On Fri, Jul 24, 2026 at 02:02:25PM -0400, Jason Merrill wrote: > Hmm, yes, because e.g. in constexpr-base2a.C the A subobject is at a > non-zero offset so there isn't a B at that address. > > This seems to indicate that we're representing the conversion badly. > > This is because the cp_fold_convert in build_static_cast_1 turns > NOP_EXPR (B&, NOP_EXPR (B*, POINTER_PLUS_EXPR (NOP_EXPR (A*, a), -4))) > into > POINTER_PLUS_EXPR (NOP_EXPR (B&, a), -4) > so the NOP_EXPR is now an invalid downcast that the patch diagnoses.
Here is an updated patch, which 1) has slightly different wording mostly as you suggested, I have just used the pointed or referenced type rather than a pointer (what would be printed in the reference case anyway?) 2) in cp_fold_convert I've stopped using fold_convert for the INDIRECT_TYPE_P to INDIRECT_TYPE_P casts so that we avoid the Convert (T1)(X p+ Y) into ((T1)X p+ Y), for pointer type, when ... problematic fold-const.cc optimization, instead it optimizes just some simple cases 3) had to move -fsanitize=null checking for references on nullptr in order not to regress one ubsan testcase Bootstrapped successfull on both x86_64-linux and i686-linux, but has one regression on both: FAIL: std/ranges/adaptors/slide/1.cc -std=gnu++23 (test for excess errors) Excess errors: /home/jakub/src/gcc/libstdc++-v3/testsuite/std/ranges/adaptors/slide/1.cc:110: error: non-constant condition for static assertion /home/jakub/src/gcc/obj74/x86_64-pc-linux-gnu/libstdc++-v3/include/bits/ranges_base.h:1016: error: '(((((int*)(& x)) + 12) - (((int*)(& x)) + 4)) / 4)' is not a constant expression and ditto with -std=gnu++29. I'm afraid something relies on some of the fold_convert optimizations, dunno if we should try harder during POINTER_DIFF_EXPR folding or what. 2026-07-27 Jakub Jelinek <[email protected]> * constexpr.cc (cxx_eval_constant_expression) <case CONVERT_EXPR>: Set *non_constant_p and optionally diagnose if a static_cast downcast results in undefined behavior. * cvt.cc (cp_fold_convert): If both type is a pointer/reference type and expr has pointer/reference type, avoid using fold_convert and instead either just build a NOP_EXPR or ADDR_SPACE_CONVERT_EXPR or optimize useless intermediate cast. * typeck.cc (build_static_cast_1): Move COND_EXPR reference binding to NULL instrumentation before cp_fold_convert call and allow the type to be a pointer rather than reference, as long as its TREE_TYPE is the expected one. * g++.dg/cpp0x/constexpr-static-cast1.C: New test. * g++.dg/cpp0x/constexpr-static-cast2.C: New test. * g++.dg/cpp1y/constexpr-static-cast1.C: New test. * g++.dg/cpp1y/constexpr-static-cast2.C: New test. * g++.dg/cpp1y/constexpr-static-cast3.C: New test. --- gcc/cp/constexpr.cc.jj 2026-07-27 13:18:42.334001621 +0200 +++ gcc/cp/constexpr.cc 2026-07-27 17:24:34.504056271 +0200 @@ -10259,6 +10259,53 @@ cxx_eval_constant_expression (const cons } } + /* [expr.static.cast]/10: A prvalue of type "pointer to cv1 B", where + B is a class type, can be converted to a prvalue of type + "pointer to cv2 D", where D is a complete class derived from B, ... + If the prvalue of type "pointer to cv1 B" points to a B that is + actually a base class subobject of an object of type D, the + resulting pointer points to the