<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/113467>113467</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [clang] Assertion `(t.isNull() || !t->isReferenceType()) && "Expressions can't have reference type"' failed. Crashed at clang::DeclRefExpr::DeclRefExpr
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang:frontend,
            crash-on-valid,
            clang:frontend:fuzzer,
            regression:17
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          yijan4845
      </td>
    </tr>
</table>

<pre>
    **This testcase is generated by a fuzzer.**

Compiler Explorer: [https://godbolt.org/z/r1YqY56ez](https://godbolt.org/z/r1YqY56ez)

This valid code will crash on Clang Assertion Trunk:
```cpp
struct Foo {
 float& value_;
};

template <typename T>
struct A{};

template <typename T>
class C : A<T> {
public:
  C() {
    using o = decltype(Foo::value_);
  }
};

void bar() {
  C<void>{};
}
```

It seems that this goes back to clang-17.

Stack dump:
```
clang++: /root/llvm-project/clang/include/clang/AST/Expr.h:150: void clang::Expr::setType(clang::QualType): Assertion `(t.isNull() || !t->isReferenceType()) && "Expressions can't have reference type"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.      Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -gdwarf-4 -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics <source>
1.      <eof> parser at end of file
2.      <source>:11:3: instantiating function definition 'C<void>::C'
 #0 0x0000000003bcced8 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3bcced8)
 #1 0x0000000003bcab9c llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3bcab9c)
 #2 0x0000000003b18248 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
 #3 0x00007b840ec42520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #4 0x00007b840ec969fc pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x969fc)
 #5 0x00007b840ec42476 gsignal (/lib/x86_64-linux-gnu/libc.so.6+0x42476)
 #6 0x00007b840ec287f3 abort (/lib/x86_64-linux-gnu/libc.so.6+0x287f3)
 #7 0x00007b840ec2871b (/lib/x86_64-linux-gnu/libc.so.6+0x2871b)
 #8 0x00007b840ec39e96 (/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
 #9 0x0000000007b09064 clang::DeclRefExpr::DeclRefExpr(clang::ASTContext const&, clang::NestedNameSpecifierLoc, clang::SourceLocation, clang::ValueDecl*, bool, clang::DeclarationNameInfo const&, clang::NamedDecl*, clang::TemplateArgumentListInfo const*, clang::QualType, clang::ExprValueKind, clang::NonOdrUseReason) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7b09064)
#10 0x0000000007b2388b clang::DeclRefExpr::Create(clang::ASTContext const&, clang::NestedNameSpecifierLoc, clang::SourceLocation, clang::ValueDecl*, bool, clang::DeclarationNameInfo const&, clang::QualType, clang::ExprValueKind, clang::NamedDecl*, clang::TemplateArgumentListInfo const*, clang::NonOdrUseReason) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7b2388b)
#11 0x0000000006c85415 clang::Sema::BuildDeclRefExpr(clang::ValueDecl*, clang::QualType, clang::ExprValueKind, clang::DeclarationNameInfo const&, clang::NestedNameSpecifierLoc, clang::NamedDecl*, clang::SourceLocation, clang::TemplateArgumentListInfo const*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c85415)
#12 0x0000000006c8ce77 clang::Sema::BuildDeclRefExpr(clang::ValueDecl*, clang::QualType, clang::ExprValueKind, clang::SourceLocation, clang::CXXScopeSpec const*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6c8ce77)
#13 0x00000000074404f3 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformMemberExpr(clang::MemberExpr*) SemaTemplateInstantiate.cpp:0:0
#14 0x00000000074151cd clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformExpr(clang::Expr*) SemaTemplateInstantiate.cpp:0:0
#15 0x00000000074267a8 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformType(clang::TypeLocBuilder&, clang::TypeLoc) SemaTemplateInstantiate.cpp:0:0
#16 0x000000000742cc7a clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformType(clang::TypeSourceInfo*) SemaTemplateInstantiate.cpp:0:0
#17 0x0000000007439176 clang::Sema::SubstType(clang::TypeSourceInfo*, clang::MultiLevelTemplateArgumentList const&, clang::SourceLocation, clang::DeclarationName, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7439176)
