<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/74269>74269</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            clang-tidy crash in `clang::FunctionDecl::getNumParams()`
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang,
            clang-tidy
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          paulaltin
      </td>
    </tr>
</table>

<pre>
    `clang-tidy-17` (version 17.0.6) crashes when run on the test program below.

```
#include <cstdio>

template<typename... Args>
void log(const char* fmt, const Args&... args) {
    auto f = snprintf;
    int n = f(nullptr, 0, fmt, args...);
}

int main() {
    log("%d", 1);
    return 0;
}
```

The output is:

```
Stack dump:
0.      Program arguments: clang-tidy-17 test.cpp
1.      <eof> parser at end of file
2.      While analyzing stack: 
        #0 Calling log(const char *, const int &) at line 13
        #1 Calling main()
3.      test.cpp:7:13: Error evaluating statement
4.      test.cpp:7:13: Error evaluating statement
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0  libLLVM-17.so.1 0x00007f5a91267406 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) + 54
1  libLLVM-17.so.1    0x00007f5a912655b0 llvm::sys::RunSignalHandlers() + 80
2  libLLVM-17.so.1    0x00007f5a91267a9b
3  libc.so.6 0x00007f5a9007b520
4  libclang-cpp.so.17 0x00007f5a988e1981 clang::FunctionDecl::getNumParams() const + 1
5  libclang-cpp.so.17 0x00007f5a9a79424d
6  libclang-cpp.so.17 0x00007f5a9a794530
7 libclang-cpp.so.17 0x00007f5a9a6b8660 clang::ento::CheckerManager::runCheckersForEvalCall(clang::ento::ExplodedNodeSet&, clang::ento::ExplodedNodeSet const&, clang::ento::CallEvent const&, clang::ento::ExprEngine&, clang::ento::EvalCallOptions const&) + 480
8 libclang-cpp.so.17 0x00007f5a9a6fc598 clang::ento::ExprEngine::evalCall(clang::ento::ExplodedNodeSet&, clang::ento::ExplodedNode*, clang::ento::CallEvent const&) + 392
9 libclang-cpp.so.17 0x00007f5a9a6fc2f5 clang::ento::ExprEngine::VisitCallExpr(clang::CallExpr const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&) + 453
10 libclang-cpp.so.17 0x00007f5a9a6dc0ca clang::ento::ExprEngine::Visit(clang::Stmt const*, clang::ento::ExplodedNode*, clang::ento::ExplodedNodeSet&) + 8826
11 libclang-cpp.so.17 0x00007f5a9a6d81c3 clang::ento::ExprEngine::ProcessStmt(clang::Stmt const*, clang::ento::ExplodedNode*) + 611
