dynamic_cast in constant evaluation requires public bases [GH #398]

The run-time checks of a dynamic_cast during constant evaluation now require
the operand to be a public base class subobject of the most derived object
(and, for a cast to a sibling base class, the destination type to be a
public base class of the most derived type), instead of checking the
accessibility of the base classes in the context of the cast.  Also make the
derived-to-base shortcut for interpreter objects reachable (its condition was
inverted).

Author: daveedvdv-nvidia

src/interpret.c

@@ -26097,10 +26097,12 @@ represented by an entry of type a_constant (ck_address or ck_integer).
             new_con->variant.address.offset -=
                                             (a_targ_ptrdiff_t)prev_bcp->offset;
             if (type_is(tp, tk_void) ||
-                same_entities(tp, prev_bcp->derived_class)) {
+                (same_entities(tp, prev_bcp->derived_class) &&
+                 prev_bcp->has_public_derivation)) {
               /* A cast to the most-derived class (either by casting to void*
                  or because the destination type happens to match the most-
-                 derived class type). */
+                 derived class type, of which the operand is a public base
+                 class subobject). */
               remove_trailing_subobject_path_entry(new_con);
               clear_runtime_constant_address(result_storage, new_con);
               goto done;
@@ -26113,7 +26115,21 @@ represented by an entry of type a_constant (ck_address or ck_integer).
               bcdp = bcdp->next;
               for (; dsp != tail->next; dsp = dsp->next) {
                 if (same_entities(dsp->base_class->type, tp)) {
-                  if (new_bcp == NULL) {
+                  a_derivation_step_ptr  step;
+                  a_boolean              is_public_base = TRUE;
+                  /* The operand must be a public base class subobject of the
+                     destination subobject. */
+                  for (step = dsp->next; step != tail->next;
+                       step = step->next) {
+                    if (!step->base_class->has_public_derivation) {
+                      is_public_base = FALSE;
+                    }  /* if */
+                  }  /* for */
+                  if (!is_public_base) {
+                    /* Move on to the final strategy (which will fail too). */
+                    new_bcp = NULL;
+                    bcdp = NULL;
+                  } else if (new_bcp == NULL) {
                     new_bcp = dsp->base_class;
                   } else if (dsp->base_class != new_bcp) {
                     /* The subobject on the derivation path is not unambiguous.
@@ -26139,7 +26155,11 @@ represented by an entry of type a_constant (ck_address or ck_integer).
                                        &expr->position, new_bcp->type, ips);
                   }  /* if */
                   goto done;
-                } else if (!is_accessible_base_class(new_bcp)) {
+                } else if (!prev_bcp->has_public_derivation ||
+                           !new_bcp->has_public_derivation) {
+                  /* The operand must be a public base class subobject of the
+                     most-derived object, and the destination a public base
+                     class of the most-derived type. */
                   if (pointer_case) {
                     clear_address(result_storage, NULL);
                   } else {
@@ -26189,6 +26209,7 @@ represented by an entry of type a_constant (ck_address or ck_integer).
       a_base_class_ptr  bcp, baseward_bcp;
       a_type_ptr        dtp;
       a_byte            *subobj = opnd_addr->address;
+      a_boolean         is_public_base = TRUE;
       /* Check for the null address case first. */
       if (subobj == NULL) {
         /* Casting a null pointer value results in a null pointer value. */
@@ -26205,8 +26226,8 @@ represented by an entry of type a_constant (ck_address or ck_integer).
         do_constexpr_fail(result);
         goto done;
       }  /* if */
-      if (type_is(tp, tk_void) &&
-          (baseward_bcp = find_base_in_type(opnd_type, tp))!= NULL) {
+      if (!type_is(tp, tk_void) &&
+          (baseward_bcp = find_base_in_type(opnd_type, tp)) != NULL) {
         /* The dynamic cast is actually a (static) derived-to-base cast. */
         if (baseward_bcp->ambiguous) {
           do_constexpr_fail(result);
@@ -26230,13 +26251,17 @@ represented by an entry of type a_constant (ck_address or ck_integer).
         a_byte_count  offset;
         get_mapped_byte_count(&persistent_map, bcp, offset);
         result_addr->address -= offset;
+        if (!bcp->has_public_derivation) is_public_base = FALSE;
         dtp = bcp->derived_class;
         if (same_entities(dtp, tp)) {
           /* We found a derived subobject of the right type.  Since types with
              virtual bases cannot be literal types (and thus cannot be stored
              in interpreter memory), there is no concern about this being
-             ambiguous. */
-          goto done;
+             ambiguous.  The cast succeeds only if the operand is a public base
+             class subobject of it; otherwise, it also is not a public base
+             class subobject of the most-derived object, and so the cast fails
+             below. */
+          if (is_public_base) goto done;
         }  /* if */
         if (is_initialized(result_addr)) {
           bcp = *(a_base_class_ptr*)result_addr->address;
@@ -26253,11 +26278,13 @@ represented by an entry of type a_constant (ck_address or ck_integer).
         goto done;
       }  /* if */
       /* We've reached the most derived type (dtp) without encountering the
-         destination type.  This might still be a "sideways" cast. */
+         destination type as a class of which the operand is a public base
+         class subobject.  This might still be a "sideways" cast. */
       baseward_bcp = find_base_in_type(dtp, tp);
       if (baseward_bcp != NULL) {
         /* There is a subobject of the right kind: Verify that it is
-           unambiguous and accessible. */
+           unambiguous and that it and the operand are public base class
+           subobjects of the most-derived object. */
         if (baseward_bcp->ambiguous) {
           if (pointer_case) {
             clear_address(result_storage, NULL);
@@ -26267,7 +26294,7 @@ represented by an entry of type a_constant (ck_address or ck_integer).
                                &expr->position, tp, ips);
           }  /* if */
           goto done;
-        } else if (!is_accessible_base_class(baseward_bcp)) {
+        } else if (!is_public_base || !baseward_bcp->has_public_derivation) {
           if (pointer_case) {
             clear_address(result_storage, NULL);
           } else {

