On Fri, Aug 16, 2019 at 05:40:39PM -0700, Jason Merrill wrote:
> On 8/16/19 5:11 AM, Marek Polacek wrote:
> > On Thu, Aug 15, 2019 at 08:21:25PM -0400, Jason Merrill wrote:
> > > On 8/15/19 5:34 PM, Marek Polacek wrote:
> > > > On Wed, Aug 14, 2019 at 02:50:13PM -0400, Jason Merrill wrote:
> > > > > On Thu, Aug 8, 2019 at 3:25 PM Marek Polacek <pola...@redhat.com>
> > > > > wrote:
> > > > > >
> > > > > > On Thu, Aug 08, 2019 at 11:06:17AM -0400, Jason Merrill wrote:
> > > > > > > On 8/6/19 3:20 PM, Marek Polacek wrote:
> > > > > > > > On Mon, Aug 05, 2019 at 03:54:19PM -0400, Jason Merrill wrote:
> > > > > > > > > On 7/31/19 3:26 PM, Marek Polacek wrote:
> > > > > > > > > > One of the features of constexpr is that it doesn't allow
> > > > > > > > > > UB; and such UB must
> > > > > > > > > > be detected at compile-time. So running your code in a
> > > > > > > > > > context that requires
> > > > > > > > > > a constant expression should ensure that the code in
> > > > > > > > > > question is free of UB.
> > > > > > > > > > In effect, constexpr can serve as a sanitizer. E.g. this
> > > > > > > > > > article describes in
> > > > > > > > > > in more detail:
> > > > > > > > > > <https://shafik.github.io/c++/undefined%20behavior/2019/05/11/explporing_undefined_behavior_using_constexpr.html>
> > > > > > > > > >
> > > > > > > > > > [dcl.type.cv]p4 says "Any attempt to modify a const object
> > > > > > > > > > during its lifetime
> > > > > > > > > > results in undefined behavior." However, as the article
> > > > > > > > > > above points out, we
> > > > > > > > > > aren't detecting that case in constexpr evaluation.
> > > > > > > > > >
> > > > > > > > > > This patch fixes that. It's not that easy, though, because
> > > > > > > > > > we have to keep in
> > > > > > > > > > mind [class.ctor]p5:
> > > > > > > > > > "A constructor can be invoked for a const, volatile or
> > > > > > > > > > const volatile object.
> > > > > > > > > > const and volatile semantics are not applied on an object
> > > > > > > > > > under construction.
> > > > > > > > > > They come into effect when the constructor for the most
> > > > > > > > > > derived object ends."
> > > > > > > > > >
> > > > > > > > > > I handled this by keeping a hash set which tracks objects
> > > > > > > > > > under construction.
> > > > > > > > > > I considered other options, such as going up call_stack,
> > > > > > > > > > but that wouldn't
> > > > > > > > > > work with trivial constructor/op=. It was also interesting
> > > > > > > > > > to find out that
> > > > > > > > > > the definition of TREE_HAS_CONSTRUCTOR says "When appearing
> > > > > > > > > > in a FIELD_DECL,
> > > > > > > > > > it means that this field has been duly initialized in its
> > > > > > > > > > constructor" though
> > > > > > > > > > nowhere in the codebase do we set TREE_HAS_CONSTRUCTOR on a
> > > > > > > > > > FIELD_DECL as far
> > > > > > > > > > as I can see. Unfortunately, using this bit proved useless
> > > > > > > > > > for my needs here.
> > > > > > > > >
> > > > > > > > > > Also, be mindful of mutable subobjects.
> > > > > > > > > >
> > > > > > > > > > Does this approach look like an appropriate strategy for
> > > > > > > > > > tracking objects'
> > > > > > > > > > construction?
> > > > > > > > >
> > > > > > > > > For scalar objects, we should be able to rely on INIT_EXPR
> > > > > > > > > vs. MODIFY_EXPR
> > > > > > > > > to distinguish between initialization and modification; for
> > > > > > > > > class objects, I
> > > > > > > >
> > > > > > > > This is already true: only class object go into the hash set.
