[Bug c++/125764] can_substitute returns false for function types with reference return type

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=125764

--- Comment #2 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-16 branch has been updated by Marek Polacek
<mpolacek@gcc.gnu.org>:

https://gcc.gnu.org/g:64e69a5bed2691e47d6f15b086fbe6174dcfdd51

commit r16-9131-g64e69a5bed2691e47d6f15b086fbe6174dcfdd51
Author: Marek Polacek <polacek@redhat.com>
Date:   Fri Jun 12 09:43:52 2026 -0400

    c++/reflection: crash with can_substitute and fn returning ref [PR125764]

    Here we crash in convert_from_reference because it gets a FUNCTION_TYPE
    int&().  Since its return type is a reference, it passes the c_f_r check:

      if (TREE_TYPE (val)
          && TYPE_REF_P (TREE_TYPE (val)))

    and we crash inside that block.

    The call isn't needed since r17-1271:

      return convert_nontype_argument (type, convert_from_reference (arg),
                      complain);

    but we can also avoid calling it on TYPE_P because the function is meant
    for expressions only.

            PR c++/125764

    gcc/cp/ChangeLog:

            * reflect.cc (eval_can_substitute): Don't call
            convert_from_reference on types.

    gcc/testsuite/ChangeLog:

            * g++.dg/reflect/can_substitute3.C: New test.

    Reviewed-by: Patrick Palka <ppalka@redhat.com>
    (cherry picked from commit ea80d5b13dd9c4fdf979234ae24d5d9559402135)