<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/61635>61635</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Clang ICE: `invalid parameter index` on `__format_arg__` with invalid index applied to varargs function
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          langston-barrett
      </td>
    </tr>
</table>

<pre>
    This is a fuzzer-generated bug. Feel free to close if you're not interested in such reports. If you would like more reports of fuzzer-generated bugs, let me know and I can post them. I read [the bug report guidelines](https://llvm.org/docs/HowToSubmitABug.html), and did not find information on whether or not fuzzer-generated bugs were welcome.

Clang crashes on this program:
```c
__attribute__ ((__format_arg__(2)))
void test (int i, ...) { }
```
with this message ([godbolt](https://godbolt.org/z/oszqjxGzn)):
```
clang++: /root/llvm-project/clang/include/clang/AST/Type.h:4249: clang::QualType clang::FunctionProtoType::getParamType(unsigned int) const: Assertion `i < getNumParams() && "invalid parameter index"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -gdwarf-4 -g -o /app/output.s -mllvm --x86-asm-syntax=intel -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics -c -O0 <source>
1.      <source>:2:24: current parser token '{'
 #0 0x000055767e07d78f llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x400478f)
 #1 0x000055767e07b4cc llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x40024cc)
 #2 0x000055767dfc8b38 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007f6519e42420 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x14420)
 #4 0x00007f651990f00b raise (/lib/x86_64-linux-gnu/libc.so.6+0x4300b)
 #5 0x00007f65198ee859 abort (/lib/x86_64-linux-gnu/libc.so.6+0x22859)
 #6 0x00007f65198ee729 (/lib/x86_64-linux-gnu/libc.so.6+0x22729)
 #7 0x00007f65198fffd6 (/lib/x86_64-linux-gnu/libc.so.6+0x33fd6)
 #8 0x0000557680ac32d5 getFunctionOrMethodParamType(clang::Decl const*, unsigned int) SemaDeclAttr.cpp:0:0
 #9 0x0000557680af2357 handleFormatArgAttr(clang::Sema&, clang::Decl*, clang::ParsedAttr const&) SemaDeclAttr.cpp:0:0
#10 0x0000557680b1dcee ProcessDeclAttribute(clang::Sema&, clang::Scope*, clang::Decl*, clang::ParsedAttr const&, clang::Sema::ProcessDeclAttributeOptions const&) (.isra.0) SemaDeclAttr.cpp:0:0
#11 0x0000557680b1ebeb clang::Sema::ProcessDeclAttributes(clang::Scope*, clang::Decl*, clang::Declarator const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6aa5beb)
#12 0x0000557680ab5470 clang::Sema::ActOnFunctionDeclarator(clang::Scope*, clang::Declarator&, clang::DeclContext*, clang::TypeSourceInfo*, clang::LookupResult&, llvm::MutableArrayRef<clang::TemplateParameterList*>, bool&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6a3c470)
#13 0x0000557680abb0cf clang::Sema::HandleDeclarator(clang::Scope*, clang::Declarator&, llvm::MutableArrayRef<clang::TemplateParameterList*>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6a420cf)
#14 0x0000557680abbc13 clang::Sema::ActOnStartOfFunctionDef(clang::Scope*, clang::Declarator&, llvm::MutableArrayRef<clang::TemplateParameterList*>, clang::Sema::SkipBodyInfo*, clang::Sema::FnBodyKind) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6a42c13)
#15 0x0000557680754792 clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::LateParsedAttrList*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x66db792)
#16 0x00005576807805a0 clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x67075a0)
#17 0x00005576807486f2 clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x66cf6f2)
#18 0x0000557680748faf clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (.part.0) Parser.cpp:0:0
#19 0x000055768074fa39 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x66d6a39)
#20 0x000055768075038d clang::Parser::ParseTopLevelDecl(clang::OpaquePtr<clang::DeclGroupRef>&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x66d738d)
#21 0x0000557680750854 clang::Parser::ParseFirstTopLevelDecl(clang::OpaquePtr<clang::DeclGroupRef>&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x66d7854)
#22 0x000055768074422a clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x66cb22a)
#23 0x000055767f2a4798 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x522b798)
#24 0x000055767eb09979 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4a90979)
#25 0x000055767ea8dea6 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4a14ea6)
#26 0x000055767ebedb37 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4b74b37)
#27 0x000055767b608ef6 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x158fef6)
#28 0x000055767b604d1a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#29 0x000055767e8eeb0d void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#30 0x000055767dfc9020 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3f50020)
#31 0x000055767e8ef3cf clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#32 0x000055767e8b6c0c clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x483dc0c)
#33 0x000055767e8b76ad clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x483e6ad)
#34 0x000055767e8bf35d clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x484635d)
#35 0x000055767b6073a0 clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x158e3a0)
#36 0x000055767b5134b5 main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x149a4b5)
#37 0x00007f65198f0083 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24083)
#38 0x000055767b5ffa2e _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x1586a2e)
clang++: error: clang frontend command failed with exit code 134 (use -v to see invocation)
Compiler returned: 134
```

This looks like a Clang problem, because it still happens with `-emit-llvm -Xclang -disable-llvm-passes`.

