<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/113324>113324</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [clang] clang trunk crashes at clang::FunctionDecl::getNumParams()
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang:frontend,
            crash-on-invalid,
            clang:frontend:fuzzer
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          yijan4845
      </td>
    </tr>
</table>

<pre>
    **This testcase is generated by a fuzzer.**

Compiler explorer: [https://godbolt.org/z/aehhzKdd1](https://godbolt.org/z/aehhzKdd1)

This invalid code will crash on both Clang Trunk and Clang Assertion Trunk:
```cpp
template<typename = int>
struct ct {
  friend void f(ct, int = 0);
};
void test() {
  f(ct<>{});
}
```

It seems that this goes back to clang-11.

Stack dump:
```
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -gdwarf-4 -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics <source>
1.      <source>:6:11: current parser token ')'
2.      <source>:5:13: parsing function body 'test'
3.      <source>:5:13: in compound statement ('{}')
 #0 0x0000000003bc6148 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3bc6148)
 #1 0x0000000003bc3e0c llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3bc3e0c)
 #2 0x0000000003b114b8 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x0000786adf842520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x0000000007a69a14 clang::FunctionDecl::getNumParams() const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7a69a14)
 #5 0x0000000007463bc7 clang::Sema::addInstantiatedParametersToScope(clang::FunctionDecl*, clang::FunctionDecl const*, clang::LocalInstantiationScope&, clang::MultiLevelTemplateArgumentList const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7463bc7)
 #6 0x00000000073bdeb5 clang::Sema::SubstDefaultArgument(clang::SourceLocation, clang::ParmVarDecl*, clang::MultiLevelTemplateArgumentList const&, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x73bdeb5)
 #7 0x0000000007463fb4 clang::Sema::InstantiateDefaultArgument(clang::SourceLocation, clang::FunctionDecl*, clang::ParmVarDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7463fb4)
 #8 0x0000000006c71c8d clang::Sema::BuildCXXDefaultArgExpr(clang::SourceLocation, clang::FunctionDecl*, clang::ParmVarDecl*, clang::Expr*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c71c8d)
 #9 0x0000000006c9c7d6 clang::Sema::GatherArgumentsForCall(clang::SourceLocation, clang::FunctionDecl*, clang::FunctionProtoType const*, unsigned int, llvm::ArrayRef<clang::Expr*>, llvm::SmallVectorImpl<clang::Expr*>&, clang::Sema::VariadicCallType, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c9c7d6)
#10 0x0000000006c9dba7 clang::Sema::ConvertArgumentsForCall(clang::CallExpr*, clang::Expr*, clang::FunctionDecl*, clang::FunctionProtoType const*, llvm::ArrayRef<clang::Expr*>, clang::SourceLocation, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c9dba7)
