c++: constexpr pointer indirection with negative offset [PR100209]

During constexpr evaluation, a base-to-derived conversion may yield an
expression like (Derived*)(&D.2217.D.2106 p+ -4) where D.2217 is the
derived object and D.2106 is the base.  But cxx_fold_indirect_ref
doesn't know how to resolve an INDIRECT_REF thereof to just D.2217,
because it doesn't handle POINTER_PLUS_EXPR of a COMPONENT_REF with
negative offset well: when the offset N is positive, it knows that
'&x p+ N' is equivalent to '&x.f p+ (N - bytepos(f))', but it doesn't
know about the reverse transformation, that '&x.f p+ N' is equivalent
to '&x p+ (N + bytepos(f))' when N is negative, which is important for
resolving such base-to-derived conversions and for accessing subobjects
backwards.  This patch teaches cxx_fold_indirect_ref this reverse
transformation.

gcc/cp/ChangeLog:

	PR c++/100209
	* constexpr.c (cxx_fold_indirect_ref): Try to canonicalize the
	object/offset pair for a POINTER_PLUS_EXPR of a COMPONENT_REF
	with a negative offset into one whose offset is nonnegative
	before calling cxx_fold_indirect_ref_1.

gcc/testsuite/ChangeLog:

	PR c++/100209
	* g++.dg/cpp1y/constexpr-base1.C: New test.
	* g++.dg/cpp1y/constexpr-ptrsub1.C: New test.

gcc/cp/constexpr.c

@@ -4894,12 +4894,26 @@ cxx_fold_indirect_ref (const constexpr_ctx *ctx, location_t loc, tree type,
 	   && tree_fits_uhwi_p (TREE_OPERAND (sub, 1)))
     {
       tree op00 = TREE_OPERAND (sub, 0);
-      tree op01 = TREE_OPERAND (sub, 1);
+      tree off = TREE_OPERAND (sub, 1);
 
       STRIP_NOPS (op00);
       if (TREE_CODE (op00) == ADDR_EXPR)
-	return cxx_fold_indirect_ref_1 (ctx, loc, type, TREE_OPERAND (op00, 0),
-					tree_to_uhwi (op01), empty_base);
+	{
+	  tree obj = TREE_OPERAND (op00, 0);
+	  while (TREE_CODE (obj) == COMPONENT_REF
+		 && tree_int_cst_sign_bit (off))
+	    {
+	      /* Canonicalize this object/offset pair by iteratively absorbing
+		 the innermost component into the offset until the offset is
+		 nonnegative, so that cxx_fold_indirect_ref_1 can identify
+		 more folding opportunities.  */
+	      tree field = TREE_OPERAND (obj, 1);
+	      off = int_const_binop (PLUS_EXPR, off, byte_position (field));
+	      obj = TREE_OPERAND (obj, 0);
+	    }
+	  return cxx_fold_indirect_ref_1 (ctx, loc, type, obj,
+					  tree_to_uhwi (off), empty_base);
+	}
     }
   /* *(foo *)fooarrptr => (*fooarrptr)[0] */
   else if (TREE_CODE (TREE_TYPE (subtype)) == ARRAY_TYPE

gcc/testsuite/g++.dg/cpp1y/constexpr-base1.C

@@ -0,0 +1,28 @@
+// PR c++/100209
+// { dg-do compile { target c++14 } }
+
+template<typename Derived>
+struct __a_t
+{
+  unsigned char A = 0;
+  constexpr Derived & SetA(const unsigned char & value) {
+    A = value;
+    return *static_cast<Derived *>(this);
+  }
+};
+
+template<typename Derived>
+struct __b_t
+{
+  unsigned char B = 0;
+  constexpr Derived & SetB(const unsigned char & value) {
+    B = value;
+    return *static_cast<Derived *>(this);
+  }
+};
+
+struct __ab_t : __a_t<__ab_t>, __b_t<__ab_t> { };
+
+constexpr auto AB = __ab_t().SetA(100).SetB(10);
+static_assert(AB.A == 100, "");
+static_assert(AB.B == 10, "");

gcc/testsuite/g++.dg/cpp1y/constexpr-ptrsub1.C

@@ -0,0 +1,23 @@
+// PR c++/100209
+// { dg-do compile { target c++14 } }
+
+struct A {
+  int x = 1;
+};
+
+struct B : A {
+  int y = 2;
+  int z = 3;
+  int w = 4;
+};
+
+constexpr bool f() {
+  B b;
+  if (&b.w - &b.x != 3)
+    /* Effectively disable this test if the layout of B isn't
+       what we expect.  */
+    return true;
+  const int* w = &b.w;
+  return *w-- == 4 && *w-- == 3 && *w-- == 2 && *w-- == 1;
+}
+static_assert(f(), "");