enclosing object of type D. + Otherwise, the behavior is undefined. + Similarly [expr.static.cast]/2 for references. */ + if (INDIRECT_TYPE_P (type) + && INDIRECT_TYPE_P (TREE_TYPE (op)) + && COMPLETE_TYPE_P (TREE_TYPE (type)) + && !integer_zerop (op) + && is_properly_derived_from (TREE_TYPE (type), + TREE_TYPE (TREE_TYPE (op)))) + { + tree sop = tree_strip_nop_conversions (op); + if (cxx_fold_indirect_ref (ctx, loc, TREE_TYPE (type), sop, + NULL, jump_target) == NULL_TREE) + { + tree dyntype = NULL_TREE; + if (!ctx->quiet && TREE_CODE (sop) == ADDR_EXPR) + { + sop = TREE_OPERAND (sop, 0); + while (TREE_CODE (sop) == COMPONENT_REF + && DECL_FIELD_IS_BASE (TREE_OPERAND (sop, 1))) + sop = TREE_OPERAND (sop, 0); + dyntype = strip_array_types (TREE_TYPE (sop)); + if (same_type_p (dyntype, TREE_TYPE (TREE_TYPE (op)))) + dyntype = NULL_TREE; + } + if (!ctx->quiet) + { + if (dyntype) + error_at (loc, "%qT operand (of dynamic type %qT) is " + "not a base class subobject of a %qT object", + TREE_TYPE (TREE_TYPE (op)), dyntype, + TREE_TYPE (type)); + else + error_at (loc, "%qT operand is not a base class " + "subobject of a %qT object", + TREE_TYPE (TREE_TYPE (op)), TREE_TYPE (type)); + } + *non_constant_p = true; + return t; + } + } + if (TREE_CODE (op) == PTRMEM_CST && !TYPE_PTRMEM_P (type)) { op = cplus_expand_constant (op); --- gcc/cp/cvt.cc.jj 2026-07-13 18:32:06.112290290 +0200 +++ gcc/cp/cvt.cc 2026-07-27 16:50:13.902406965 +0200 @@ -639,7 +639,30 @@ cp_fold_convert (tree type, tree expr) } else { - conv = fold_convert (type, expr); + /* E.g. the GENERIC (T1)(X p+ Y) into ((T1)X p+ Y) optimization + is harmful for constant evaluation, because there can + be a cast to a type on an address which doesn't have valid + object of the type pointed to by T1. For pointer/reference + casts just handle the most common cases. */ + if (INDIRECT_TYPE_P (type) + && INDIRECT_TYPE_P (TREE_TYPE (expr))) + { + if (TYPE_ADDR_SPACE (TREE_TYPE (type)) + != TYPE_ADDR_SPACE (TREE_TYPE (TREE_TYPE (expr)))) + conv = build1 (ADDR_SPACE_CONVERT_EXPR, type, expr); + else if (CONVERT_EXPR_P (expr) + && INDIRECT_TYPE_P (TREE_TYPE (TREE_OPERAND (expr, 0)))) + { + if (TREE_TYPE (TREE_OPERAND (expr, 0)) == type) + conv = TREE_OPERAND (expr, 0); + else + conv = build1 (NOP_EXPR, type, TREE_OPERAND (expr, 0)); + } + else + conv = build1 (NOP_EXPR, type, expr); + } + else + conv = fold_convert (type, expr); conv = ignore_overflows (conv, expr); } --- gcc/cp/typeck.cc.jj 2026-07-27 12:45:24.363871030 +0200 +++ gcc/cp/typeck.cc 2026-07-27 18:48:08.821251413 +0200 @@ -8851,6 +8851,17 @@ build_static_cast_1 (location_t loc, tre /*nonnull=*/flag_delete_null_pointer_checks, complain); + /* When -fsanitize=null, make sure to diagnose reference binding to + NULL even when the reference is converted to pointer later on. */ + if (sanitize_flags_p (SANITIZE_NULL) + && TREE_CODE (expr) == COND_EXPR + && TREE_OPERAND (expr, 2) + && TREE_CODE (TREE_OPERAND (expr, 2)) == INTEGER_CST + && POINTER_TYPE_P (TREE_TYPE (TREE_OPERAND (expr, 2))) + && (TREE_TYPE (TREE_TYPE (TREE_OPERAND (expr, 2))) + == TREE_TYPE (type))) + ubsan_maybe_instrument_reference (&TREE_OPERAND (expr, 2)); + /* Convert the pointer to a reference -- but then remember that there are no expressions with