<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/73901>73901</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            This is a bug in ASTContext.cpp:  ASTContext::getTypeInfoImpl(const Type *T) ?
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          xytywh
      </td>
    </tr>
</table>

<pre>
    The source code snippets is as follows:

### test.c
```#include <stdarg.h>

unsigned int test(int count, ...) {
    unsigned int ret = 0;
    va_list args;
    va_start(args, count);

    for (int i = 0; i < count; ++i) {
        int value = va_arg(args, int);
        // handle value
    }

    va_end(args);
    return ret;
}

int main() {
   return 0;
}
```
I write a CSA checker to find some bugs，when I use PreStmt:
```
void xxChecker::checkPreStmt(const Stmt *S, CheckerContext &C) const {
  auto expr = dyn_cast<Expr>(S);
  expr = expr->IgnoreImpCasts();
  if (expr) {
    TypeInfo FieldInfo =
        C.getASTContext().getTypeInfo(expr->getType().getTypePtr());
    unsigned int size = FieldInfo.Width / 8;
}
```
in Ubuntu 20, when I run command: `path-to/bin/clang -cc1 -analyze -analyzer-checker=aboveChecker -I/usr/include -I/usr/include/x86_64-linux-gnu/ -I/usr/lib/gcc/x86_64-linux-gnu/9/include/ test.c` , there is an error, finally crash in :
```
ASTContext.cpp:  ASTContext::getTypeInfoImpl(const Type *T)
...
...
 case Type::Builtin:
    switch (cast<BuiltinType>(T)->getKind()) {
    default: llvm_unreachable("Unknown builtin type!"); // here crash
```
I found when PreStmt deal with  `va_start(args, count);' in test.c, 'expr->getType().getTypePtr()' incheckPreStmt dump() is: 

```
BuiltinType 0x5555556c6d10 '<builtin fn type>'
'''

so, in  `ASTContext::getTypeInfoImpl`, cast<BuiltinType>(T)->getKind() will be `BuiltinType::BuiltinFn', is this a bug? or should deal with this kind of type, like add a new case BuiltinType::BuiltinFn is a better solution? 
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJysVkuP4joT_TVmUwIFGxJ6waIJHQl9m5G6R9-y5cSG-LaxkR885tdflRPopGdGc690UQTGqTr1OMeVcO_VwUi5JssNWW4nPIbWuvX1Fm6XdlJbcVu_tRK8ja6R0FghwRt1OsngQXngHvZWa3vxhD2TbEuy-zdl3QVB-jBr-t086y_KlGl0FBIIK30Q3B1mLWEvQ4xoUm4ClAkJhtAVLhsbTSC0hNlsRugTkGLTOQAAjJycDEDYFjLCBiZn_q6VD8DdwX-94QN3GCfdo-U91tPD7tN6bx30GalHlLS8u7ENELohdKN-ShM_6HnmOsrkfebv3B0GodU48N2L0IrQClpuhJad_6cBKbZf0zzzd2nEA3cM6GSIzuDPZ4FjCEzyyJUhdPW1iN45-4Xrg-f0dwcXp4IEDuXrMzStbD6kg2Bhr4wAb48S6njw5KUim5KsyksrDewgegnfnHwNx_CprjHy2SoB12vZQaIVe074dz-6aqzxAfAPEPr8ip3tzUtrgrzidl5ibZ3loEIegwV5PblEkLiZ94b7QFj5cj05FCtdvY47-jDGxZSwl93BWCd3x1PJffBdEwf2ao8SQuOfFPJ2O8md2VuolNQirQjbjrVQzg4yPL--9ZV08Lh3d-7BMZN-d2zzLbg-py_CGB0jr350Gn2kMvu_EqFFLcLqj_QrA9_raEIEmmH7e3pdNNDY45EbQdgzkDw78dBOgyW0qlFwVaO5OcC0aeYw5Ybr2w_5WLhpcyd9y2t7lj2pMN0RWkXvCK3uI-bnLUKr6yp_zxdTrUy8Tg8mYi0DQ61qQqtD0_za9GmEdR9yeQZYYGilk2k8GpDOWYebe2W41jdoHPctKAO_0_Qnn7PmdMLWwIDiJPEBw7vjST9Ujpuo8jekM4HhiBwvoOFeJssOaxOVDso8skH2_UWFBuld9YLvjTov1D1G6FX1P5XGSyeisYaF3POoMWnQ-nx8j8ZJ3rS81p0O6XfzYezFQN3hQ0gKnRNKO0E-ph02NHXuNwNmb6MRnbL6ow9Ccg0XFVpAbf1httMCKelppCUQWvzTg4Oew5kDIh5P_bhUPkl7-GAcZz5oLGTXZfrkTS7mqKSCsPLemX3fHOx-cX_GFv01wPe2e3akov-kmzydx3_FMVyU1lBLhB95DLRUmZRXiUcgtHgOcL4TVoF14FsbtRiwkyw-8Elg970AStDqQwIXAjgYeek0-_tw0MWQIUgH3uoYlDUYbyLWTDyxJz6R63mRzRktFnk2adernGdisXza81rIrJZstagXi0LsM1rUYiknak0zyuZzlmX5slhkM7lc1kW-4s1qz_KcMbLI5JErPUNlz6w7TJT3Ua4L9pTNJ5rXUvv0VkUpVpBuoq6X24lbo880PfMWGb6L-E-UoIKW6zdsyr1zSOd_NBWAsGoSnV63IZzSS1s6YAcV2ljPGnvE0afP95_pydm_ZBNw2mEBntAqFfh3AAAA__-w1ASb">