<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello all,<div class=""><br class=""></div><div class="">I was investigating the bug <a href="https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=4985" class="">Heap-use-after-free in clang::APValue::swap</a> which corresponds to the more human-friendly form</div><div class=""><br class=""></div><div class=""><div class="">struct S {</div><div class=""> union {</div><div class=""> int i = i = 3;</div><div class=""> };</div><div class=""> constexpr S() {}</div><div class="">};</div><div class="">static_assert(S().i == 3, "”);</div></div><div class=""><br class=""></div><div class="">When you compile this example with</div><div class="">clang -std=c++14 -fsyntax-only</div><div class=""><br class=""></div><div class="">it crashes Clang 5.0.0, 4.0.0, 3.9.0 and running with ASAN shows there is use after free in APValue hierarchy caused by the `i` on the right hand side. If anybody is interested I can provide more details about the mechanism of the crash but it’s not important for the question I have.</div><div class=""><br class=""></div><div class="">Should Clang accept such code at all according to C++14 constexpr evaluation rules? GCC 7.2 rejects it, Clang ToT with -std=c++11 rejects it too. Also it would be helpful to shed some light on the differences between C++11 and C++14 for this example as for `int i = i;` and -std=c++11 Clang hits the assertion</div><div class=""><blockquote type="cite" class="">Assertion failed: (isInt() && "Invalid accessor"), function getInt, file clang/include/clang/AST/APValue.h, line 202.</blockquote></div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Volodymyr</div></body></html>