> > > > > > > >
> > > > > > > > > wonder about setting a flag on the CONSTRUCTOR after
> > > > > > > > > initialization is
> > > > > > > > > complete to indicate that the value is now constant.
> > > > > > > >
> > > > > > > > But here we're not dealing with CONSTRUCTORs in the gcc sense
> > > > > > > > (i.e. exprs with
> > > > > > > > TREE_CODE == CONSTRUCTOR). We have a CALL_EXPR like Y::Y
> > > > > > > > ((struct Y *) &y),
> > > > > > > > which initializes the object "y". Setting a flag on the
> > > > > > > > CALL_EXPR or its underlying
> > > > > > > > function decl wouldn't help.
> > > > > > > >
> > > > > > > > Am I missing something?
> > > > > > >
> > > > > > > I was thinking that where in your current patch you call
> > > > > > > remove_object_under_construction, we could instead mark the
> > > > > > > object's value
> > > > > > > CONSTRUCTOR as immutable.
> > > > > >
> > > > > > Ah, what you meant was to look at DECL_INITIAL of the object we're
> > > > > > constructing, which could be a CONSTRUCTOR. Unfortunately, this
> > > > > > DECL_INITIAL is null (in all the new tests when doing
> > > > > > remove_object_under_construction), so there's nothing to mark as
> > > > > > TREE_READONLY :/.
> > > > >
> > > > > There's a value in ctx->values, isn't there?
> > > >
> > > > Doesn't seem to be the case for e.g.
> > > >
> > > > struct A {
> > > > int n;
> > > > constexpr A() : n(1) { n = 2; }
> > > > };
> > > >
> > > > struct B {
> > > > const A a;
> > > > constexpr B(bool b) {
> > > > if (b)
> > > > const_cast<A &>(a).n = 3; // { dg-error "modifying a const
> > > > object" }
> > > > }
> > > > };
> > > >
> > > > constexpr B b(false);
> > > > static_assert(b.a.n == 2, "");
> > > >
> > > > Here we're constructing "b", its ctx->values->get(new_obj) is initially
> > > > "{}". In the middle of constructing "b", we construct "b.a", but that
> > > > has nothing in ctx->values.
> > >
> > > Right, subobjects aren't in ctx->values. In cxx_eval_call_expression we
> > > have
> > >
> > > if (DECL_CONSTRUCTOR_P (fun))
> > > /* This can be null for a subobject constructor call, in
> > >
> > > which case what we care about is the initialization
> > >
> > > side-effects rather than the value. We could get at the
> > >
> > > value by evaluating *this, but we don't bother; there's
> > >
> > > no need to put such a call in the hash table. */
> > > result = lval ? ctx->object : ctx->ctor;
> > >
> > > Your patch already finds *this (b.a) and puts it in new_obj; if it's const
> > > we can evaluate it to get the CONSTRUCTOR to set TREE_READONLY on.
> >
> > Ah, got it! This patch uses setting TREE_READONLY to achieve what I was
> > after.
> > I also needed to set TREE_READONLY in
> > cxx_eval_constant_expression/DECL_EXPR.
> > The additional evaluating will only happen for const-qual objects so I hope
> > not
> > very often.
> >
> > Any further comments? Thanks,
> >
> > @@ -1910,6 +1958,29 @@ cxx_eval_call_expression (const constexpr_ctx *ctx,
> > tree t,
> >
> > + /* At this point, the object's constructor will have run, so
> > + the object is no longer under construction, and its possible
> > + 'const' semantics now apply. Make a note of this fact by
> > + marking the CONSTRUCTOR TREE_READONLY. */
> > + if (new_obj
> > + && CLASS_TYPE_P (TREE_TYPE (new_obj))
> > + && CP_TYPE_CONST_P (TREE_TYPE (new_obj)))
> > + {
> > + tree *ctor = ctx->values->get (new_obj);
>
> I don't think trying ctx->values->get first is a win, let's go straight to
> cxx_eval_constant_expression.