src/pending_changes/gh-398-dynamic-cast-public-base.txt

@@ -0,0 +1,18 @@
+[GH #398]
+dynamic_cast in constant evaluation requires public base class subobjects
+
+During constant evaluation, the run-time checks of a dynamic_cast did not
+require the operand to point to (or refer to) a public base class subobject
+of the most derived object, nor (for a cast to a sibling base class) the
+destination type to be a public base class of the most derived type.
+Instead, the accessibility of the base classes in the context of the cast
+was checked.  For example, with --c++20:
+
+  struct B { virtual void b() {} };
+  struct D : private B {};
+  struct F : D {};
+  constexpr F f;
+  static_assert(dynamic_cast<const D*>((const B*)&f) == nullptr);
+                                              // Previously failed.
+
+This is now fixed.

tests/expectations/edg_x86_64/imported.log

@@ -7076,7 +7076,6 @@ gnu/cpp/cpp2a/consteval13.sft.cpp:fp:-DTEST_NUMBER=1 --c++20:FAIL:
 gnu/cpp/cpp2a/consteval25.sft.cpp:fp:-DTEST_NUMBER=1 --c++20:FAIL:
 gnu/cpp/cpp2a/consteval32.sft.cpp:fn:-DTEST_NUMBER=1 --c++20:FAIL:
 gnu/cpp/cpp2a/constexpr-99287.sft.cpp:fp:-DTEST_NUMBER=1 --c++20:FAIL:
-gnu/cpp/cpp2a/constexpr-dynamic13.sft.cpp:fp:-DTEST_NUMBER=1 --c++20:FAIL:
 gnu/cpp/cpp2a/constexpr-init18.sft.cpp:fp:-DTEST_NUMBER=1 --c++20:FAIL:
 gnu/cpp/cpp2a/constexpr-inst1.sft.cpp:fn:-DTEST_NUMBER=1 --c++14:FAIL:
 gnu/cpp/cpp2a/constexpr-inst2.sft.cpp:fp:-DTEST_NUMBER=1 --c++11:FAIL:

