<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/88832>88832</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            clang crashes when template instantiation results in a constant instead of a type
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang:frontend,
            crash-on-invalid
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          igorkudrin
      </td>
    </tr>
</table>

<pre>
    Reproducer:
```cpp
template <typename T> struct O {
  static const T v = 0;
};

struct P {
  template <typename T> using I = typename O<T>::v;
};

struct Q
{
  template <typename T>
  int foo() { return T::template I<int>; }
};

int bar() {
  Q m;
  return m.foo<P>();
}
```

Compiling the sample with `clang++` results in an assertion failure/crash:
```
Assertion failed: isa<To>(Val) && "cast<Ty>() argument of incompatible type!", file <...>\llvm\include\llvm/Support/Casting.h, line 578
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: <...>\\clang++.exe -c test.cpp -o tmp.o
1.      <eof> parser at end of file
2.      test.cpp:12:7: instantiating function definition 'Q::foo<P>'
Exception Code: 0x80000003
<...>
 #6 0x00007ff7e339e681 <...>\llvm\include\llvm\Support\Casting.h:578:0
 #7 0x00007ff7e45275e1 clang::Sema::ResolveSingleFunctionTemplateSpecialization(class clang::OverloadExpr *, bool, class clang::DeclAccessPair *, class clang::TemplateSpecCandidateSet *) <...>\clang\lib\Sema\SemaOverload.cpp:13504:0
 #8 0x00007ff7e456b514 `anonymous namespace'::AddressOfFunctionResolver::AddressOfFunctionResolver <...>\clang\lib\Sema\SemaOverload.cpp:12901:0
 #9 0x00007ff7e4526ac6 clang::Sema::ResolveAddressOfOverloadedFunction(class clang::Expr *, class clang::QualType, bool, class clang::DeclAccessPair &, bool *) <...>\clang\lib\Sema\SemaOverload.cpp:13288:0
#10 0x00007ff7e45450ed IsStandardConversion <...>\clang\lib\Sema\SemaOverload.cpp:2087:0
#11 0x00007ff7e454d1f9 TryImplicitConversion <...>\clang\lib\Sema\SemaOverload.cpp:1699:0
#12 0x00007ff7e4513802 clang::Sema::TryImplicitConversion(class clang::Expr *, class clang::QualType, bool, enum clang::Sema::AllowedExplicit, bool, bool, bool) <...>\clang\lib\Sema\SemaOverload.cpp:1752:0
#13 0x00007ff7e425fab2 clang::InitializationSequence::InitializeFrom(class clang::Sema &, class clang::InitializedEntity const &, class clang::InitializationKind const &, class llvm::MutableArrayRef<class clang::Expr *>, bool, bool) <...>\clang\lib\Sema\SemaInit.cpp:6555:0
#14 0x00007ff7e425dc2d clang::InitializationSequence::InitializationSequence(class clang::Sema &, class clang::InitializedEntity const &, class clang::InitializationKind const &, class llvm::MutableArrayRef<class clang::Expr *>, bool, bool) <...>\clang\lib\Sema\SemaInit.cpp:6119:0