Done.
> > +/* Return true if we are modifying something that is const during constant
> > + expression evaluation. CODE is the code of the statement, OBJ is the
> > + object in question, MUTABLE_P is true if one of the subobjects were
> > + declared mutable. */
> > +
> > +static bool
> > +modifying_const_object_p (const constexpr_ctx *ctx, tree_code code, tree
> > obj,
> > + bool mutable_p)
> > +{
> > + /* If this is initialization, there's no problem. */
> > + if (code != MODIFY_EXPR)
> > + return false;
> > +
> > + tree type = TREE_TYPE (obj);
> > +
> > + /* [basic.type.qualifier] "A const object is an object of type
> > + const T or a non-mutable subobject of a const object." */
> > + return ((TREE_READONLY (obj) || CP_TYPE_CONST_P (type)
> > + /* If it's an aggregate and any field is const, then it is
> > + effectively const. */
> > + || (CLASS_TYPE_P (type) && C_TYPE_FIELDS_READONLY (type)))
>
> This seems wrong; if one field is const, we can still modify other fields. I
> don't see a test for that case.
I took it from cp_build_modify_expr but it's not really needed, so dropped.
> > @@ -3783,6 +3885,17 @@ cxx_eval_store_expression (const constexpr_ctx *ctx,
> > tree t,
> > {
> > tree ob = TREE_OPERAND (probe, 0);
> > tree elt = TREE_OPERAND (probe, 1);
> > + if (DECL_P (elt) && DECL_MUTABLE_P (elt))
> > + mutable_p = true;
> > + if (evaluated
> > + && modifying_const_object_p (ctx, TREE_CODE (t), probe,
> > + mutable_p))
> > + {
> > + if (!ctx->quiet)
> > + modifying_const_object_error (t, probe);
> > + *non_constant_p = true;
> > + return t;
> > + }
>
> What if there's a mutable member further down, i.e.
>
> struct A { mutable int i; };
> struct B { A a; };
> const B b;
> b.a.i = 42;
>
> ? And also...
This works. We check mutable going from the innermost object to the outermost,
so if we have b.a.n, we check n first. Some of the new tests are exercising
this.
> > @@ -3811,6 +3924,14 @@ cxx_eval_store_expression (const constexpr_ctx *ctx,
> > tree t,
> > + if (modifying_const_object_p (ctx, TREE_CODE (t), object, mutable_p))
> > + {
> > + if (!ctx->quiet)
> > + modifying_const_object_error (t, object);
> > + *non_constant_p = true;
> > + return t;
> > + }
>
> ...we are already collecting the CONSTRUCTORs that we're dealing with in the
> "ctors" stack, we shouldn't need to evaluate object at this point. I'd
> expect the topmost class-type CONSTRUCTOR on the stack (if any) to be the
> one we want to look at. I'd think you could do away with much of
> modifying_const_object_p.
Oh, got it; wish I'd thought of that sooner. We can't just check the topmost
CONSTRUCTOR though, the yuge comment I've added has an example when that would
not be enough.
And yes, I could 86 most of modifying_const_object_p.
> > @@ -4650,6 +4772,11 @@ cxx_eval_constant_expression (const constexpr_ctx
> > *ctx, tree t,
> > non_constant_p, overflow_p);
> > /* Don't share a CONSTRUCTOR that might be changed. */
> > init = unshare_constructor (init);
> > + /* Remember that a constant object's constructor has already
> > + ran. */
>
> "has...run"
Yikes.
Thanks for the review, it allowed me to make the patch more concise.
Bootstrapped/regtested on x86_64-linux, ok for trunk?
2019-08-18 Marek Polacek <pola...@redhat.com>
PR c++/91264 - detect modifying const objects in constexpr.