reference type in C++. @@ -8861,15 +8872,6 @@ build_static_cast_1 (location_t loc, tre the wrong answer. */ expr = cp_fold_convert (type, expr); - /* When -fsanitize=null, make sure to diagnose reference binding to - NULL even when the reference is converted to pointer later on. */ - if (sanitize_flags_p (SANITIZE_NULL) - && TREE_CODE (expr) == COND_EXPR - && TREE_OPERAND (expr, 2) - && TREE_CODE (TREE_OPERAND (expr, 2)) == INTEGER_CST - && TREE_TYPE (TREE_OPERAND (expr, 2)) == type) - ubsan_maybe_instrument_reference (&TREE_OPERAND (expr, 2)); - return convert_from_reference (rvalue (expr)); } --- gcc/testsuite/g++.dg/cpp0x/constexpr-static-cast1.C.jj 2026-07-27 13:27:10.540126544 +0200 +++ gcc/testsuite/g++.dg/cpp0x/constexpr-static-cast1.C 2026-07-27 17:58:00.467466477 +0200 @@ -0,0 +1,76 @@ +// { dg-do compile { target c++11 } } + +struct A { int a; }; +struct B : A { int b; }; +struct C : A { int c; }; +struct D { int d; }; +struct E { int e; }; +struct F : A, D, E { int f; }; +struct G {}; +struct H {}; +struct I {}; +struct J : G, H, I {}; +struct K { F k; J l[2]; }; +struct L : G {}; +struct M : G {}; +struct N : L, M {}; +constexpr A a = {}; +constexpr B b = {}; +constexpr C c = {}; +constexpr auto d = static_cast <const B *> (&a); // { dg-error "'const A' operand is not a base class subobject of a 'const B' object" } +constexpr auto e = static_cast <const A *> (&a); +constexpr auto f = static_cast <const A *> (&b); +constexpr auto g = static_cast <const B *> (&b); +constexpr auto h = static_cast <const B *> (f); +constexpr auto i = static_cast <const A *> (nullptr); +constexpr auto j = static_cast <const B *> (nullptr); +constexpr auto k = static_cast <const B *> (i); +constexpr auto l = static_cast <const A *> (j); +constexpr auto m = static_cast <const A *> (&c); +constexpr auto n = static_cast <const B *> (m); // { dg-error "'const A' operand \\\(of dynamic type 'const C'\\\) is not a base class subobject of a 'const B' object" } +constexpr auto o = static_cast <const C *> (m); +constexpr F p = {}; +constexpr auto q = static_cast <const A *> (&p); +constexpr auto r = static_cast <const F *> (q); +constexpr auto s = static_cast <const D *> (r); +constexpr auto t = static_cast <const F *> (s); +constexpr auto u = static_cast <const E *> (t); +constexpr auto v = static_cast <const F *> (u); +constexpr J y = {}; +constexpr auto z = static_cast <const G *> (&y); +constexpr auto aa = static_cast <const J *> (z); +constexpr auto ab = static_cast <const H *> (aa); +constexpr auto ac = static_cast <const J *> (ab); +constexpr auto ad = static_cast <const I *> (ac); +constexpr auto ae = static_cast <const J *> (ad); +constexpr H af = {}; +constexpr auto ag = static_cast <const J *> (&af); // { dg-error "'const H' operand is not a base class subobject of a 'const J' object" } +constexpr F ah[1] = {}; +constexpr auto ai = static_cast <const A *> (&ah[0]); +constexpr auto aj = static_cast <const F *> (ai); +constexpr auto ak = static_cast <const D *> (aj); +constexpr auto al = static_cast <const F *> (ak); +constexpr auto am = static_cast <const E *> (al); +constexpr auto an = static_cast <const F *> (am); +constexpr K ao = {}; +constexpr auto ap = static_cast <const A *> (&ao.k); +constexpr auto aq = static_cast <const F *> (ap); +constexpr auto ar = static_cast <const D *> (aq); +constexpr auto as = static_cast <const F *> (ar); +constexpr auto at = static_cast <const E *> (as); +constexpr auto au = static_cast <const F *> (at); +constexpr auto av = static_cast <const G *> (&ao.l[0]); +constexpr auto aw = static_cast <const J *> (av); +constexpr auto ax = static_cast <const H *> (aw); +constexpr auto ay = static_cast <const J *> (ax); +constexpr auto az = static_cast <const I *> (ay); +constexpr auto ba = static_cast <const J *> (az); +constexpr auto bb = static_cast <const G *> (&ao.l[1]); +constexpr auto bc = static_cast <const J *> (bb); +constexpr auto bd = static_cast <const H *> (bc); +constexpr auto be = static_cast <const J *> (bd); +constexpr auto bf = static_cast <const I *> (be); +constexpr auto bg = static_cast <const J *> (bf); +constexpr N bh = {}; +constexpr const G *bi = static_cast <const M *> (&bh); +constexpr auto bj = static_cast <const L *> (bi); // { dg-error "'const G' operand is not a base class subobject of a 'const L' object" } --- gcc/testsuite/g++.dg/cpp0x/constexpr-static-cast2.C.jj 2026-07-27 13:27:10.540267870 +0200 +++ gcc/testsuite/g++.dg/cpp0x/constexpr-static-cast2.C 2026-07-27 17:58:46.126883163 +0200 @@ -0,0 +1,72 @@ +// { dg-do compile { target c++11 } } + +struct A { int a; }; +struct B : A { int b; }; +struct C : A { int c; }; +struct D { int d; }; +struct E { int e; }; +struct F : A, D, E { int f; }; +struct G {}; +struct H {}; +struct I {}; +struct J : G, H, I {}; +struct K { F k; J l[2]; }; +struct L : G {}; +struct M : G {}; +struct N : L, M {}; +constexpr A a = {}; +constexpr B b = {}; +constexpr C c = {}; +constexpr auto &d = static_cast <const B &> (a); // { dg-error "'const A' operand is not a base class subobject of a 'const B' object" } +constexpr auto &e = static_cast <const A &> (a); +constexpr auto &f = static_cast <const A &> (b); +constexpr auto &g = static_cast <const B &> (b); +constexpr auto &h = static_cast <const B &> (f); +constexpr auto &m = static_cast <const A &> (c); +constexpr auto &n = static_cast <const B &> (m); // { dg-error "'const A' operand \\\(of dynamic type 'const C'\\\) is not a base class subobject of a 'const B' object" } +constexpr auto &o = static_cast <const C &> (m); +constexpr F p = {}; +constexpr auto &q = static_cast <const A &> (p); +constexpr auto &r = static_cast <const F &> (q); +constexpr auto &s = static_cast <const D &> (r); +constexpr auto &t = static_cast <const F &> (s); +constexpr auto &u = static_cast <const E &> (t); +constexpr auto &v = static_cast <const F &> (u); +constexpr J y = {}; +constexpr auto &z = static_cast <const G &> (y); +constexpr auto &aa = static_cast <const J &> (z); +constexpr auto &ab = static_cast <const H &> (aa); +constexpr auto &ac = static_cast <const J &> (ab); +constexpr auto &ad = static_cast <const I &> (ac); +constexpr auto &ae = static_cast <const J &> (ad); +constexpr H af = {}; +constexpr auto &ag = static_cast <const J &> (af); // { dg-error "'const H' operand is not a base class subobject of a 'const J' object" } +constexpr F ah[1] = {}; +constexpr auto &ai = static_cast <const A &> (ah[0]); +constexpr auto &aj = static_cast <const F &> (ai); +constexpr auto &ak = static_cast <const D &> (aj); +constexpr