12 libclang-cpp.so.17 0x00007f5a9a6d7eef clang::ento::ExprEngine::processCFGElement(clang::CFGElement, clang::ento::ExplodedNode*, unsigned int, clang::ento::NodeBuilderContext*) + 175
13 libclang-cpp.so.17 0x00007f5a9a6bf3a7 clang::ento::CoreEngine::dispatchWorkItem(clang::ento::ExplodedNode*, clang::ProgramPoint, clang::ento::WorkListUnit const&) + 551
14 libclang-cpp.so.17 0x00007f5a9a6bef11 clang::ento::CoreEngine::ExecuteWorkList(clang::LocationContext const*, unsigned int, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) + 1201
15 libclang-cpp.so.17 0x00007f5a9aada16a
16 libclang-cpp.so.17 0x00007f5a9aaba0fc
17 libclang-cpp.so.17 0x00007f5a9a3dde4c clang::MultiplexConsumer::HandleTranslationUnit(clang::ASTContext&) + 44
18 libclang-cpp.so.17 0x00007f5a98683816 clang::ParseAST(clang::Sema&, bool, bool) + 614
19 libclang-cpp.so.17 0x00007f5a9a3a30c5 clang::FrontendAction::Execute() + 85
20 libclang-cpp.so.17 0x00007f5a9a31e6c4 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) + 708
21 libclang-cpp.so.17 0x00007f5a9a6245c7 clang::tooling::FrontendActionFactory::runInvocation(std::shared_ptr<clang::CompilerInvocation>, clang::FileManager*, std::shared_ptr<clang::PCHContainerOperations>, clang::DiagnosticConsumer*) + 423
22 clang-tidy-17 0x000055d44be8d478
23 libclang-cpp.so.17 0x00007f5a9a624304 clang::tooling::ToolInvocation::runInvocation(char const*, clang::driver::Compilation*, std::shared_ptr<clang::CompilerInvocation>, std::shared_ptr<clang::PCHContainerOperations>) + 276
24 libclang-cpp.so.17 0x00007f5a9a6230c4 clang::tooling::ToolInvocation::run() + 1412
25 libclang-cpp.so.17 0x00007f5a9a625b5f clang::tooling::ClangTool::run(clang::tooling::ToolAction*) + 3679
26 clang-tidy-17      0x000055d44be897d1 clang::tidy::runClangTidy(clang::tidy::ClangTidyContext&, clang::tooling::CompilationDatabase const&, llvm::ArrayRef<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, llvm::IntrusiveRefCntPtr<llvm::vfs::OverlayFileSystem>, bool, bool, llvm::StringRef) + 1057
27 clang-tidy-17      0x000055d44b189b04 clang::tidy::clangTidyMain(int, char const**) + 10724
28 libc.so.6 0x00007f5a90062d90
29 libc.so.6          0x00007f5a90062e40 __libc_start_main + 128
30 clang-tidy-17      0x000055d44b184e65 _start + 37
Segmentation fault (core dumped)