* constexpr.c (modifying_const_object_error): New function.
(cxx_eval_call_expression): Set TREE_READONLY on a CONSTRUCTOR of
a const-qualified object after it's been fully constructed.
(modifying_const_object_p): New function.
(cxx_eval_store_expression): Detect modifying a const object
during constant expression evaluation.
(cxx_eval_increment_expression): Use a better location when building
up the store.
(cxx_eval_constant_expression) <case DECL_EXPR>: Mark a constant
object's constructor TREE_READONLY.
* g++.dg/cpp1y/constexpr-tracking-const1.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const2.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const3.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const4.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const5.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const6.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const7.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const8.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const9.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const10.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const11.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const12.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const13.C: New test.
* g++.dg/cpp1y/constexpr-tracking-const14.C: New test.
diff --git gcc/cp/constexpr.c gcc/cp/constexpr.c
index 23f2a027e2f..e5ed326efca 100644
--- gcc/cp/constexpr.c
+++ gcc/cp/constexpr.c
@@ -1575,6 +1575,19 @@ clear_no_implicit_zero (tree ctor)
}
}
+/* Complain about a const object OBJ being modified in a constant expression.
+ EXPR is the MODIFY_EXPR expression performing the modification. */
+
+static void
+modifying_const_object_error (tree expr, tree obj)
+{
+ location_t loc = cp_expr_loc_or_input_loc (expr);
+ auto_diagnostic_group d;
+ error_at (loc, "modifying a const object %qE is not allowed in "
+ "a constant expression", TREE_OPERAND (expr, 0));
+ inform (location_of (obj), "originally declared %<const%> here");
+}
+
/* Subroutine of cxx_eval_constant_expression.
Evaluate the call expression tree T in the context of OLD_CALL expression
evaluation. */
@@ -1775,6 +1788,19 @@ cxx_eval_call_expression (const constexpr_ctx *ctx, tree
t,
depth_ok = push_cx_call_context (t);
+ /* Remember the object we are constructing. */
+ tree new_obj = NULL_TREE;
+ if (DECL_CONSTRUCTOR_P (fun))
+ {
+ /* In a constructor, it should be the first `this' argument.
+ At this point it has already been evaluated in the call
+ to cxx_bind_parameters_in_call. */
+ new_obj = TREE_VEC_ELT (new_call.bindings, 0);
+ STRIP_NOPS (new_obj);
+ if (TREE_CODE (new_obj) == ADDR_EXPR)
+ new_obj = TREE_OPERAND (new_obj, 0);
+ }
+
tree result = NULL_TREE;
constexpr_call *entry = NULL;
@@ -1910,6 +1936,23 @@ cxx_eval_call_expression (const constexpr_ctx *ctx, tree
t,
}
}
+ /* At this point, the object's constructor will have run, so
+ the object is no longer under construction, and its possible
+ 'const' semantics now apply. Make a note of this fact by
+ marking the CONSTRUCTOR TREE_READONLY. */
+ if (new_obj
+ && CLASS_TYPE_P (TREE_TYPE (new_obj))
+ && CP_TYPE_CONST_P (TREE_TYPE (new_obj)))
+ {
+ /* Subobjects might not be stored in ctx->values but we can
+ get its CONSTRUCTOR by evaluating *this. */
+ tree e = cxx_eval_constant_expression (ctx, new_obj,
+ /*lval*/false,
+ non_constant_p,
+ overflow_p);