#11 0x0000000006c9f791 clang::Sema::BuildResolvedCallExpr(clang::Expr*, clang::NamedDecl*, clang::SourceLocation, llvm::ArrayRef<clang::Expr*>, clang::SourceLocation, clang::Expr*, bool, clang::CallExpr::ADLCallKind) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c9f791)
#12 0x000000000712ee9a FinishOverloadedCallExpr(clang::Sema&, clang::Scope*, clang::Expr*, clang::UnresolvedLookupExpr*, clang::SourceLocation, llvm::MutableArrayRef<clang::Expr*>, clang::SourceLocation, clang::Expr*, clang::OverloadCandidateSet*, clang::OverloadCandidate**, clang::OverloadingResult, bool) SemaOverload.cpp:0:0
#13 0x000000000712fda4 clang::Sema::BuildOverloadedCallExpr(clang::Scope*, clang::Expr*, clang::UnresolvedLookupExpr*, clang::SourceLocation, llvm::MutableArrayRef<clang::Expr*>, clang::SourceLocation, clang::Expr*, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x712fda4)
#14 0x0000000006ca13b8 clang::Sema::BuildCallExpr(clang::Scope*, clang::Expr*, clang::SourceLocation, llvm::MutableArrayRef<clang::Expr*>, clang::SourceLocation, clang::Expr*, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6ca13b8)
#15 0x0000000006ca391c clang::Sema::ActOnCallExpr(clang::Scope*, clang::Expr*, clang::SourceLocation, llvm::MutableArrayRef<clang::Expr*>, clang::SourceLocation, clang::Expr*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6ca391c)
#16 0x0000000006709a0d clang::Parser::ParsePostfixExpressionSuffix(clang::ActionResult<clang::Expr*, true>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6709a0d)
#17 0x00000000067023d1 clang::Parser::ParseCastExpression(clang::Parser::CastParseKind, bool, bool&, clang::Parser::TypeCastState, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x67023d1)
#18 0x0000000006704527 clang::Parser::ParseCastExpression(clang::Parser::CastParseKind, bool, clang::Parser::TypeCastState, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6704527)
#19 0x00000000067045b9 clang::Parser::ParseAssignmentExpression(clang::Parser::TypeCastState) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x67045b9)
#20 0x0000000006708fd9 clang::Parser::ParseExpression(clang::Parser::TypeCastState) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6708fd9)
#21 0x000000000678bde9 clang::Parser::ParseExprStatement(clang::Parser::ParsedStmtContext) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x678bde9)
#22 0x000000000678215c clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector<clang::Stmt*, 32u>&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x678215c)
#23 0x0000000006783070 clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector<clang::Stmt*, 32u>&, clang::Parser::ParsedStmtContext, clang::SourceLocation*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6783070)
#24 0x0000000006783f45 clang::Parser::ParseCompoundStatementBody(bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6783f45)
#25 0x000000000678569a clang::Parser::ParseFunctionStatementBody(clang::Decl*, clang::Parser::ParseScope&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x678569a)
#26 0x0000000006699223 clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::LateParsedAttrList*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6699223)
