[clang] [Clang] Allow devirtualization involving array subscripts with constant indices when the pointee type is known (PR #207540)
via cfe-commits
cfe-commits at lists.llvm.org
Sat Jul 11 09:08:27 PDT 2026
https://github.com/AZero13 updated https://github.com/llvm/llvm-project/pull/207540
>From de8a23d5fd6e2f681d82974ab27bc31e2959364c Mon Sep 17 00:00:00 2001
From: AZero13 <gfunni234 at gmail.com>
Date: Sat, 4 Jul 2026 16:41:32 -0400
Subject: [PATCH] [Clang] Allow devirtualization involving array subscripts
with constant indices when the pointee type is known
By C++17 [expr.add]/6, if the array element type and the pointee type are not similar, behavior is undefined.
---
clang/docs/ReleaseNotes.md | 6 +++
clang/lib/AST/DeclCXX.cpp | 32 ++++++++++++++
clang/test/CXX/drs/cwg15xx.cpp | 19 ++++++++
.../devirtualize-virtual-function-calls.cpp | 43 ++++++++++++++++++-
clang/www/cxx_dr_status.html | 2 +-
5 files changed, 99 insertions(+), 3 deletions(-)
diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md
index bbd42848a98c2..fedaeebf76520 100644
--- a/clang/docs/ReleaseNotes.md
+++ b/clang/docs/ReleaseNotes.md
@@ -275,6 +275,9 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the
#### Resolutions to C++ Defect Reports
+- Clang now implements [CWG1504](https://cplusplus.github.io/CWG/issues/1504.html)
+ which makes pointer arithmetic after derived-base conversion undefined behavior,
+ allowing devirtualization of calls through non-zero array subscripts.
- Implemented [CWG1780 Explicit instantiation/specialization of generic lambda
operator()](https://cplusplus.github.io/CWG/issues/1780.html)
- Clang now allows omitting `typename` before a template name in a
@@ -323,6 +326,9 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the
### Non-comprehensive list of changes in this release
+- Clang can now devirtualize virtual function calls on objects accessed through
+ array subscript expressions with non-zero constant indices, based on the
+ resolution of [CWG1504](https://cplusplus.github.io/CWG/issues/1504.html).
- Added support for floating point and pointer values in most `__atomic_`
builtins.
- Added `__builtin_stdc_rotate_left` and `__builtin_stdc_rotate_right`
diff --git a/clang/lib/AST/DeclCXX.cpp b/clang/lib/AST/DeclCXX.cpp
index 0573cdf95952a..b78ab4393cc7a 100644
--- a/clang/lib/AST/DeclCXX.cpp
+++ b/clang/lib/AST/DeclCXX.cpp
@@ -2600,6 +2600,38 @@ CXXMethodDecl *CXXMethodDecl::getDevirtualizedMethod(const Expr *Base,
}
}
+ // By CWG1504 / [expr.add]/6, pointer arithmetic on a base pointer into an
+ // array of derived objects is undefined behavior when the element type and
+ // pointee type are not similar. This means we can devirtualize calls on
+ // objects accessed through array subscripts or pointer arithmetic with
+ // non-zero offsets, since the dynamic type must match the static type.
+ //
+ // A single object is considered to be an array of one element, so p[0]
+ // could still be a derived object, but p[N] for N != 0 cannot.
+ const Expr *Inner = Base->IgnoreParenImpCasts();
+
+ // Handle p[N].f() (dot syntax with array subscript).
+ if (const auto *ASE = dyn_cast<ArraySubscriptExpr>(Inner)) {
+ Expr::EvalResult Result;
+ if (ASE->getIdx()->EvaluateAsInt(Result, getASTContext()) &&
+ !Result.Val.getInt().isZero())
+ return DevirtualizedMethod;
+ }
+
+ // Handle (p + N)->f() (arrow syntax with pointer arithmetic).
+ if (const auto *BO = dyn_cast<BinaryOperator>(Inner)) {
+ if (BO->getOpcode() == BO_Add || BO->getOpcode() == BO_Sub) {
+ // Identify the integer operand (the offset).
