PR c++/86521 - wrong overload resolution with ref-qualifiers.

Here we were wrongly treating binding a const lvalue ref to an xvalue as
direct binding, which is wrong under [dcl.init.ref] and [over.match.ref].

gcc/cp/ChangeLog
2020-02-26  Jason Merrill  <jason@redhat.com>

	PR c++/86521 - wrong overload resolution with ref-qualifiers.
	* call.c (build_user_type_conversion_1): Don't use a conversion to a
	reference of the wrong rvalueness for direct binding.

4 files changed, 39 insertions, 2 deletions

diff --git a/gcc/cp/ChangeLog b/gcc/cp/ChangeLog
index f963baa..2b13eba 100644
--- a/gcc/cp/ChangeLog
+++ b/gcc/cp/ChangeLog
@@ -1,3 +1,9 @@
+2020-02-26  Jason Merrill  <jason@redhat.com>
+
+	PR c++/86521 - wrong overload resolution with ref-qualifiers.
+	* call.c (build_user_type_conversion_1): Don't use a conversion to a
+	reference of the wrong rvalueness for direct binding.
+
 2020-02-25  Jason Merrill  <jason@redhat.com>
 
 	PR c++/89831 - error with qualified-id in const member function.
diff --git a/gcc/cp/call.c b/gcc/cp/call.c
index 0b04eb9..dffae0e 100644
--- a/gcc/cp/call.c
+++ b/gcc/cp/call.c
@@ -3895,6 +3895,14 @@ build_user_type_conversion_1 (tree totype, tree expr, int flags,
 	      cand->reason = arg_conversion_rejection (NULL_TREE, -2,
 						       rettype, totype);
 	    }
+	  else if (TYPE_REF_P (totype) && !ics->rvaluedness_matches_p
+		   && TREE_CODE (TREE_TYPE (totype)) != FUNCTION_TYPE)
+	    {
+	      /* If we are called to convert to a reference type, we are trying
+		 to find a direct binding per [over.match.ref], so rvaluedness
+		 must match for non-functions.  */
+	      cand->viable = 0;
+	    }
 	  else if (DECL_NONCONVERTING_P (cand->fn)
 		   && ics->rank > cr_exact)
 	    {
diff --git a/gcc/testsuite/g++.dg/cpp0x/overload-conv-3.C b/gcc/testsuite/g++.dg/cpp0x/overload-conv-3.C
new file mode 100644
index 0000000..42a135d
--- /dev/null
+++ b/gcc/testsuite/g++.dg/cpp0x/overload-conv-3.C
@@ -0,0 +1,21 @@
+// PR c++/86521
+// { dg-do compile { target c++11 } }
+
+template <class T> T&& move (T&);
+
+struct Dest {
+  Dest() = default;
+  Dest( Dest && ) = default;
+  Dest( Dest const & ) = delete;
+};
+
+struct Source {
+  Dest val;
+  operator Dest () && { return move( val ); }
+  operator Dest const & () const & { return val; }
+};
+
+int main() {
+  Source x;
+  Dest d(move(x));		// { dg-error "ambiguous" }
+}
diff --git a/libstdc++-v3/testsuite/20_util/is_constructible/value-2.cc b/libstdc++-v3/testsuite/20_util/is_constructible/value-2.cc
index a2cb9ca..8864479 100644
--- a/libstdc++-v3/testsuite/20_util/is_constructible/value-2.cc
+++ b/libstdc++-v3/testsuite/20_util/is_constructible/value-2.cc
@@ -806,10 +806,12 @@ static_assert(!std::is_constructible<int&&, ExplicitTo<int>>::value, "Error");
 // Binding through reference-compatible type is required to perform
 // direct-initialization as described in [over.match.ref] p. 1 b. 1:
 static_assert(std::is_constructible<int&, ExplicitTo<int&>>::value, "Error");
-static_assert(std::is_constructible<const int&, ExplicitTo<int&&>>::value,
-	      "Error");
 static_assert(std::is_constructible<int&&, ExplicitTo<int&&>>::value, "Error");
 
+// But an xvalue doesn't count for direct binding.
+static_assert(!std::is_constructible<const int&, ExplicitTo<int&&>>::value,
+	      "Error");
+
 // Binding through temporary behaves like copy-initialization,
 // see [dcl.init.ref] p. 5, very last sub-bullet:
 static_assert(!std::is_constructible<const int&, ExplicitTo<double&&>>::value,