Default member initializer's implicit this binds to a nested aggregate temporary of the same class

[Momen-G-Ar]

Issue Summary

When the default member initializer of class Y contains an aggregate initialization of another Y, an implicit this->m inside that default member initializer refers to the inner Y temporary rather than the Y object being initialized. The generated code therefore reads the wrong object.

In unsigned n = Y{2, k}.n;, the k is (*this).k ([class.mfct.non-static]/3 in C++17/C++20, [expr.prim.id.general]/2 in the current draft), and in aggregate initialization this is the aggregate whose element is initialized from the default member initializer ([dcl.init.aggr]/5.1, and the C++17 example int d = b[a] in [dcl.init.aggr]/8). So new Y{1} must give n == 1. EDG gives n == 2, the inner temporary's k. The program is well-formed: Y{2, k} initializes n explicitly, so it does not use n's default member initializer ([dcl.init.aggr]/12 in C++20).

This reproduces in EDG 6.5, 6.7, 6.8, 6.9, 7.0 and main, in every mode from --c++17 to --c++26, both in strict mode and with GNU emulation. g++ 15.3 and clang++ 21.1 give n == 1.

Reproducing Source Code

extern "C" void abort();
struct Y {
  unsigned k;
  unsigned n = Y{2, k}.n;   // n = this->k
};
int main() {
  Y *p = new Y{1};
  if (p->n != 1) abort();   // EDG: p->n == 2
}

The program should exit with status 0. With EDG it aborts.

Command-line Options

eccp --c++20 reduced.cpp && ./a.out

Type of Issue

[Back End] There is a problem with the generated C code.

Additional Details

Actual vs expected:

EDG (linux-gcc-debug, EDG_USE_SYSTEM_HEADERS=0 and =1): Aborted, exit 134
g++ 15.3.1 / clang++ 21.1.8 (-std=c++17..c++26):       exit 0

It was originally found with this variant, where y.n is 2 instead of 1:

struct Y {
  static Y bar(Y y) { return y; }
  unsigned k;
  unsigned n = bar(Y{2, k}).n;
};
int main() { Y y{1}; /* EDG: y.n == 2, expected 1 */ }

The lowered C (-k) for that variant shows the wrong object. __T1 is the Y{2, k} temporary:

{ __T1.k = 2U; __T1.n = 0U; }
(__6042_5_y.n) = ((__T4 = ((__T2 = (((__T1.n) = (__T1.k)), __T1)), ((__T3 = __T2), __T3)), __T4.n));

__T1.n = __T1.k should be __T1.n = __6042_5_y.k.

These were checked with main:

• Wrong: the outer object comes from new Y{1}, or from return Y{1}; in a function. Also wrong: the inner Y{2, k} is passed to a function, by value or by const Y&.
• Correct: Y y{1}; and Y a = Y{1}; with n = Y{2, k}.n;; writing this->k explicitly; a nested aggregate of a different class (Z{2, k}); Y with constructors (not an aggregate).

The cause may be lower_param_ref in src/lower_il.c. While lowering a dynamic aggregate constant, it replaces the this of a default member initializer by searching aggregate_this_stack from the innermost entry outward, and it takes the first entry whose type matches. A comment there says "there can only be one". The inner Y{2, k} (pushed in lower_dynamic_init_aggregate_constant, src/lower_init.c) is a second Y entry on top of the outer one, so this binds to the inner temporary.

Front end configuration (--dump_configuration, linux-gcc-debug at 4e739c2): nsdmi_self_aggr_init-config.txt

Reproducing (Standard) Configuration(s)

linux-gcc-debug

Reproducing (Non-standard) Configuration

No response

I acknowledge that:

• I have checked open issues and existing discussions before filing this report.
• The reproducing source code that I have provided does not depend on headers that I have not included with my submission.
• I have reduced the reproducing source code to the best of my ability.
• I have selected at least one standard configuration or uploaded a non-standard configuration dump.
• I understand code shared via this form is NOT confidential.
• I have permission to share the reproducing source code and grant permission for the project to use the source code (or derivatives of the source code) to create tests.
• I agree that any tests created using the reproducing source code (or deriatives of it) will be licensed under project license unless I included a LICENSE.txt file in my .zip or .tar.gz upload. If I included a LICENSE.txt file, any tests created using the reproducing source code will be governed by the terms of the license I provided instead.