+ const Expr *IdxExpr = BO->getLHS()->getType()->isPointerType()
+ ? BO->getRHS()
+ : BO->getLHS();
+ Expr::EvalResult Result;
+ if (IdxExpr->EvaluateAsInt(Result, getASTContext()) &&
+ !Result.Val.getInt().isZero())
+ return DevirtualizedMethod;
+ }
+ }
+
// We can't devirtualize the call.
return nullptr;
}
diff --git a/clang/test/CXX/drs/cwg15xx.cpp b/clang/test/CXX/drs/cwg15xx.cpp
index 5a9b80ed028c4..53f262740eae2 100644
--- a/clang/test/CXX/drs/cwg15xx.cpp
+++ b/clang/test/CXX/drs/cwg15xx.cpp
@@ -11,6 +11,25 @@
// cxx98-error at -1 {{variadic macros are a C99 feature}}
#endif
+namespace cwg1504 { // cwg1504: 23
+#if __cplusplus >= 201103L
+ // CWG1504: Pointer arithmetic after derived-base conversion
+ struct Base { int x; };
+ struct Derived : Base { int y; };
+ constexpr Derived arr[2] = {};
+
+ // Pointer arithmetic on a base pointer into a derived array is UB,
+ // and the constexpr evaluator must diagnose it.
+ constexpr int test(int n) {
+ return ((const Base*)arr)[n].x; // #cwg1504-x
+ }
+ constexpr int bad = test(1);
+ // since-cxx11-error at -1 {{constexpr variable 'bad' must be initialized by a constant expression}}
+ // since-cxx11-note@#cwg1504-x {{cannot access field of pointer past the end of object}}
+ // since-cxx11-note at -3 {{in call to 'test(1)'}}
+#endif
+} // namespace cwg1504
+
namespace cwg1512 { // cwg1512: 4
void f(char *p) {
if (p > 0) {}
diff --git a/clang/test/CodeGenCXX/devirtualize-virtual-function-calls.cpp b/clang/test/CodeGenCXX/devirtualize-virtual-function-calls.cpp
index b50881db63e05..bfee72464176d 100644
--- a/clang/test/CodeGenCXX/devirtualize-virtual-function-calls.cpp
+++ b/clang/test/CodeGenCXX/devirtualize-virtual-function-calls.cpp
@@ -92,10 +92,49 @@ void fd(D d, XD xd, D *p) {
// CHECK: call void %
p[0].f();
- // FIXME: We can devirtualize this, by C++1z [expr.add]/6 (if the array
+ // We can devirtualize this, by CWG1504 / [expr.add]/6 (if the array
// element type and the pointee type are not similar, behavior is undefined).
- // CHECK: call void %
+ // CHECK: call void @_ZN1A1fEv
p[1].f();
+
+ // Negative indices are also UB for the same reason.
+ // CHECK: call void @_ZN1A1fEv
+ p[-1].f();
+
+ // Pointer arithmetic with arrow syntax: (p + N)->f()
+ // CHECK: call void @_ZN1A1fEv
+ (p + 1)->f();
+
+ // Pointer subtraction with arrow syntax: (p - N)->f()
+ // CHECK: call void @_ZN1A1fEv
+ (p - 1)->f();
+
+ // Can't devirtualize with non-constant index; we can't prove N != 0.
+ int n = 1;
+ // CHECK: call void %
+ p[n].f();
+
+ // Zero through expression: p[1-1] evaluates to 0, can't devirtualize.
+ // CHECK: call void %
+ p[1-1].f();
+
+ // (p + 0)->f() also can't be devirtualized (same as *p).
+ // CHECK: call void %
+ (p + 0)->f();
+
+ // 1 + p is legal pointer arithmetic too.
+ // CHECK: call void @_ZN1A1fEv
+ (1 + p)->f();
+
+ // Constant variables are evaluated.
+ const int N = 1;
+ // CHECK: call void @_ZN1A1fEv
+ p[N].f();
+
+ // Pointer arithmetic with deref: *(p + 1)
+ // This is a UnaryOperator, which our current AST matching doesn't catch.
+ // CHECK: call void %
+ (*(p + 1)).f();
}
struct B {
diff --git a/clang/www/cxx_dr_status.html b/clang/www/cxx_dr_status.html
index af91ac559d274..73c8be98e7848 100755
--- a/clang/www/cxx_dr_status.html
+++ b/clang/www/cxx_dr_status.html
@@ -10309,7 +10309,7 @@ <h2 id="cxxdr">C++ defect report implementation status</h2>
<td>[<a href="https://wg21.link/expr.add">expr.add</a>]</td>
<td>CD3</td>
<td>Pointer arithmetic after derived-base conversion</td>
- <td class="unknown" align="center">Unknown</td>
+ <td class="full" align="center">Clang 23</td>
</tr>
<tr id="1505">
<td><a href="https://cplusplus.github.io/CWG/issues/1505.html">1505</a></td>
More information about the cfe-commits
mailing list