#15 0x00007ff7e425ae5f clang::Sema::PerformCopyInitialization(class clang::InitializedEntity const &, class clang::SourceLocation, class clang::ActionResult<class clang::Expr *, 1>, bool, bool) <...>\clang\lib\Sema\SemaInit.cpp:10673:0
#16 0x00007ff7e3bfbfa1 clang::Sema::PerformMoveOrCopyInitialization(class clang::InitializedEntity const &, struct clang::Sema::NamedReturnInfo const &, class clang::Expr *, bool) <...>\clang\lib\Sema\SemaStmt.cpp:3634:0
#17 0x00007ff7e3bfe4b2 clang::Sema::BuildReturnStmt(class clang::SourceLocation, class clang::Expr *, bool) <...>\clang\lib\Sema\SemaStmt.cpp:4254:0
#18 0x00007ff7e410ff86 clang::TreeTransform<`anonymous namespace'::TemplateInstantiator>::RebuildReturnStmt <...>\clang\lib\Sema\TreeTransform.h:1494:0
#19 0x00007ff7e41b492b clang::TreeTransform<`anonymous namespace'::TemplateInstantiator>::TransformReturnStmt <...>\clang\lib\Sema\TreeTransform.h:8153:0
#20 0x00007ff7e41b8249 clang::TreeTransform<`anonymous namespace'::TemplateInstantiator>::TransformStmt <...>\build\tools\clang\include\clang\AST\StmtNodes.inc:920:0
#21 0x00007ff7e4166b80 clang::TreeTransform<`anonymous namespace'::TemplateInstantiator>::TransformCompoundStmt <...>\clang\lib\Sema\TreeTransform.h:7738:0
#22 0x00007ff7e41668fa clang::TreeTransform<`anonymous namespace'::TemplateInstantiator>::TransformCompoundStmt <...>\clang\lib\Sema\TreeTransform.h:7717:0
#23 0x00007ff7e41ba0cd clang::TreeTransform<`anonymous namespace'::TemplateInstantiator>::TransformStmt <...>\build\tools\clang\include\clang\AST\StmtNodes.inc:1526:0
#24 0x00007ff7e40fc8d0 clang::Sema::SubstStmt(class clang::Stmt *, class clang::MultiLevelTemplateArgumentList const &) <...>\clang\lib\Sema\SemaTemplateInstantiate.cpp:4353:0
#25 0x00007ff7e45a91bf clang::Sema::InstantiateFunctionDefinition(class clang::SourceLocation, class clang::FunctionDecl *, bool, bool, bool) <...>\clang\lib\Sema\SemaTemplateInstantiateDecl.cpp:5220:0
#26 0x00007ff7e45ae25e clang::Sema::PerformPendingInstantiations(bool) <...>\clang\lib\Sema\SemaTemplateInstantiateDecl.cpp:6494:0
#27 0x00007ff7e2732011 clang::Sema::ActOnEndOfTranslationUnitFragment(enum clang::Sema::TUFragmentKind) <...>\clang\lib\Sema\Sema.cpp:1095:0
#28 0x00007ff7e272f878 clang::Sema::ActOnEndOfTranslationUnit(void) <...>\clang\lib\Sema\Sema.cpp:1136:0
<...>
clang++: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 19.0.0git
Target: x86_64-pc-windows-msvc
Thread model: posix
Build config: +unoptimized, +assertions
clang++: note: diagnostic msg: 
