t\t || VAR_P (name)\n-\t\t\t || TREE_CODE (name) == CONST_DECL\n-\t\t\t || TREE_CODE (name) == FUNCTION_DECL\n-\t\t\t || DECL_FUNCTION_TEMPLATE_P\n-\t\t\t\t\t\t(OVL_FIRST (name))\n-\t\t\t || variable_template_p (name))));\n+\t\t || (splice_p && valid_splice_for_member_access_p (name)));\n \n \t if (constructor_name_p (name, scope))\n \t {\n@@ -3723,12 +3710,7 @@ finish_class_member_access_expr (cp_expr object, tree name, bool template_p,\n \t goto dependent;\n \t member = lookup_destructor (object, scope, name, complain);\n \t}\n- else if (splice_p && (TREE_CODE (name) == FIELD_DECL\n-\t\t\t || VAR_P (name)\n-\t\t\t || TREE_CODE (name) == CONST_DECL\n-\t\t\t || TREE_CODE (name) == FUNCTION_DECL\n-\t\t\t || DECL_FUNCTION_TEMPLATE_P (OVL_FIRST (name))\n-\t\t\t || variable_template_p (name)))\n+ else if (splice_p && valid_splice_for_member_access_p (name))\n \t{\n \t member = name;\n \t name = OVL_FIRST (name);\ndiff --git a/gcc/testsuite/g++.dg/reflect/member23.C b/gcc/testsuite/g++.dg/reflect/member23.C\nnew file mode 100644\nindex 00000000000..e38d70e38ef\n--- /dev/null\n+++ b/gcc/testsuite/g++.dg/reflect/member23.C\n@@ -0,0 +1,24 @@\n+// PR c++/124614\n+// { dg-do compile { target c++26 } }\n+// { dg-additional-options \"-freflection\" }\n+\n+#include \n+using namespace std::meta;\n+\n+struct B { int id; };\n+\n+void\n+f (int p)\n+{\n+ B b;\n+ b.[:reflect_constant (^^B::id):]; // { dg-error \"access a class member\" }\n+ b.[:reflect_constant (&B::id):]; // { dg-error \"access a class member\" }\n+ b.[:reflect_constant (data_member_spec (^^int, { .name = \"i\" })):]; // { dg-error \"access a class member\" }\n+ b.[:reflect_constant (false):]; // { dg-error \"access a class member\" }\n+ b.[:reflect_constant (42):];\t // { dg-error \"access a class member\" }\n+ b.[:reflect_constant (3.14f):]; // { dg-error \"access a class member\" }\n+ b.[:reflect_constant (&::f):]; // { dg-error \"access a class member\" }\n+ b.[:reflect_constant (^^::):]; // { dg-error \"access a class member\" }\n+ b.[:reflect_constant (info{}):]; // { dg-error \"access a class member\" }\n+ b.[:reflect_constant (^^p):];\t // { dg-error \"access a class member\" }\n+}\n","prefixes":[]}