+ TREE_READONLY (e) = true;
+ }
+
/* Forget the saved values of the callee's SAVE_EXPRs. */
unsigned int i;
tree save_expr;
@@ -3724,6 +3767,26 @@ maybe_simplify_trivial_copy (tree &target, tree &init)
}
}
+/* Return true if we are modifying something that is const during constant
+ expression evaluation. CODE is the code of the statement, OBJ is the
+ object in question, MUTABLE_P is true if one of the subobjects were
+ declared mutable. */
+
+static bool
+modifying_const_object_p (tree_code code, tree obj, bool mutable_p)
+{
+ /* If this is initialization, there's no problem. */
+ if (code != MODIFY_EXPR)
+ return false;
+
+ /* [basic.type.qualifier] "A const object is an object of type
+ const T or a non-mutable subobject of a const object." */
+ if (mutable_p)
+ return false;
+
+ return (TREE_READONLY (obj) || CP_TYPE_CONST_P (TREE_TYPE (obj)));
+}
+
/* Evaluate an INIT_EXPR or MODIFY_EXPR. */
static tree
@@ -3773,6 +3836,9 @@ cxx_eval_store_expression (const constexpr_ctx *ctx, tree
t,
/* Find the underlying variable. */
releasing_vec refs;
tree object = NULL_TREE;
+ /* If we're modifying a const object, save it. */
+ tree const_object_being_modified = NULL_TREE;
+ bool mutable_p = false;
for (tree probe = target; object == NULL_TREE; )
{
switch (TREE_CODE (probe))
@@ -3783,6 +3849,12 @@ cxx_eval_store_expression (const constexpr_ctx *ctx,
tree t,
{
tree ob = TREE_OPERAND (probe, 0);
tree elt = TREE_OPERAND (probe, 1);
+ if (DECL_P (elt) && DECL_MUTABLE_P (elt))
+ mutable_p = true;
+ if (evaluated
+ && modifying_const_object_p (TREE_CODE (t), probe, mutable_p)
+ && const_object_being_modified == NULL_TREE)
+ const_object_being_modified = probe;
if (TREE_CODE (probe) == ARRAY_REF)
{
elt = eval_and_check_array_index (ctx, probe, false,
@@ -3811,6 +3883,10 @@ cxx_eval_store_expression (const constexpr_ctx *ctx,
tree t,
}
}
+ if (modifying_const_object_p (TREE_CODE (t), object, mutable_p)
+ && const_object_being_modified == NULL_TREE)
+ const_object_being_modified = object;
+
/* And then find/build up our initializer for the path to the subobject
we're initializing. */
tree *valp;
@@ -3950,6 +4026,61 @@ cxx_eval_store_expression (const constexpr_ctx *ctx,
tree t,
valp = &cep->value;
}
+ /* Detect modifying a constant object in constexpr evaluation.
+ We have found a const object that is being modified. Figure out
+ if we need to issue an error. Consider
+
+ struct A {
+ int n;
+ constexpr A() : n(1) { n = 2; } // #1
+ };
+ struct B {
+ const A a;
+ constexpr B() { a.n = 3; } // #2
+ };
+ constexpr B b{};
+
+ #1 is OK, since we're modifying an object under construction, but
+ #2 is wrong, since "a" is const and has been fully constructed.
+ We track the "under construction" state by using the TREE_READONLY
+ bit in the object's CONSTRUCTOR. For the example above, the *ctors
+ stack at the point of #2 will look like:
+
+ ctors[0] = {.a={.n=2}} TREE_READONLY = 0
+ ctors[1] = {.n=2} TREE_READONLY = 1
+
+ and we're modifying "b.a", so we search the stack and see that the
+ constructor for "b.a" has already run. */
+ if (const_object_being_modified)
+ {
+ bool fail = false;
+ if (!CLASS_TYPE_P (TREE_TYPE (const_object_being_modified)))
+ fail = true;
+ else
+ {
+ /* [class.ctor]p5 "A constructor can be invoked for a const,
+ volatile, or const volatile object. const and volatile
+ semantics are not applied on an object under construction.