I searched like so for duplicates, but didn't find any:

- https://github.com/llvm/llvm-project/issues?q=is%3Aissue+is%3Aopen+label%3Aclang%3Afrontend+__format_arg__+
- https://github.com/llvm/llvm-project/issues?q=is%3Aissue+is%3Aopen+label%3Aclang%3Afrontend+invalid+parameter+index+
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzkWtty4zbSfhr6BkUVBB514Qv5oMT5J7-9o6mtvVOBYFNCTAIMANryPP0WQMomaNnxZK2karfKo5FwaHR__aG7CYJqzbcC4DxILoLk6ox2ZifVeU3FVhspwoIqBcacFbJ8Ov-24xpxjSiquu_fQYVbEKCogRIV3XaGVgA1qhQAMhKxWmpAvEJPsgtIpgAJaRAXBhRoO4ULpDu2QwpaqYyeoRs3Fj3Kri5Rze8BNVLBoR_J6uiyOiCXqAaDGkD3Qj4iKkp0gxgVqJXaILODZoZukAJaoiC5MDuw0waxaNvxEmouQAfJVUDynTGtDqJlQFYBWdX1QzOTahuQVSmZDsjqZ_n4Ta67ouFmedFtZzvT1AFZWCXswiUvnZ0VF9bCSqqGGi4FkgI97sDsQCGp-iHHjEGPoAA9Qs1kA7MAXwV42X9eWp8gpqjegbbijPVGq-RW0cYq3I9Ncf_H-t-bDTVG8aIzsNmggOQByTebXq0NVdvNJiA5cQa4PzfpQfISGdDGTuDCIG7Nm81mAVmgILtAQXY1Wa7_-cjNrterAa3pFtyKycVWloWszTGEh64B5O8BWUn9_fff9j99F4NKr0zrfzKLR0Au7F-0RAFZKSnN4LOwVfI3YPbnMG7FBau7EkYty_W3gKy-PbUw2wXRMiaxXQz13dEyiJb_6Ght-8dtq04w69E7JY20nX3zFswdVbRxLSTvhNtXlgPGosak0MZKX2oNyjEiSDFHQXSJtmD-v2vcbO08tEABSQOSooAQLh5ozUvU2m4woBAXJewDQgKSoYryGsqBJ3dfrpfra6QdOREds9xINIGdm11XzJhsBsReA8e17sBS3hF7gM9up56EqKDs3ijKwJKjVdAqyUBrKJGWneqb7UyqtWTcMVx1AmmmeGsGldeGsntUdk377GY8C_Dirqc1omrbNSCMHlwsW-dS2bS8BhXCvq2lAnVwakgP6OrQqE7cB2RVcPHic8sWFG7LR6qqMEbhFoXSyqVta6V3pu3MTKOwsVigMNznaUh1E-onYeg-iK5s_KpRuEZhuGUsNFLWbEe5CKKrd9Wzg7Wgrd5Jg8KKyVqqsOR0K6Q2nGkUVkKGDli_maHwFluaDKBG1z1McwuT1xwtif0XOw53SoEwljUaFDLyHgQKSBZkF_bTSUABiTDCe4wxTpIszQBnZZZXyNHBkVo_6f7LneLCOGd96z2evwxS9HEjtVFAG0fbywPnHZc_xWUBucD7GOM4y6vnKGX1n0_0L2LGjul_WQMVXXsr1nwraD3eoLW0q5xCWxIz5mlLxtqWFcuLKEeX1udfgckHUE-9ej9TUdZ20XxA0htzKYWBvZmx1m4a7P49LxENS2RVmswXEJOYYLTZ2JQrFWyUGeyseRGQ1T5PN2kc1lx0-3Arur6jNTubLGdazrCzZR7HBHuWxN4yC1xhXCBFuYYPyGdWctqjFGFceJITT3IOkCcLRAv5Ic1HkgnJk4UnOZ1Kzp69_mGZGfFlZr7MqqrK9MdkRlFVpp7MfMSSHFMWkTKxOeKQeG7Vr2B2shynm1F-ugJWD-mGLO1unKaiNTTUDloao46TaOFrUJEoydDOkXLlKoel2trZ_sJW7hAAJuoMioxa72xcKq2Mg6rpH6tm9zv2VCvmJQNAd33mOcx01c5HdFszadGbKvcDKvvi7CJDuHyt0G3rwoZnb0DyGdeK2n32EevnE-uhgOLjGugJJj9ivW2lihqppgZ8ZtBMKU0KeAkI1mbik7FI4gwft3nJzK047JIXhT9s9WH4MQoPQff1RLsB1y4H34hKvu7_IuV9134F3dUHyrzkp187Q4salkrRp69QBdHlWDI0bU0N3B0qvy-839PRtZVSSFmfygsRizPseSGaeKHArDruhT55_afwfwZGJwAmJphVHjDxFBg2j96h59pQZW6rF5ZWfx8-bwSv9T1vL2T5dJzPL-NWwo76Py7KE0HN5pEHdeJBnSVxtiCvIrQafR-hzAW333yw7SAutu_t_VcyywOkFp63MsF41pce_iF3HPA_AWJpWWQL4iGW-ojlOKH4XessFD8p2bVvArVugR0PkT2Ez4HyjeR5yESvkqeLoV8ko72fjqbfQdWVVF-p2MKN4KcCM8NZQv0QmPlgxnlavU8_C8qtGpHwRhhQ_ePHD2HzsRHvOmjJbDlg-3jFLSIn4B-r0srnXz6FrKLVH0JmeeTK3I9s308Hbsq748DNWqpMX7X1Nhyv1xYT-ysaLd61_3rfM2SEw19j8ynCUUqjxZgOBE8COI7y8l04vsn2CzxA3dekYxxuW_p7B3dG-fnuOX65THj9Xo3-qyy7Gm6aViqzNtQ-MZykmErLLMpLD4f5FIc8id9PZFxp818CRp7EHhhkskdiQugrMNxR7RsPdH0hfPj_FHGtIIR6Oo-r4awiNM4W-VjnS1nCTyCWLnz1Tdd7YJ2BoelwyvupmiaEFNki9zSNvQOyAi8WmReBVsrma1EeUfU0SsZ0gReZHxcST0mal0BTH85-2RuhDRUMjiP6tlUn4XJM5zHQ1DMk9dGGsoiysSGDyi_2PDzXO_l79p4kQsdFFhdR5hkwrnGyIsU5VClibL5pqJUxOvUdP2_sqHo5cRqeLLw2cokeJC9PY8c8ySuofEfkEzvick7RAf3L-TcXKkbWrBta1_8EZqS6adr6qFGT5y4rYyh2vSORUvGHN-oBsvD4kQMUuHTIjORWQ9WzUQ5c19tvxf6QP4iWjNZ1Qdn9phJ-xO_XHkh0Ob-UTUNFOd3VR52ozTBOunMqajEY4WMUF9shj_Qefp6w2bD9fj7vfxRUc7bRbviAojfYNmyMotzoQ_dEHK1ruymkGvXbIcuXGL8cv1Fzr7SymjZFSQOSvUBF8sPR_i-yOOoP__VHWbEFJnjkimPH7n3P106saQX1kwfn-677fOZHVYIx8Z5SJm9Ecqgi_6Dmf44ik3L9TS4QH7giZZi9CZzzHX2VMg9oetF8MtEOeOvc4J2hS6_aGdn2qSkhj0qGmUeoaIJLltLyR3H5RRb6bVB-kcUXro0Hynuh-ZkHLeWWAu69xsdxHMjyl6AJKfVK_yieoFlFyZtoXo2-e5XDkZLhLS_8hWh-foGSx2mU-Pglk8SeRYcTrUOJctDfhZXlEBT-OG1_flECkX-AFHnVYZHMo7hIkNX60xePFzQuEm_x6ZtKjPMIbTY1L2wspspsRpp89H1ojHPviDby666kqigB1Ms_AcIpJfC8_Lg_WiJQyuaH4ToPqoYnAsQGAvc3Z5C7sQR7bslQAppHsdWz04DCB2Qk0gCIj8r0YbFDhY4UmE4JsFvITj56U6n_dJfnainvdX-3jaL-RlerZFFD46IRMGqX5gZpw-sa7WjbgtC9lkGKQ2i4Cfu7Kf_qDQtLrmlRQ9jf3rHw6SDF3tWxG6SBKraD4VqdlqiSCpVdW3NG3RnRJSo6g0peioBkw_U1Kp6C58tX7jP807eIotXvQXTFdUCSaOnaAnIx_JQtiIBc1LSA2jUMrkyi5cFtAbmY3lq7-PtVGu5mBeTi-XaWa3X3sy7OyvOoXEQLegbn8zRbJIQkeX62O2dxVcYZxEWKF3kFNK2KIpnjIosYzjEkZ_ycYBLhiBBCcITzGcmLssjTPF1kkCVxGcQYGsrr2eF-4pnT_zydp1Fy5rTW7kYnIQIe0WAcCZKrM3Xu0HAXJ2Ncc230ixTDTQ3nPS9vLq_dpasUv3UFLcWov8Y2cU2Ke8Ie5rnRiLZtzaG0m-qBKqq2Gh3q5bNO1ed__n6as_rfAQAA__8PLju2">