<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/92414>92414</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Clang crash on valid code since #87933
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          yronglin
      </td>
    </tr>
</table>

<pre>
    ```C++
namespace std {
template <class T> class initializer_list {};
}

template <typename T, int> class C {
public:
 C(std::initializer_list<T>);
};

template <typename T> using Ptr =__remove_pointer(T) *;
template <typename T>  C(T) ->  C<Ptr<T>, sizeof(T)>;

class A {
public:
  template <typename T1, typename T2>
  T1 *some_func(T2 &&);
};

struct B : A {
  int *ar = some_func<int>(C{some_func<int>(0)});
  B() {}
};

```
I've debug in local. The crash issue caused by initializer rebuild failed in https://github.com/llvm/llvm-project/blob/8e00703be9ceb41d9b80c2bc8f024a9610b9aaa1/clang/lib/Sema/SemaExpr.cpp#L5717-L5721 , if remove Line 5717 `SFINAETrap Trap(*this);`, we can got diagnostics like the following:
```
./main.cpp:23:28: error: no viable constructor or deduction guide for deduction of template arguments of 'C'
   23 |   int *ar = some_func<int>(C{some_func<int>(0)});
      | ^
./main.cpp:6:34: note: candidate template ignored: couldn't infer template argument 'T'
    6 | template <typename T, int> class C {
 |                                  ^
./main.cpp:8:3: note: candidate template ignored: couldn't infer template argument ''
    8 | C(std::initializer_list<T>);
      |   ^
./main.cpp:12:24: note: candidate template ignored: couldn't infer template argument 'T'
   12 | template <typename T>  C(T) ->  C<Ptr<T>, sizeof(T)>;
      | ^
1 error generated.
```
But why does the check pass during Parse phase but fails when we rebuilding `CXXDefaultInitExpr`? Through tracing, I found that the root cause was the parameter `bool ListInitialization` that passed to `RebuildCXXTemporaryObjectExpr`(fall throuth to `Sema::BuildCXXTypeConstructExpr`). During parsing, `ListInitialization` was `true`, but it became `false` during rebuilding, it's cause `InitializationKind` to become DirectInit instead of DirectListInit. Finally, causing `Sema::DeduceTemplateSpecializationFromInitializer` fail.

https://github.com/llvm/llvm-project/blob/8e00703be9ceb41d9b80c2bc8f024a9610b9aaa1/clang/lib/Sema/TreeTransform.h#L14116-L14121

Therefore, I think the key to the problem is to fix `TreeTransform.h:14116`'s FIXME. As the comments in `TreeTransform.h:14116` said, we should pass `E->isListInitialization()`, because `E` is actually list initialization, I have tried this modification, but it will cause 3 lit failures. We have not try to rebuild the `CXXDefaultInitExpr` before this PR, so it's works fine before.
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzEV1GP4jgS_jXmpTQosYHAAw90aKTWzd2NdpCu31pOXCG-duzIdrqX_fWncgL0zHbPaXQ3WoRI4riqvvrqc9nIEPTJIm7Z8o4t9zM5xNb57dk7ezLaziqnzlu2ysZvyfgdfbM9y3ZWdhh6WSOEqIAV03DErjcyIjBR1kaGAEcm7mG81VZHLY3-A_2T0SEms2LPxGRM9-PNn3zFc48UEo6Ml6BtvHktb9H7oTK6ZmJyACXj6xAVDYjd99GZKAkb45tvAFzvf4RB3MMQtD3Bl-iBif3Tk8fOveBT77SN6BlfHxnfAOO7q8OPXSWcaf6n6VGUX6K_Aiwh6D_QNdMsGvsW5UjE7mMi4P3gOfm-PXLyPBkccwIfXIdPzWBrCs2B8VX6_oixEP1QR7gDJnZvIQFVjXzKxBjcXItyrCfj65IVd---yChosX8bGuCO8XVieZTRB4Cu-h0fHxgvXhAUVsMJtAXjamnmcGwRai9DCzqEAaGWQ0AF1fmtasFjNWijoJHaoCLzNsY-ENH8wPjhpGM7VPPadYwfjHm5XD713v0b68j4oTKuYvywxiwrMlHhpsZqkatNtc5qXtXrJuMLuVnlWbWRUuaMH2oj7YkcaTL8ip2cLve_935e9z3j4vOyyItPn5cFp7qVoBsYFQmftUWgt8BW2dfDwz9290cve6CfxN8utjpMxK4yMn6l9C2cXASl5cm6EHUdwOhnhNgiNM4Y96rt6Sqw7zieM37opLYJnNhxQT9rEgR67zzdWAcvWlYGoXZ21Izz4DwoVEMdtbNwGrSiYG_HXHOTsvSnoUMbA40yXpSMFxdpABfAihJ-geroQ67Z8v7dbFdM7MRizDEiXWtplVYE-Ypdn6zzqNJbNxhlGS8iaNug_3OClNzxbXKwSgh-vkFOnPyXz0eZUQXF_zuxb_JaJ4A_27ZvNfkYe85Jg7-2LDn_UVn-t0b_ju7ycTXBCS16GVHN312Md0OE1_YMymFIy7dusX6GnqShBp92MekDQt_KgFANMbW3AK8tWuoFU9OjiXQKeHzcYyMHEx-sjtSCKJI4wLH1bji1EL2sqTfwEh6gcYNVEFsZU2jvXBxbK7zKEU0vvewwoifnlXMGPuuQfKeqS1r2bJWNPgg0KoiOJv824iofH4_Y9c5Lf_5nRV32AoqvG2kMRAIW28kq9c-krLuL9bnH8tKErrabOexHdnrpw5QQW2Xvo6Ns2CqLfsCpiRKPOkKFNZWfrbJGmkAvL6TfaE0rNjJehIkbtsq-DfE3bVUiwZFD1yHstcc6AQFtQ0SpqAuOoxeIczhoK405UwDyPJXwRsGeGiseJ8F-7bG-xTx41z3cFh-FJ13M3-6tf9Xud_SIRy9taJzv5i1tgPkiz1ef6MLztxCPLXpsnMdRkLHV9jkJ7xnPxGfSoHeVwQ50oJFG_04sfR9D7FKIVN4iwOHh8e_3c9hNa8p141ak7Y9tIUitpk02tNRjxpXIVtk9NQUd3hFYOuZcdIVXjdyTPx1A1nGgMkM6VOvvbCnrVr4gRK9p7bQ6QOeUbnR9nTGJ9VUbM0lQgNFjIxg8hjn8C0cn1kWIPjF3OQxR_h81BqgS92PUL7-lFucuYn91_jlAQweUcdp8prZCbcRGznCbF_lyXfDNcjFrt8Umw5XgPF8sRL1o1oLzrMaN4g1X1VKJmd7yjC-yZb7Kl5wLMV_UG1zm61qulVg0a8kWGXakX1Lk3PnTLB30thu-yBczIys0If0P4nySHKe_RH6bFFwNp8AWGREcbh6ijga3JU2fDo_Owos0WkHtFELQtkZgXKyLjRCzwZvtT6-YhDIwfkhA_xMAAP__J1svfw">