+ They come into effect when the constructor for the most
+ derived object ends." */
+ tree elt;
+ unsigned int i;
+ FOR_EACH_VEC_ELT (*ctors, i, elt)
+ if (CLASS_TYPE_P (TREE_TYPE (elt)) && TREE_READONLY (elt))
+ {
+ fail = true;
+ break;
+ }
+ }
+ if (fail)
+ {
+ if (!ctx->quiet)
+ modifying_const_object_error (t, const_object_being_modified);
+ *non_constant_p = true;
+ return t;
+ }
+ }
+
if (!preeval)
{
/* Create a new CONSTRUCTOR in case evaluation of the initializer
@@ -4063,7 +4194,8 @@ cxx_eval_increment_expression (const constexpr_ctx *ctx,
tree t,
VERIFY_CONSTANT (mod);
/* Storing the modified value. */
- tree store = build2 (MODIFY_EXPR, type, op, mod);
+ tree store = build2_loc (cp_expr_loc_or_loc (t, input_location),
+ MODIFY_EXPR, type, op, mod);
cxx_eval_constant_expression (ctx, store,
true, non_constant_p, overflow_p);
ggc_free (store);
@@ -4650,6 +4782,11 @@ cxx_eval_constant_expression (const constexpr_ctx *ctx,
tree t,
non_constant_p, overflow_p);
/* Don't share a CONSTRUCTOR that might be changed. */
init = unshare_constructor (init);
+ /* Remember that a constant object's constructor has already
+ run. */
+ if (CLASS_TYPE_P (TREE_TYPE (r))
+ && CP_TYPE_CONST_P (TREE_TYPE (r)))
+ TREE_READONLY (init) = true;
ctx->values->put (r, init);
}
else if (ctx == &new_ctx)
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const1.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const1.C
new file mode 100644
index 00000000000..e081a535659
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const1.C
@@ -0,0 +1,72 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+constexpr void
+mod (int &r)
+{
+ r = 99; // { dg-error "modifying a const object" }
+}
+
+constexpr int
+fn1 ()
+{
+ const int i = 0; // { dg-message "originally declared" }
+ mod (const_cast<int &>(i)); // { dg-message "in .constexpr. expansion of " }
+ return i;
+}
+
+constexpr int i1 = fn1 (); // { dg-message "in .constexpr. expansion of " }
+
+constexpr int
+fn2 ()
+{
+ const int i = 5; // { dg-message "originally declared" }
+ const_cast<int &>(i) = 10; // { dg-error "modifying a const object" }
+ return i;
+}
+
+constexpr int i2 = fn2 (); // { dg-message "in .constexpr. expansion of " }
+
+constexpr int
+fn3 ()
+{
+ const int i = 5; // { dg-message "originally declared" }
+ ++const_cast<int &>(i); // { dg-error "modifying a const object" }
+ return i;
+}
+
+constexpr int i3 = fn3 (); // { dg-message "in .constexpr. expansion of " }
+
+constexpr int
+fn4 ()
+{
+ const int i = 5; // { dg-message "originally declared" }
+ const_cast<int &>(i)--; // { dg-error "modifying a const object" }
+ return i;
+}
+
+constexpr int i4 = fn4 (); // { dg-message "in .constexpr. expansion of " }
+
+constexpr int
+fn5 ()
+{
+ const int i = 5; // { dg-message "originally declared" }
+ const_cast<int &>(i) += 2; // { dg-error "modifying a const object" }
+ return i;
+}
+
+constexpr int i5 = fn5 (); // { dg-message "in .constexpr. expansion of " }
+
+constexpr int
+fn6 ()
+{
+ // This is OK.