auto &al = static_cast <const F &> (ak); +constexpr auto &am = static_cast <const E &> (al); +constexpr auto &an = static_cast <const F &> (am); +constexpr K ao = {}; +constexpr auto &ap = static_cast <const A &> (ao.k); +constexpr auto &aq = static_cast <const F &> (ap); +constexpr auto &ar = static_cast <const D &> (aq); +constexpr auto &as = static_cast <const F &> (ar); +constexpr auto &at = static_cast <const E &> (as); +constexpr auto &au = static_cast <const F &> (at); +constexpr auto &av = static_cast <const G &> (ao.l[0]); +constexpr auto &aw = static_cast <const J &> (av); +constexpr auto &ax = static_cast <const H &> (aw); +constexpr auto &ay = static_cast <const J &> (ax); +constexpr auto &az = static_cast <const I &> (ay); +constexpr auto &ba = static_cast <const J &> (az); +constexpr auto &bb = static_cast <const G &> (ao.l[1]); +constexpr auto &bc = static_cast <const J &> (bb); +constexpr auto &bd = static_cast <const H &> (bc); +constexpr auto &be = static_cast <const J &> (bd); +constexpr auto &bf = static_cast <const I &> (be); +constexpr auto &bg = static_cast <const J &> (bf); +constexpr N bh = {}; +constexpr const G &bi = static_cast <const M &> (bh); +constexpr auto &bj = static_cast <const L &> (bi); // { dg-error "'const G' operand is not a base class subobject of a 'const L' object" } --- gcc/testsuite/g++.dg/cpp1y/constexpr-static-cast1.C.jj 2026-07-27 13:27:10.540452139 +0200 +++ gcc/testsuite/g++.dg/cpp1y/constexpr-static-cast1.C 2026-07-27 17:37:12.014415981 +0200 @@ -0,0 +1,91 @@ +// { dg-do compile { target c++14 } } + +struct A { int a; }; +struct B : A { int b; }; +struct C : A { int c; }; +struct D { int d = 42; }; +struct E { int e = 0; }; +struct F : E, D { }; +struct G : F { }; +struct H { G b; }; + +constexpr bool +foo (bool x) +{ + A a = {}; + if (x) + { + auto c = static_cast <B *> (&a); // { dg-error "'A' operand is not a base class subobject of a 'B' object" } + } + return true; +} + +constexpr bool +bar () +{ + A a = {}; + B b = {}; + auto c = static_cast <A *> (&a); + auto d = static_cast <A *> (&b); + auto e = static_cast <B *> (&b); + auto f = static_cast <B *> (d); + auto g = static_cast <A *> (nullptr); + auto h = static_cast <B *> (nullptr); + auto i = static_cast <B *> (g); + auto j = static_cast <A *> (h); + return true; +} + +constexpr bool +baz (bool x) +{ + C a = {}; + auto b = static_cast <A *> (&a); + if (x) + { + auto c = static_cast <B *> (b); // { dg-error "'A' operand \\\(of dynamic type 'C'\\\) is not a base class subobject of a 'B' object" } + } + return true; +} + +#if __cpp_constexpr_dynamic_alloc >= 201907 +constexpr bool +qux () +{ + A *a = new B {}; + auto b = static_cast <B *> (a); + auto c = static_cast <C *> (a); // { dg-error "operand \\\(of dynamic type 'B'\\\) is not a base class subobject of a 'C' object" "" { target c++20 } } + delete a; + return true; +} + +constexpr bool +corge () +{ + A *a = new B[2] {}; + auto b = static_cast <B *> (a); + auto c = static_cast <C *> (a); // { dg-error "operand \\\(of dynamic type 'B'\\\) is not a base class subobject of a 'C' object" "" { target c++20 } } + delete[] a; + return true; +} +#endif + +constexpr int +fred () +{ + H h; + auto a = static_cast <D *> (&h.b); + auto b = static_cast <G *> (a); + return