CWG453 References may only bind to “valid” objects

cplusplus · tkoeppe · Apr 15, 2024 · Mar 26, 2024 · Mar 26, 2024 · Mar 27, 2024
commit 47469c02f92b09a1d54d2bd889ef20ee5482ece5
diff --git a/source/declarations.tex b/source/declarations.tex
@@ -3069,16 +3069,46 @@
 specifier\iref{dcl.stc},
 is a class member\iref{class.mem} declaration within a class definition,
 or is the declaration of a parameter or a return type\iref{dcl.fct}; see~\ref{basic.def}.
-A reference shall be initialized to refer to a valid object or function.
+
+\pnum
+Attempting to bind a reference to a function where
+the converted initializer is a glvalue whose
+type is not call-compatible\iref{expr.call}
+with the type of the function's definition
+results in undefined behavior.
+Attempting to bind a reference to an object where
+the converted initializer is a glvalue through which
+the object is not type-accessible\iref{basic.lval}
+results in undefined behavior.
 \begin{note}
 \indextext{reference!null}%
-In particular, a null reference cannot exist in a well-defined program,
-because the only way to create such a reference would be to bind it to
-the ``object'' obtained by indirection through a null pointer,
-which causes undefined behavior.
+The object designated by such a glvalue can be
+outside its lifetime\iref{basic.life}.
+Because a null pointer value or a pointer past the end of an object
+does not point to an object,
+a reference in a well-defined program cannot refer to such things;
+see~\ref{expr.unary.op}.
 As described in~\ref{class.bit}, a reference cannot be bound directly
 to a bit-field.
 \end{note}
+The behavior of an evaluation of a reference\iref{expr.prim.id, expr.ref} that
+does not happen after\iref{intro.races} the initialization of the reference
+is undefined.
+\begin{example}
+\begin{codeblock}
+int &f(int&);
+int &g();
+extern int &ir3;
+int *ip = 0;
+int &ir1 = *ip;                 // undefined behavior: null pointer
+int &ir2 = f(ir3);              // undefined behavior: \tcode{ir3} not yet initialized
+int &ir3 = g();
+int &ir4 = f(ir4);              // undefined behavior: \tcode{ir4} used in its own initializer
+
+char x alignas(int);
+int &ir5 = *reinterpret_cast<int *>(&x);    // undefined behavior: initializer refers to char object
+\end{codeblock}
+\end{example}
 
 \pnum
 \indextext{reference collapsing}%

diff --git a/source/expressions.tex b/source/expressions.tex
@@ -300,23 +300,24 @@
 \end{note}
 
 \pnum
+An object of dynamic type $\tcode{T}_\text{obj}$ is
+\defn{type-accessible} through a glvalue of type $\tcode{T}_\text{ref}$
+if $\tcode{T}_\text{ref}$ is similar\iref{conv.qual} to:
+\begin{itemize}
+\item $\tcode{T}_\text{obj}$,
+
+\item a type that is the signed or unsigned type corresponding to $\tcode{T}_\text{obj}$, or
+
+\item a \keyword{char}, \tcode{\keyword{unsigned} \keyword{char}}, or \tcode{std::byte} type.
+\end{itemize}
 If a program attempts to access\iref{defns.access}
 the stored value of an object through a glvalue
-whose type is not similar\iref{conv.qual} to
-one of the following types the behavior is
-undefined:
+through which it is not type-accessible,
+the behavior is undefined.
 \begin{footnote}
 The intent of this list is to specify those circumstances in which an
 object can or cannot be aliased.
 \end{footnote}
-\begin{itemize}
-\item the dynamic type of the object,
-
-\item a type that is the signed or unsigned type corresponding to the
-dynamic type of the object, or
-
-\item a \keyword{char}, \tcode{\keyword{unsigned} \keyword{char}}, or \tcode{std::byte} type.
-\end{itemize}
 If a program invokes
 a defaulted copy/move constructor or copy/move assignment operator
 for a union of type \tcode{U} with a glvalue argument
@@ -3270,14 +3271,20 @@
 of the class member access\iref{expr.ref,basic.life}.
 
 \pnum
+A type $\tcode{T}_\text{call}$ is
+\defn{call-compatible} with a function type $\tcode{T}_\text{func}$
+if $\tcode{T}_\text{call}$ is the same type as $\tcode{T}_\text{func}$ or
+if the type ``pointer to $\tcode{T}_\text{func}$'' can be
+converted to type ``pointer to $\tcode{T}_\text{call}$''
+via a function pointer conversion\iref{conv.fctptr}.
 Calling a function through an
-expression whose function type \tcode{E} is different
-from the function type \tcode{F} of the called function's
-definition results in undefined behavior
-unless the type ``pointer to \tcode{F}'' can be converted
-to the type ``pointer to \tcode{E}'' via a function pointer conversion\iref{conv.fctptr}.
+expression whose function type
+is not call-compatible with the
+type of the called function's
+definition results in undefined behavior.
 \begin{note}
-The exception applies when the expression has the type of a
+This requirement allows the case
+when the expression has the type of a
 potentially-throwing function, but the called function has
 a non-throwing exception specification,
 and the function types are otherwise the same.