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJy8WF2T2jrS_jWeG1UoWf6-4IJh4E2qkpOpMO85tXtDyXYbtBGSS5LJcH79liwZDJmJOfuVSg1gtbr76X661RbVmu0EwDxIHoPk6YF2Zi_VvKUdp9ww8VDK-jQPUlxxKnYfDKtPH8IsSDEKSH4EpZkUKMxmeJYGpECVonoPGv3Yg0CqE0gKZPaADGiDWiV3ih5QCVz-mAX4KcAL_zfF_r_7SSImKt7VgIJoWWlTMxlEq_EOA4eWUwNBtDSnFgQ9wGw2Qwu102fJo2Q14nIXkLySQhtU7akKyAI1BxOQJXIP-y0ktbtp_7VAQfboNCCEEO2MRA0KoiekRauYME0QjdaZMEj0y01ActFx3hpl1WP7x5uymmezWUCK894gexoDsmoOlImA5D-54DAEhAQkqfuPJQrHuqyQAtMpgfAbBm6i2_992QOSnWk7g5gOosUv0rExtPqO6u7QnuXwLMDFs88nVbvuAMJYNeiKJ33eZ1Xbul2h3RVES5BNEK1QS5UGhahBIGokG9QwDk6SWMk_9owDooLy059M7JC2flgbg69FQCKMlpRzu3ybaRSQxSXNNr4B6UlKDeJMAAqjsaLwrOiSBrceWWfOSKJFFkSLMLKOrJSSCsGR8o4a76IBGwu3M_6Xd15ijn4ws5edQfp0KCVHluraVh8I3SlAJ9mhPT0C4vx4-OCE2J-gEBN2TaHnxctHJBXSYPpaBHFkSgprCx1tmFL8-fPvX7abv315_Pr5099X37Z2i61xI1ErbeSMRMz0jBsIgBBnpd33IcxmWs5ChF8xxjhrElqEJM1inPYu2S3RQp-0-_JsK6hH96JoBQHJL0KK_thKbRTQQ5-qpc1aXw3kESWxJ9HPlhG6MZ4kJX7L-LdObNhOUP6RipqD0kO1kUeUe7aTO_RntCg9N3rpysqlYyGMszIhXmXshPrKqNq2V5qNpfMcwiIPXfE4V9edqAyT4gkq7p7swPzWHZ6poofBb0dt633oLCVTlmhWxCSunXR6j3QSeRTZlHBa5mmKxyBAGOm-LfdQfQf1hQq6A-XT3Qn_WK-lWh0ptxVoa_gtDavXlssa6t9kDRswniD3iLow_WqDtbs62oKYFF29tmoldkzAL6U8mK-tzaEeqXVkiwe25ZNBbaqkyCd9cSv_nRAOffTeyDmIUUEcxOIOiKRJ7oP4O9PM9EZfW3WNc3g6ePK-0_eCeytePn-JPztCPImurnBF_wK6a1QbczD_C0R5TlIPKZyGlIdVdB-kZyUr0NrC-I8Ac96moW94IZl2NgNo7nO2dc4u1_-34u4wvmbY6Pn9iehEP2LX7jB7Z5-Vf-wYr0EtpTDwakZowyzxaKPpHtxENHunVqWCMdqa6Zaaav-HVN8_GTjc0zZ-zpWfAp_lr-BZE5-ZNv8v2M-dIkmGZMbT8KAJw_vgrV6h6gwMpq_RfZYVta3ZB_uKiLcJuwwSn4RRnWZH-AbNUphno-z7yVvO-Khs7FTnlUercz4JHhAnU4hpTcOUeul0UrqkuKm89OSBHdU1xNU4ml86bljL4XUphe4Ow0ntxqUXRYXmfdhsHq8Duti8nIl7aZPDzDZ1zOVpHuVhesUr-3aw2LzcdA04UH9ulVLyy-fQFwaLk6dORCNcXZ06a2UBiHrRD15XJBrPib4WyWTnj0JIq3hsYSkPLeOgPgltqKiuierNXsG9cekS2Qzn3o3pbk3ipLpqCUZK-6Lzlok1rYxUp_OA9kkcfaUEJNem9gP1niqot-0t_y_4zrss66-awppxGMZAV2-Tap-XHy23KBOgvrages36Z9VPjO6E1IZVZ_pemmhM_JFNyM1LqgtWktRxXEJex9kQ2uluS-IIx--G9kVKPg7FWzHt31TfOQZrxY5DCbrQ-l33he3dbPw7AXfBJJkfFsh0yyYRrv5yjEYFF8ahnyTJZLdMSVImzbvGlva5tTi28yvPhro7syhKM38rQNIbGqHLe-LApSKrrw4rK3p59-mdsU-ufTjLnAXGjXX5PrgLQ56ooSXVcPU6cznGFkrR0zdogmh5psJ2W72-hqH7UVLNqq02qle-dPdmI97YB1ujKDN6WL5hFuXcplSq0br7P32gXpaPjX9x_3oExenJ9o7NSdtZxWm6PgPGmje98xbkQCOcZD5z2VTmwrwob-r6nJVqyMoXd000jD3XdXyZ3XBG_JlE8vfuClJSF8P1QzESOv-7kYYYo-3Wym21ocpsD5QJP1r45hXhaZAxpAlyGhy5fYA2sLNDbk8l1NCO2-W8kgr6Gymoz1dj55vCh3oe1UVU0AeYhxkO0yTNi-xhPyd10kBTJqSkTUpr0oRlntM6boqkCBsgD2xOMIlCgmNMSB6ms5xAlBRlFpdpVZAwDWIMB8r4zCZ3JtXugWndwTyLSVo8cFoC1_31NSEuYf0F6fCrx28fJU8Pat7fkZXdTgcx5kwbfVFqmOEwv-xxd9nIxtXfft9_MWMD0ik-3xvT9gwm64Csd8zsu3JWyUNA1j1T3ceHVsl_QGUCsu6R6YCse3D_DAAA__98mhW5">