b->d; +} + +static_assert (foo (false), ""); +constexpr bool a = foo (true); +static_assert (bar (), ""); +static_assert (baz (false), ""); +constexpr bool b = baz (true); +#if __cpp_constexpr_dynamic_alloc >= 201907 +constexpr bool c = qux (); +constexpr bool d = corge (); +#endif +static_assert(fred () == 42, ""); --- gcc/testsuite/g++.dg/cpp1y/constexpr-static-cast2.C.jj 2026-07-27 13:27:10.540556802 +0200 +++ gcc/testsuite/g++.dg/cpp1y/constexpr-static-cast2.C 2026-07-27 17:38:49.367172264 +0200 @@ -0,0 +1,87 @@ +// { dg-do compile { target c++14 } } + +struct A { int a; }; +struct B : A { int b; }; +struct C : A { int c; }; +struct D { int d = 42; }; +struct E { int e = 0; }; +struct F : E, D { }; +struct G : F { }; +struct H { G b; }; + +constexpr bool +foo (bool x) +{ + A a = {}; + if (x) + { + auto &c = static_cast <B &> (a); // { dg-error "'A' operand is not a base class subobject of a 'B' object" } + } + return true; +} + +constexpr bool +bar () +{ + A a = {}; + B b = {}; + auto &c = static_cast <A &> (a); + auto &d = static_cast <A &> (b); + auto &e = static_cast <B &> (b); + auto &f = static_cast <B &> (d); + return true; +} + +constexpr bool +baz (bool x) +{ + C a = {}; + auto &b = static_cast <A &> (a); + if (x) + { + auto &c = static_cast <B &> (b); // { dg-error "'A' operand \\\(of dynamic type 'C'\\\) is not a base class subobject of a 'B' object" } + } + return true; +} + +#if __cpp_constexpr_dynamic_alloc >= 201907 +constexpr bool +qux () +{ + A *a = new B {}; + auto &b = static_cast <B &> (*a); + auto &c = static_cast <C &> (*a); // { dg-error "'A' operand \\\(of dynamic type 'B'\\\) is not a base class subobject of a 'C' object" "" { target c++20 } } + delete a; + return true; +} + +constexpr bool +corge () +{ + A *a = new B[2] {}; + auto &b = static_cast <B &> (*a); + auto &c = static_cast <C &> (*a); // { dg-error "'A' operand \\\(of dynamic type 'B'\\\) is not a base class subobject of a 'C' object" "" { target c++20 } } + delete[] a; + return true; +} +#endif + +constexpr int +fred () +{ + H h; + auto &a = static_cast <D &> (h.b); + auto &b = static_cast <G &> (a); + return b.d; +} + +static_assert (foo (false), ""); +constexpr bool a = foo (true); +static_assert (bar (), ""); +static_assert (baz (false), ""); +constexpr bool b = baz (true); +#if __cpp_constexpr_dynamic_alloc >= 201907 +constexpr bool c = qux (); +constexpr bool d = corge (); +#endif +static_assert(fred () == 42, ""); --- gcc/testsuite/g++.dg/cpp1y/constexpr-static-cast3.C.jj 2026-07-27 13:27:10.540657321 +0200 +++ gcc/testsuite/g++.dg/cpp1y/constexpr-static-cast3.C 2026-07-27 17:39:18.447800747 +0200 @@ -0,0 +1,31 @@ +// { dg-do compile { target c++14 } } + +template <typename T> +struct A +{ + unsigned char a = 0; + constexpr T & + foo (const unsigned char &x) + { + a = x; + return *static_cast <T *> (this); + } +}; + +template <typename T> +struct B +{ + unsigned char b = 0; + constexpr T & + bar (const unsigned char &x) + { + b = x; + return *static_cast <T *> (this); // { dg-error "'B<D>' operand \\\(of dynamic type 'C<D>'\\\) is not a base class subobject of a 'D' object" } + } +}; + +template <typename T> +struct C : A <C <T>>, B <T> { }; +struct D : B <D> { }; + +constexpr auto c = C <D> ().foo (100).bar (10); Jakub