tests/tests/changes/.gh-398.rto/default.1.1.txt

@@ -0,0 +1 @@
+fe_only -DTEST_NUMBER=1 --c++20 Test_name.c

tests/tests/changes/gh-398.sft.cpp

@@ -0,0 +1,61 @@
+//type:fp
+//options:--c++20
+//remark:[GH #398] The run-time checks of a dynamic_cast in constant
+//remark:evaluation require public base class subobjects
+
+// The run-time checks require public base class subobjects, independent of
+// access in the context of the cast.
+struct B { virtual void b() {} };
+struct C { virtual void c() {} };
+struct D : private B {
+  virtual void d() {}
+  constexpr const B* pb() const { return this; }
+};
+struct E { virtual void e() {} };
+struct F : D, E, private C {
+  virtual void f() {}
+  constexpr bool m() const {
+    return dynamic_cast<const F*>((const C*)this) == nullptr &&
+           dynamic_cast<const E*>((const C*)this) == nullptr;
+  }
+};
+
+constexpr F gf;
+// Each of the following three assertions previously failed.
+static_assert(dynamic_cast<const D*>((const B*)&gf) == nullptr);
+static_assert(dynamic_cast<const E*>((const B*)&gf) == nullptr);
+static_assert(dynamic_cast<const F*>((const C*)&gf) == nullptr);
+static_assert(dynamic_cast<const F*>((const D*)&gf) == &gf);
+static_assert(dynamic_cast<const F*>((const E*)&gf) == &gf);
+static_assert(dynamic_cast<const E*>((const D*)&gf) == &gf);
+static_assert(dynamic_cast<const void*>((const B*)&gf) == &gf);
+static_assert(gf.m());  // Previously failed.
+
+constexpr bool local() {
+  F f;
+  const B* pb = (const B*)&f;
+  const C* pc = (const C*)&f;
+  return dynamic_cast<const D*>(pb) == nullptr &&
+         dynamic_cast<const E*>(pb) == nullptr &&
+         dynamic_cast<const F*>(pc) == nullptr &&
+         dynamic_cast<const E*>(pc) == nullptr &&
+         dynamic_cast<const D*>(f.pb()) == nullptr &&
+         dynamic_cast<const F*>((const D*)&f) == &f &&
+         dynamic_cast<const E*>((const D*)&f) == &f &&
+         dynamic_cast<const D*>((const E*)&f) == &f &&
+         dynamic_cast<const void*>(pb) == &f &&
+         f.m();
+}
+static_assert(local());  // Previously failed.
+
+struct G : B {};
+struct H : G, E {};
+constexpr bool public_bases() {
+  H h;
+  const B* pb = &h;
+  return dynamic_cast<const G*>(pb) == &h &&
+         dynamic_cast<const H*>(pb) == &h &&
+         dynamic_cast<const E*>(pb) == &h &&
+         dynamic_cast<const B*>((const E*)&h) == pb;
+}
+static_assert(public_bases());

tests/tests/imported/clang/cpp/SemaCXX/.constant-expression-cxx2a.rto/default.1.1.txt

@@ -156,6 +156,13 @@ fe_only -DTEST_NUMBER=1 --clang -tused -e 200 --no_wrap_diagnostics --clang_vers
     static_assert(&dynamic_cast<A&>((D&)g) == &(A&)(B&)g);
                    ^
 
+"SemaCXX/constant-expression-cxx2a.cpp", line 274: error: expression must have a constant value
+    constexpr int e_f = (dynamic_cast<F&>((E&)g), 0);
+                        ^
+"SemaCXX/constant-expression-cxx2a.cpp", line 274: note: conversion to inaccessible base class "DynamicCast::F" is not allowed
+    constexpr int e_f = (dynamic_cast<F&>((E&)g), 0);
+                         ^
+
 "SemaCXX/constant-expression-cxx2a.cpp", line 278: error: expression must have a constant value
     constexpr int b_e = (dynamic_cast<E&>((B&)g), 0);
                         ^

tests/tests/imported/clang/cpp/SemaCXX/.constant-expression-cxx2a.rto/edg_x86_32.1.1.txt