#27 0x00000000066cd8dd clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x66cd8dd)
#28 0x000000000668cf6e clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x668cf6e)
#29 0x000000000668d72e clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x668d72e)
#30 0x0000000006694ec3 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6694ec3)
#31 0x0000000006695dad clang::Parser::ParseTopLevelDecl(clang::OpaquePtr<clang::DeclGroupRef>&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6695dad)
#32 0x00000000066882ca clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x66882ca)
#33 0x000000000453b728 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x453b728)
#34 0x00000000047f6bf9 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x47f6bf9)
#35 0x00000000047756be clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x47756be)
#36 0x00000000048dc3de clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x48dc3de)
#37 0x0000000000cdee3f cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xcdee3f)
#38 0x0000000000cd6b3a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#39 0x000000000457f449 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#40 0x0000000003b11964 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3b11964)
#41 0x000000000457fa3f clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#42 0x000000000454533d clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x454533d)
#43 0x000000000454642d clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x454642d)
#44 0x000000000454dd55 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x454dd55)
#45 0x0000000000cdbcff clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xcdbcff)
#46 0x0000000000baadf4 main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xbaadf4)
#47 0x0000786adf829d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#48 0x0000786adf829e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#49 0x0000000000cd65ee _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xcd65ee)
clang++: error: clang frontend command failed with exit code 139 (use -v to see invocation)
Compiler returned: 139
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzkm11z2zazgH8NfYORhgS_L3why1GPW7fxRD6d3nlAAJTQUAAPADpyfv0ZgKQlUJTitGamb99Ok1DE1-6zi8USBJFSbMMpvfbiGy--vUKN3gp5_cL-RDzKoviqEOTl2oMLDy4et0wBTZXGSFHAFNhQTiXSlIDiBSBQNl-_UjlvK3v-red3fy_FrmYVlYDu60pIKr1wAbz4Zqt1rbxw4cGVB1cbQQpR6bmQGw-uvnpwheh2-_UXQgIvvvVg9vbqMD8e3srN-DOqGAFYEAq-sKoCWCK1BYKDQugtWFaIb8CjbPhngDjpfi-UolIzwdsSM3jbceK3_-O6bu9ouqsrpKkXLvVLTTnaUeCFt4Bx7YUf2jpKywZrgDXw0pv2FgClZJQT8CwYAaUHM6w9uDTNbHPf6BJ2lb309vXa1jfG8GDmwdzpse0lXJqB0xvTatCJq8MxqzsNFKU7BfQWaaANuY2gChQIfwZaAGywzIJgftxorU0paXb1KaD258P9h8X6A1BNsWMaIFA0GyBpLaQ2nQ4My_S2KeZY7Dy4qqrn_p9ZLcWf1OBZMaUaqjy4sqZiHFcNoUBvaWdUI62WCFODspa0lgJTpSgBSjSyvW1aIqUEZtaDZcOBwpLVen5WKX_u-fmDFBuJdgDJTbOjXCvrzHAlaiMZ7lx99urqcNUyQ70rqZm2vgRXBeN9sQdvPHgDZhvyBclyFoHZBsyE6RfVtem90XWj5wrMdoYFmM32WTJDajdTL1yjvRfeMq5pBWYlF7NnKguhqCkHszWYzTYYz7QQFd4ixr3w9qK8prLiqFZbocGsxKISckYY2nChNMOqHcOSdm574bLD2zu8cZPcuR0