+ int i = 3;
+ const int *cip = &i;
+ int *ip = const_cast<int *>(cip);
+ *ip = 4;
+ return i;
+}
+
+constexpr int i6 = fn6 ();
+static_assert(i6 == 4, "");
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const10.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const10.C
new file mode 100644
index 00000000000..53acb37beb8
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const10.C
@@ -0,0 +1,22 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct B {
+ B() = default;
+ int i;
+};
+
+constexpr B bar()
+{
+ constexpr B b = B(); // { dg-message "originally declared" }
+ B *p = const_cast<B*>(&b);
+
+ p->i = 11; // { dg-error "modifying a const object" }
+
+ return *p;
+}
+
+void foo()
+{
+ constexpr B y = bar(); // { dg-message "in .constexpr. expansion of" }
+}
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const11.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const11.C
new file mode 100644
index 00000000000..2b351cd013a
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const11.C
@@ -0,0 +1,16 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct S {
+ int a = 1;
+ int * ptr = &a;
+};
+
+constexpr bool f() {
+ auto const s = S{}; // { dg-message "originally declared" }
+ *s.ptr = 2; // { dg-error "modifying a const object" }
+ return s.a == 2;
+}
+
+static_assert(f(), ""); // { dg-error "non-constant condition" }
+// { dg-message "in 'constexpr' expansion of" "" { target *-*-* } .-1 }
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const12.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const12.C
new file mode 100644
index 00000000000..d83e2794f7f
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const12.C
@@ -0,0 +1,17 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct A {
+ const int n;
+ int m;
+ constexpr A() : n(1), m(2) { }
+};
+struct B {
+ A a;
+ constexpr B() {
+ int *p = &a.m;
+ *p = 3;
+ }
+};
+constexpr B b;
+static_assert(b.a.m == 3, "");
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const13.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const13.C
new file mode 100644
index 00000000000..bc7faa3c250
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const13.C
@@ -0,0 +1,20 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct A {
+ mutable int i;
+ constexpr A() : i(0) { }
+};
+struct B {
+ A a;
+ constexpr B() : a{} { }
+};
+
+constexpr void
+g ()
+{
+ const B b;
+ b.a.i = 42;
+}
+
+static_assert((g(), 1), "");
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const14.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const14.C
new file mode 100644
index 00000000000..45c4fcf50be
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const14.C
@@ -0,0 +1,38 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct F {
+ const int f;
+ constexpr F() : f(9) { }
+};
+
+struct C {
+ int n;
+ const F f;
+ constexpr C() : n(1) { n = 66; }
+};
+
+struct A {
+ int r;
+ const C c;
+ constexpr A() : r(11) { r = 14; const_cast<C &>(c).n = 42; } // { dg-error
"modifying a const object" }
+};
+
+struct D {
+ const A a;
+ constexpr D() { } // { dg-message "in .constexpr. expansion of" }
+};
+
+struct E {
+ const D d;
+ constexpr E() { } // { dg-message "in .constexpr. expansion of" }
+};
+
+struct B {
+ const E e;
+ constexpr B(bool) { } // { dg-message "in .constexpr. expansion of" }
+};
+
+constexpr B b(false); // { dg-message "in .constexpr. expansion of" }
+// { dg-message "originally declared" "" { target *-*-* } .-1 }
+static_assert(b.e.d.a.c.n == 2, ""); // { dg-error "non-constant condition" }
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const2.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const2.C
new file mode 100644
index 00000000000..9803309cace
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const2.C
@@ -0,0 +1,23 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct X {
+ int j;
+ constexpr X() : j(0) { }
+};
+
+struct Y {
+ X x;
+ constexpr Y() : x{} { }
+};
+
+constexpr void
+g ()
+{
+ const Y y; // { dg-message "originally declared" }
+ Y *p = const_cast<Y *>(&y);
+ p->x.j = 99; // { dg-error "modifying a const object" }
+}
+
+static_assert((g() , 1), ""); // { dg-error "non-constant condition" }
+// { dg-message "in 'constexpr' expansion of" "" { target *-*-* } .-1 }
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const3.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const3.C