@@ -156,6 +156,13 @@ fe_only -DTEST_NUMBER=1 --clang -tused -e 200 --no_wrap_diagnostics --clang_vers
     static_assert(&dynamic_cast<A&>((D&)g) == &(A&)(B&)g);
                    ^
 
+"SemaCXX/constant-expression-cxx2a.cpp", line 274: error: expression must have a constant value
+    constexpr int e_f = (dynamic_cast<F&>((E&)g), 0);
+                        ^
+"SemaCXX/constant-expression-cxx2a.cpp", line 274: note: conversion to inaccessible base class "DynamicCast::F" is not allowed
+    constexpr int e_f = (dynamic_cast<F&>((E&)g), 0);
+                         ^
+
 "SemaCXX/constant-expression-cxx2a.cpp", line 278: error: expression must have a constant value
     constexpr int b_e = (dynamic_cast<E&>((B&)g), 0);
                         ^

tests/tests/imported/clang/cpp/SemaCXX/.constant-expression-cxx2a.rto/edg_x86_32_cp.1.1.txt

@@ -156,20 +156,20 @@ fe_only -DTEST_NUMBER=1 --clang -tused -e 200 --no_wrap_diagnostics --clang_vers
     constexpr int d_a = (dynamic_cast<const A&>(static_cast<const D&>(g)), 0);
                          ^
 
-"SemaCXX/constant-expression-cxx2a.cpp", line 264: error: expression must have a constant value
-    static_assert(&dynamic_cast<A&>((B&)g) == &(A&)(B&)g);
-                  ^
-"SemaCXX/constant-expression-cxx2a.cpp", line 264: note: base class "DynamicCast::A" is ambiguous
-    static_assert(&dynamic_cast<A&>((B&)g) == &(A&)(B&)g);
-                   ^
-
 "SemaCXX/constant-expression-cxx2a.cpp", line 267: error: expression must have a constant value
     static_assert(&dynamic_cast<A&>((D&)g) == &(A&)(B&)g);
                   ^
 "SemaCXX/constant-expression-cxx2a.cpp", line 267: note: base class "DynamicCast::A" is ambiguous
     static_assert(&dynamic_cast<A&>((D&)g) == &(A&)(B&)g);
                    ^
 
+"SemaCXX/constant-expression-cxx2a.cpp", line 274: error: expression must have a constant value
+    constexpr int e_f = (dynamic_cast<F&>((E&)g), 0);
+                        ^
+"SemaCXX/constant-expression-cxx2a.cpp", line 274: note: conversion to inaccessible base class "DynamicCast::F" is not allowed
+    constexpr int e_f = (dynamic_cast<F&>((E&)g), 0);
+                         ^
+
 "SemaCXX/constant-expression-cxx2a.cpp", line 278: error: expression must have a constant value
     constexpr int b_e = (dynamic_cast<E&>((B&)g), 0);
                         ^

tests/tests/imported/clang/cpp/SemaCXX/.constant-expression-cxx2a.rto/edg_x86_64_cp.1.1.txt

@@ -156,20 +156,20 @@ fe_only -DTEST_NUMBER=1 --clang -tused -e 200 --no_wrap_diagnostics --clang_vers
     constexpr int d_a = (dynamic_cast<const A&>(static_cast<const D&>(g)), 0);
                          ^
 
-"SemaCXX/constant-expression-cxx2a.cpp", line 264: error: expression must have a constant value
-    static_assert(&dynamic_cast<A&>((B&)g) == &(A&)(B&)g);
-                  ^
-"SemaCXX/constant-expression-cxx2a.cpp", line 264: note: base class "DynamicCast::A" is ambiguous
-    static_assert(&dynamic_cast<A&>((B&)g) == &(A&)(B&)g);
-                   ^
-
 "SemaCXX/constant-expression-cxx2a.cpp", line 267: error: expression must have a constant value
     static_assert(&dynamic_cast<A&>((D&)g) == &(A&)(B&)g);
                   ^
 "SemaCXX/constant-expression-cxx2a.cpp", line 267: note: base class "DynamicCast::A" is ambiguous
     static_assert(&dynamic_cast<A&>((D&)g) == &(A&)(B&)g);
                    ^
 
