Permitted assignment to read-only capture in not-mutable lambda

[Fedr]

This program

struct B {
    int i;
};

int foo() {
    auto [x] = B{1};
    [x]() {
        x = 2;
    }();
    return x;
}

is invalid because not-mutable lambda modifies its read-only capture x, and it is properly rejected by GCC and MSVC, but Clang erroneously admits it. Online demo: https://gcc.godbolt.org/z/46o6jad8n

[llvmbot]

@llvm/issue-subscribers-clang-frontend

Author: Fedor Chelnokov (Fedr)

Details

This program ``` struct B { int i; };

int foo() {
auto [x] = B{1};
x {
x = 2;
}();
return x;
}

is invalid because not-mutable lambda modifies its read-only capture `x`, and it is properly rejected by GCC and MSVC, but Clang erroneously admits it. Online demo: https://gcc.godbolt.org/z/46o6jad8n
</details>

[shafik]

If we use x=x instead, we obtain the diagnostic we expect: https://gcc.godbolt.org/z/MbjY4a1j8

Which is err_lambda_decl_ref_not_modifiable_lvalue emitted from here:

llvm-project/clang/lib/Sema/SemaExpr.cpp

Line 13507 in a13bc97

DiagID = diag::err_lambda_decl_ref_not_modifiable_lvalue;

It looks like when running E->isModifiableLvalue(...) we end up eventually here:

llvm-project/clang/lib/AST/ExprClassification.cpp

Lines 677 to 680 in a13bc97

	CanQualType CT = Ctx.getCanonicalType(E->getType());
	// Const stuff is obviously not modifiable.
	if (CT.isConstQualified())
	return Cl::CM_ConstQualified;

In the OP's case CT.isConstQualified() is false and I don't see any other point where it could/should catch this case.

[zygoloid]

We're computing the wrong type for the DeclRefExpr. Eg, we reject-valid on this:

void f(int&) = delete;
void f(const int&);

int arr[1];
void foo() {
    auto [x] = arr;
    [x]() { f(x); }();
}

[shafik]

At this point:

llvm-project/clang/lib/Sema/SemaExpr.cpp

Line 3332 in 7cff05a

switch (D->getKind()) {

for the x=x the result of D->getKind() is Var but is Binding for the OP's case.

So it looks like we skip the getCapturedDeclRefType(cast<VarDecl>(VD), Loc); in the OP's case.

When we do the lookup here:

llvm-project/clang/lib/Sema/SemaDecl.cpp

Lines 1281 to 1283 in 8b18684

	LookupResult Result(*this, Found->getDeclName(), NameLoc, LookupOrdinaryName);
	Result.addDecl(Found);
	Result.resolveKind();

We are missing the capture in the OP's case.