new file mode 100644
index 00000000000..6853775c1e2
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const3.C
@@ -0,0 +1,22 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct A {
+ int n;
+ constexpr A() : n(1) { n = 2; }
+};
+
+struct B {
+ const A a;
+ constexpr B(bool b) {
+ if (b)
+ const_cast<A &>(a).n = 3; // { dg-error "modifying a const object" }
+ }
+};
+
+constexpr B b(false);
+static_assert(b.a.n == 2, "");
+
+constexpr B b2(true); // { dg-message "in .constexpr. expansion of " }
+// { dg-message "originally declared" "" { target *-*-* } .-1 }
+static_assert((b2.a.n, 1), "");
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const4.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const4.C
new file mode 100644
index 00000000000..8263a7cc505
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const4.C
@@ -0,0 +1,17 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct A {
+ const int n;
+ constexpr A() : n(1) { }
+};
+struct B {
+ A a;
+ constexpr B() {
+ int *p = const_cast<int *>(&a.n);
+ *p = 3; // { dg-error "modifying a const object" }
+ }
+};
+constexpr B b; // { dg-message "in .constexpr. expansion of " }
+// { dg-message "originally declared" "" { target *-*-* } .-1 }
+static_assert((b.a.n, 1), "");
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const5.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const5.C
new file mode 100644
index 00000000000..bea54fb4fde
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const5.C
@@ -0,0 +1,17 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct A {
+ mutable int n;
+ constexpr A() : n(1) { n = 2; }
+};
+
+struct B {
+ const A a;
+ constexpr B() {
+ const_cast<A &>(a).n = 3;
+ }
+};
+
+constexpr B b{};
+static_assert((b.a.n, 1), "");
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const6.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const6.C
new file mode 100644
index 00000000000..54d83b17d39
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const6.C
@@ -0,0 +1,22 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct X {
+ mutable int j;
+ constexpr X() : j(0) { }
+};
+
+struct Y {
+ X x;
+ constexpr Y() : x{} { }
+};
+
+constexpr void
+g ()
+{
+ const Y y;
+ Y *p = const_cast<Y *>(&y);
+ p->x.j = 99;
+}
+
+static_assert((g(), 1), "");
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const7.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const7.C
new file mode 100644
index 00000000000..922e8ff126f
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const7.C
@@ -0,0 +1,23 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct D { int n; };
+
+struct C { const D d; };
+
+struct A {
+ C c;
+ constexpr A() : c{} { }
+};
+
+struct B {
+ A a;
+ constexpr B() {
+ int &r = const_cast<int &>(a.c.d.n);
+ r = 3; // { dg-error "modifying a const object" }
+ }
+};
+
+constexpr B b{}; // { dg-message "in .constexpr. expansion of " }
+// { dg-message "originally declared" "" { target *-*-* } .-1 }
+static_assert((b.a.c.d.n, 1), "");
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const8.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const8.C
new file mode 100644
index 00000000000..2b3fe793f83
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const8.C
@@ -0,0 +1,23 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct B {
+ int i;
+ double d;
+};
+
+constexpr B bar()
+{
+ constexpr B b = {10,10.10}; // { dg-message "originally declared" }
+ B *p = const_cast<B*>(&b);
+
+ p->i = 11; // { dg-error "modifying a const object" }
+ p->d = 11.11;
+
+ return *p;
+}
+
+void foo()
+{
+ constexpr B y = bar(); // { dg-message "in .constexpr. expansion of" }
+}
diff --git gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const9.C
gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const9.C
new file mode 100644
index 00000000000..0edec4d05cf
--- /dev/null
+++ gcc/testsuite/g++.dg/cpp1y/constexpr-tracking-const9.C
@@ -0,0 +1,23 @@
+// PR c++/91264
+// { dg-do compile { target c++14 } }
+
+struct B {
+ int i;
+ double d;
+};
+
+constexpr B bar()
+{
+ constexpr B b{}; // { dg-message "originally declared" }
+ B *p = const_cast<B*>(&b);
+
+ p->i = 11; // { dg-error "modifying a const object" }
+ p->d = 11.11;
+
+ return *p;
+}
+
+void foo()
+{
+ constexpr B y = bar(); // { dg-message "in .constexpr. expansion of" }
+}