********************
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzsWc1u4zgSfhrmQsSQSOvv4IOiJECwPZN0O7PXBSWWbO5IpJak3Mk-_YKU5ZiOM-lOdx8G2MCIbLFYVd9XxVKRYsaIjQRYoeQKJdcXbLRbpVdio_SfI9dCXtSKP6--wKAVHxvQiJYoukZRidJo-jTDMN2x0A8ds4ARrezzAJL1gB8RvcHG6rGx-B6j7GqSxdhYZkWDGyWNxY94hxG9xhGiewGUXb989__3Sh6OlbxtcjRCbvCd13oYuUe0cqMOBC137xv7PI-_b3EWENLiVilEckQK5yvWYEctnZCzelBwh2glpPXuXGHnwhu-OI010y8aZ1OfcX8QxbOZfuGs0-rBKfZTAphh7I7NVKofROdYs1vAhvVDB_irsFvsgtwxuUHkyn3SCGswY2cNFhIziZkxoK1QErdMdKMGRG4bzcz2dbJMP8tgAnBESywMc9FRk9v_ZJ0HS1JEUowIaZixbvz5AAszvRl7kBarFgvZqH5gVtQd-HgjEiNCEKlwKzofrcVi4eYmVdftepRUQjbdyGG-QW7X4zAobRG5rZixQm4WWze_ExJwkuWT6w-fbsr1DTZj3QuLGa7HDdbg5mGr8NbawTjU5BaR242w27FeNMpp3xtxl8tBq39D4ywJY0YwiNxiJjneu-QD4AnENWv-tJo14DwZtFuGDRgDHBs16um2m8mMUY1gFjjWo8Sm0WKwi8nltWXNn5iP_XCIR7RAUfGg1Uaz_sCjczwgCiXVUdwX8AT4ssEWjF00w4AvFbb9sFCTytipRLQC1br1NzBtQGNmMUjuIuTCMEkSJzlrQbSMCaJl5nNAGsukFcyxj9tRNj5JOLRCCv8VkezztI6OszybFN88NTB4sUpxcAqjpzzyf3Sfhwd006JBhKY4enISWdtmQGkBaR5_Q7ok1ZwuSfWSLrR0iULL6EV_dqx_mZAsgRhPtHoca-jZ9O0LGNXtYC3kpoPbPfjHfblYD9AI1on_MncXkbzpmDHHiu53oDvF-M3ToDEipUuNWqnOXV8JX0PTlY1LpQcmDuKvxI6tV0xywd0PsNOEIuBpmpZUnagdOw7WdJkdm8NNk2gZcpSHHKV1Ei9d1WFSyedejQa7MmsGvw6yybWScw3G3LczU3v69DvDH_OZFFEc-lycxDVlTfqXcT14NOsGPvt2LpzHYXw1-Hlk3aOvct8T43QW_7HwkfwoxRGhcRRSsUwi4PjOrC2TnGleKbkDbfzy_YBBEuVZaC8-scfjtsCP-vmuHzrRCPuDBuO0KEKDJDQY0zwi52N91oufEl6QY3_eZtl16iu4de_tHk8Krx8MeJaQkA4a0EGSltUBHXeuWB9q1Rr-M4Js4GQMbrV7Lr5mxrkwJ-urwZfp_EZaYZ_3DeS78t6VfwjJz03wFd3L_zZaVndQas2ev0CLaPV25NyT54MUO7f29KZJkoT0Lk_o5Q3h301vOPZ_mtM4PlnUyQnNDJL2_AJ7AN0q3VdqeA6BnuP1e6lb-z7uk2r2Gs-IlPMDbOzsX1JFKhz_JL7iKM1oSFjYKdVt3bI3Opk9Yb-pHdzrn0Lbfj921trvrAf-xe9-7mSr3uH7dXv0jeSsbT-TQ1O6DLnJTriBZf3GE-JqFN3eW6fx7NJ8PyV-BoolSU5QhH1YHLVtHvQ0jxrgUTNpXHQRrd5p0ebu8e7Q1it92H1_gTpk4n3_A_O-246XxQmEsC2L62VB6l8F4aDnx0DkcRKuNBKdgMjJsvjlIF657-ODksoq1ZkjOC87oflOuX50AG1vf1cczELIBtGyIFEIK-zb4jSt8-iXw6pUP6hR8o9GJ8to2O4Scgojb9nfAEYcdtGEniQZixr-90uyOCFpiCtsn6K2yXl0vhSvx9rYN4uw9_SNBv23sbPiE-ygm2GX-0OUT8LY4yfQN5bl1-zBXKXpaXUIG5eEFXH9RuNypG3eal4fzlI--OR5UdR0p8cMH2o6zkB3uvfwE3JaRdIT-EAS-Ms25AEkF3Lzol8oaRDJf6KX6elziAQNAckoieI3mqWysffyRvL71q-Szvv3hxT2VrONSylE8rc3f49_zGKu6_5mOIcurwg3HyQP_SZtnuXf6Tci-U6J7_clpscrOTypOz5_piUGrV11KSfPcKuVtOA3HX3PJN8fK2M-ArYKG7GRzCVrPhrAlzt_DwALuTtkenFkB8-nB3GxiBbRRthp8JHpDVhn9ilP_5UuL4fm8quQXH01l73ZNXuprQbGca84dE52UEY8TUO-93PVoRUbf9hKrkapBit61_e6lYPI1eE03ZyFLpX1R5tcsI1UxooG92bStg_iD3zCw_oLvqK8oAW7gFWcxZTQZUqTi-0qYXmeUojjLI2ipmYRTZdZukxTypOaFsWFWJGILKNlnEaERjRZ1DWJ85jFhDPaRFmKlhH0THQLtydcKL258CfhqzzPKbnoWA2d8e-kCJmTbw7ydKzvBjQz20slL4XcsU74geT6Qq_8GXs9bgxaRp0w1rxYscJ2sJqi7OeDwV-3IF_e64jjMhG86JjKOpPWy7gYqxYz_7bhYtTd6uOH_x71_wIAAP__6jJpUA">