I will answer the question first, and then provide some context for the answer. The current working draft contains the following wording:
The temporary object to which the reference is bound or the temporary object that is the complete object of a subobject to which the reference is bound persists for the lifetime of the reference if the glvalue to which the reference is bound was obtained through one of the following:
- a temporary materialization conversion ([conv.rval]),
(
expression )
, where expression is one of these expressions,
- subscripting ([expr.sub]) of an array operand, where that operand is one of these expressions,
- a class member access ([expr.ref]) using the
.
operator where the left operand is one of these expressions and the right operand designates a non-static data member of non-reference type,
- a pointer-to-member operation ([expr.mptr.oper]) using the
.*
operator where the left operand is one of these expressions and the right operand is a pointer to data member of non-reference type,
- a
const_cast
([expr.const.cast]), static_cast
([expr.static.cast]), dynamic_cast
([expr.dynamic.cast]), or reinterpret_cast
([expr.reinterpret.cast])
converting, without a user-defined conversion, a glvalue operand that is one of these expressions to a glvalue that refers to the object designated by the operand, or to its complete object or a subobject thereof,
- a conditional expression ([expr.cond]) that is a glvalue where the second or third operand is one of these expressions, or
- a comma expression ([expr.comma]) that is a glvalue where the right operand is one of these expressions.
According to this, when a reference is bound to a glvalue returned from a function call, lifetime extension does not occur, because the glvalue was obtained from the function call, which is not one of the permitted expressions for lifetime extension.
The lifetime of the y+1
temporary is extended once when bound to the reference parameter b
. Here, the prvalue y+1
is materialized to yield an xvalue, and the reference is bound to the result of the temporary materialization conversion; lifetime extension thus occurs. When the min
function returns, however, ref2
is bound to the result of the call, and lifetime extension does not occur here. Therefore, the y+1
temporary is destroyed at the end of the definition of ref2
, and ref2
becomes a dangling reference.
There has historically been some confusion on this topic. It is well-known that the OP's code and similar code result in a dangling reference, but the standard text, even as of C++17, did not provide an unambiguous explanation as to why.
It is often claimed that lifetime extension only applies when the reference binds "directly" to the temporary, but the standard has never said anything to that effect. Indeed, the standard defines what it means for a reference to "bind directly", and that definition (e.g., const std::string& s = "foo";
is an indirect reference binding) is clearly not relevant here.
Rakete1111 has said in a comment elsewhere on SO that lifetime extension only applies when the reference binds to a prvalue (rather than some glvalue that was obtained through a previous reference binding to that temporary object); they appear to be saying something similar here by "bound ... directly". However, there is no textual support for this theory. Indeed, code like the following has sometimes been considered to trigger lifetime extension:
struct S { int x; };
const int& r = S{42}.x;
However, in C++14, the expression S{42}.x
became an xvalue, so if lifetime extension applies here, then it is not because the reference binds to a prvalue.
One might instead claim that lifetime extension only applies once, and binding any other references to the same object do not further extend its lifetime. This would explain why the OP's code creates a dangling reference, without preventing lifetime extension in the S{42}.x
case. However, there is no statement to this effect in the standard, either.
StoryTeller has also said here that the reference must bind directly, but I don't know what he means by that, either. He cites standards text indicating that binding a reference to a temporary in a return
statement doesn't extend its lifetime. However, that statement seems to be intended to apply to the case where the temporary in question is created by the full-expression in the return
statement, since it says the temporary will be destroyed at the end of that full-expression. Clearly that's not the case for the y+1
temporary, which will instead be destroyed at the end of the full-expression containing the call to min
. Thus, I tend to think that this statement was not intended to apply to cases like that in the question. Instead, its effect, together with the other limitations on lifetime extension, is to prevent any temporary object's lifetime from being extended beyond the block scope in which it was created. But this would not prevent the y+1
temporary in the question from surviving until the end of main
.
Thus the question remains: what is the principle that explains why the binding of ref2
to the temporary in the question doesn't extend that temporary's lifetime?
The wording from the current working draft that I cited earlier was introduced by the resolution of CWG 1299, which was opened in 2011 but only resolved recently (not in time for C++17). In a sense, it clarifies the intuition that the reference must bind "directly", by delineating those cases where the binding is "direct" enough for lifetime extension to occur; it is not, however, so restrictive as to only allow it when the reference binds to a prvalue. It permits lifetime extension in the S{42}.x
case.