+"SemaCXX/constant-expression-cxx2a.cpp", line 274: error: expression must have a constant value
+    constexpr int e_f = (dynamic_cast<F&>((E&)g), 0);
+                        ^
+"SemaCXX/constant-expression-cxx2a.cpp", line 274: note: conversion to inaccessible base class "DynamicCast::F" is not allowed
+    constexpr int e_f = (dynamic_cast<F&>((E&)g), 0);
+                         ^
+
 "SemaCXX/constant-expression-cxx2a.cpp", line 278: error: expression must have a constant value
     constexpr int b_e = (dynamic_cast<E&>((B&)g), 0);
                         ^

tests/tests/imported/gnu/cpp/cpp2a/.constexpr-dynamic13.rto/default.1.1.txt

@@ -1,66 +1 @@
 fe_only -DTEST_NUMBER=1 --gnu_version=999999 -tused -e 200 --no_wrap --no_wrap_diagnostics --c++20 Test_name.c
-"Test_name.c", line 25: error: static assertion failed
-  static_assert (dynamic_cast<D*> ((A*)&d) == nullptr);
-  ^
-
-"Test_name.c", line 26: error: static assertion failed
-  static_assert (dynamic_cast<D*> ((B*)&d) == nullptr);
-  ^
-
-"Test_name.c", line 28: error: static assertion failed
-  static_assert (dynamic_cast<C*> ((B*)&d) == nullptr);
-  ^
-
-"Test_name.c", line 31: error: static assertion failed
-  static_assert (dynamic_cast<DD*> ((A*)&dd) == nullptr);
-  ^
-
-"Test_name.c", line 32: error: static assertion failed
-  static_assert (dynamic_cast<DD*> ((B*)&dd) == nullptr);
-  ^
-
-"Test_name.c", line 35: error: static assertion failed
-  static_assert (dynamic_cast<DDD*> ((A*)&ddd) == nullptr);
-  ^
-
-"Test_name.c", line 36: error: static assertion failed
-  static_assert (dynamic_cast<DDD*> ((B*)&ddd) == nullptr);
-  ^
-
-"Test_name.c", line 37: error: static assertion failed
-  static_assert (dynamic_cast<CCC*> ((B*)&ddd) == nullptr);
-  ^
-
-"Test_name.c", line 46: error: static assertion failed
-  static_assert (dynamic_cast<E*> ((A*)(D*)&e) == nullptr);
-  ^
-
-"Test_name.c", line 47: error: static assertion failed
-  static_assert (dynamic_cast<E*> ((B*)(D*)&e) == nullptr);
-  ^
-
-"Test_name.c", line 53: error: static assertion failed
-  static_assert (dynamic_cast<EE*> ((A*)(D*)&ee) == nullptr);
-  ^
-
-"Test_name.c", line 54: error: static assertion failed
-  static_assert (dynamic_cast<EE*> ((B*)(D*)&ee) == nullptr);
-  ^
-
-"Test_name.c", line 70: error: static assertion failed
-  static_assert (dynamic_cast<XX*>((B*)(CC*)(E*)&xx) == nullptr);	
-  ^
-
-"Test_name.c", line 73: error: static assertion failed
-  static_assert (dynamic_cast<Y*>((B*)&y) == nullptr);
-  ^
-
-"Test_name.c", line 74: error: static assertion failed
-  static_assert (dynamic_cast<Y*>((A*)(B*)&y) == nullptr);
-  ^
-
-"Test_name.c", line 82: error: static assertion failed
-  static_assert (dynamic_cast<CC*> ((B*)(D*)&e) == nullptr);
-  ^
-
-16 errors detected in the compilation of "Test_name.c".