uEi9cBIGBhhspKdegRlJRCbT4TDnwYGq8FaZtD3Ckh9j0EJoeTEvGN6BsOLaz1EQr00U7Mbo-wot9MA4MBNFwApRGmhqjAjur0n72pK8RBXgw9IG_9_v_wgInQZQB66jhwgsX6kW1Fw-ScW3d6LH1xexQSaIvT0JpSdHOg0k34-08NgO_izN58Mbfd-I58gcD-UPq4zH5lxVFvKk_8jXbcFR5MGu4XS0IqIQZZQppjTCOtNCVNgiiIgNL43yfKBbPVL604v0P4qQyg2YdSafOUnBN93pu4nW48O2f1yHCbog0SxApswjG0O9Uq1jhwdU-S56SaFYx3uxnG960BXiuxDyxgtsmjtjRsdgpSnIURG30bOGuOpe9pbhq72yo_q3ZPSCJdqoL6lhwpd8bcieMI23sSBslYYHTY2nXdIfaK0TIHVcacW3jphWXairVo1hjURsvP6elyQuW5xi0up7WuRcYVYcRmeDdMMmg4q9Npdk9fabVY7cUL7oIfc-U7rtPJvDajpcDNHGAhgWhRTwOdN0USt_SEjWV7iV2Ia5t3DIgjDQDtR-Q3P2O5DjgNzNZgkKIago2reoOm3TobGURjbM58rS_TuiyDw75TeIdZeFOt-yYQILTAGdknMBNwyqy_OOPg_of9rWcTHunsB1pCiadyg6T3GWS45Qk40x-QnpLZe8JaiXkElXVuzHpSx-k0OLxpaZOaHpdAu0qszxaNxdSopdPtPTC5QjE8INbe71DVfU7xVrIu11dnW80jHMHDr8jyRBh2Ghv5DxM48mmc2eXwwMWDAN_YDhSoDNrx1LwZyr1ZcuZO6-eN-6P72bM7zPeRfeaDrjh6QAPBsDLNA8uRI9PVInqmZID2OybUH9DO0rGiZ6q_o4UxwXrnXrMS9pxb-_NjV8YJ9PYwCB2bOBkpWkAKc0RWDHO1PbjM5WVQOQccWue02ndZjVv8_n_5bIz6r0Qn5t6vNYlS_3aaFRUdCKDHd3taSwRJ4wgTdd0JMs7qdVtIo3XYnzziaqm0scTz2DtK5ym-cZm4cBmJUFn8g47b75px3-TxSZeNzrazhSK3DCGgrDILiVBf98I_1q8HT0HbzzAG-YBHse7wPoj_w_GOwVOQ8vB6TzQJamfI58MMmlF5dH1g1C6ZHsjJVXKPLc2Zcn2Lt-FTU66YDbKBC6Blo3dtZpA0VYPR9F0oCgMSXBR0SVS-qClq99xZVPP_m6X6eGkGC6Ix01N4maar7VdGoZNJ_GBVnMHTTZAE8UwnRbNP4qHUdfhkZ_wKPKLPBb2bZPJ_d9CZaDlNCoV-bFK0B-olJXkskr_EEWMnI4i7kNCmhWEfluRdb__fV4Xe03Weqe7LdVJ9LHiOvrAgT4wiPFFfV51-Wi3N5C0a8ii1FQutJasaDRVzp780SO5G4uNtl0sDmEz-lT-DUQXV7WRTRlFybGQo6MNa0xhBkPZMUM4MEPop_5fMMM_hfsUzAwSh1k0ZFZG8eVlo3sf9cruRpAXD2ZTZY-tSI7M8UDmOMnRRZn7jZahzEdtzm5BDjzmdX9_Ck2NIo6mbmKX5DmE4Zs0vaUl40yPRn7GN723C_kWr-335-94KZx9-TOt7pGmhyhwz7otrfcn1gJxiLkZYoJJRi6nwgbFT1I09VlQ65riU4UPCMcn9BsD5VnQI7swbwnNXX8rIT8hvqF3nE0G37J14Ls5aJLhMqHfhP9RHjntHddUtu9z__6ic1LjokEXGFOlTBkrmSEyATJLxEGWD5CRFH4bWbdQOeTOTvd3Bzf0ux8CznA5BucedEiSPKL4cmj8sG9dy13pfwCsKeKe0dbBEQxwxARdjnuPorYvX9uF75jDxxr9X0Mf9CDheQ2Udovk4sufXwVpKnq3q4XsnysmWTFbNR0OcDCfMohPc4PF-vHstvfUu2GtSI7MTt4axWGRQmezcSkI_Ynydj-m34GhuNG0u9WdsntfSTtBHEmdbDFKy6QonQe3lTRrIScjok4kZCuDI2TsCpnGSUFdnO2w7Qt8TMeJntdqEl_u5HQUcbK_KCM4JNTdZLQiH_R5fs0Nskv6ThKUOvkcBZxkzMeE0rAEGAdPO8Tcx6zjvdctkocXod22q3MPLu2J1Gn0aKV01MgGaiRFiEAPfxk82kgx_szYvz4_0Slxt6BNH10e6ZwGIpI9Uzn6ysg9lBDFaRlFeXtU99Bvf_jwSVq2trSdie1RQy9cYFRVBcKfn0ruBvx27M6HlsFS7HaIk-GkHrWh0l09UZvRkWFwxEdL-5bMLiOtgV8bPD3h_d4ewfTCRYEUw0_KVu8oOpXNjSctEdOqLx50h6rKzIn24b0rN1UWgw3Jlrlt4sG0QruCIHu0skcFs_5Y4c-iGLVH5A8PA-ZJdGSKsSN_bcmnhq9RSasXB-dl001xvtFKfOz5UTB0MWQm8H-xixjo8xpJPfcv-gJ0wUVxGJKz4Kzt0MmK2dN0gvmgoalw7pH8QtXF4GDdJGc5O7UdhxqkOlESwe_m8rMo1HkoP4vi5PzgpdD86gc1YsYFuqNTb-XYOcsPoWlgOTSjAU1C4vic5LdH107iMJIxnLPCD6Q5QTpr8Tj84sHCXuCyC299htLLb8PK4uRk1rll-91zEiOZI7qTG_oFQqSMgBH6vcduu3bGTt0j6TAn-XceSbdNnD6zYZ808sHTk2n2pDSS-ulIuTePQiN3lHyYycWUgrb_97eZ6fx19OPicAGolMJ-aWbvg7J7wgC4mxElYhUl4AvTW0D3TLefhgWhda1GUTB7BloARSlgR2l_PvimTVLdSE7NnDSNB58_XZHrkORhjq7odZDCPPHTPI6uttdB4sdpXGZBgfyS0pTEWYCyMC2TKCqiPL9i19CHUeBDGERhHkRzXKYZCkiepigNUAi9yKc7xKq5mStzITdX9rOo6yAIQxhdVaiglbLf9UHYB4ceggehB5emwH7FI_is-z7uUDBsYbKlr1-NmaAX317Ja_tNVtFslBf5FVNaHQTRTFf2k8K2l_i2s4E1Z_uNFlUA6e_9IOKqkdX1X_9arCPzfA3_PwAA__-IEYzx">