#18 0x00000000074cbd51 clang::TemplateDeclInstantiator::InstantiateTypedefNameDecl(clang::TypedefNameDecl*, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x74cbd51)
#19 0x00000000074cc494 clang::TemplateDeclInstantiator::VisitTypeAliasDecl(clang::TypeAliasDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x74cc494)
#20 0x00000000074ce764 void llvm::function_ref<void ()>::callback_fn<clang::Sema::SubstDecl(clang::Decl*, clang::DeclContext*, clang::MultiLevelTemplateArgumentList const&)::'lambda'()>(long) SemaTemplateInstantiateDecl.cpp:0:0
#21 0x000000000816c711 clang::StackExhaustionHandler::runWithSufficientStackSpace(clang::SourceLocation, llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x816c711)
#22 0x000000000747469a clang::Sema::SubstDecl(clang::Decl*, clang::DeclContext*, clang::MultiLevelTemplateArgumentList const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x747469a)
#23 0x00000000073cdde1 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformDeclStmt(clang::DeclStmt*) SemaTemplateInstantiate.cpp:0:0
#24 0x000000000744fec4 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformCompoundStmt(clang::CompoundStmt*, bool) SemaTemplateInstantiate.cpp:0:0
#25 0x0000000007458204 clang::Sema::SubstStmt(clang::Stmt*, clang::MultiLevelTemplateArgumentList const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7458204)
#26 0x00000000074c2f25 clang::Sema::InstantiateFunctionDefinition(clang::SourceLocation, clang::FunctionDecl*, bool, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x74c2f25)
#27 0x00000000074c11bf clang::Sema::PerformPendingInstantiations(bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x74c11bf)
#28 0x0000000006832d8f clang::Sema::ActOnEndOfTranslationUnitFragment(clang::Sema::TUFragmentKind) (.part.0) Sema.cpp:0:0
#29 0x000000000683358a clang::Sema::ActOnEndOfTranslationUnit() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x683358a)
#30 0x00000000066a6dfb clang::Parser::ParseTopLevelDecl(clang::OpaquePtr<clang::DeclGroupRef>&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x66a6dfb)
#31 0x000000000669923a clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x669923a)
#32 0x0000000004542c48 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4542c48)
#33 0x00000000047fe239 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x47fe239)
#34 0x000000000477cbde clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x477cbde)
#35 0x00000000048e3a0e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x48e3a0e)
#36 0x0000000000ce1c8f cc1_main(llvm::ArrayRef<char const*>, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xce1c8f)
#37 0x0000000000cd998a ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) driver.cpp:0:0
#38 0x0000000004586969 void llvm::function_ref<void ()>::callback_fn<clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#39 0x0000000003b186f4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref<void ()>) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x3b186f4)
#40 0x0000000004586f5f clang::driver::CC1Command::Execute(llvm::ArrayRef<std::optional<llvm::StringRef>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>*, bool*) const (.part.0) Job.cpp:0:0
#41 0x000000000454c85d clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x454c85d)
#42 0x000000000454d94d clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x454d94d)
#43 0x0000000004555275 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl<std::pair<int, clang::driver::Command const*>>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4555275)
#44 0x0000000000cdeb4f clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xcdeb4f)
#45 0x0000000000badae4 main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xbadae4)
#46 0x00007b840ec29d90 (/lib/x86_64-linux-gnu/libc.so.6+0x29d90)
#47 0x00007b840ec29e40 __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x29e40)
#48 0x0000000000cd943e _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xcd943e)
clang++: error: clang frontend command failed with exit code 134 (use -v to see invocation)
Compiler returned: 134
```
</pre>

<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzkW91y47aSfhr6BiUVCf5f-EJD22cnO8nMjpzsOVcqEGxKOEMBDAB67Hn6LYCURFCSY0-sSbZOynEU_DS-_rrR3YBgohRbc4BrL37nxTdXpNMbIa-f2L8Jj7IovipF9XTt4YWHF_cbppAGpSlRgJhCa-AgiYYKlU-IoLr79g3kvB_s-TeeP_wuxLZlDUh0-9g2QoL0wgXy4ncbrVvlhQsP33n4bi2qUjR6LuTaw3ffPHwng3_9_q84gW9efOPh7OXDcT5e3uJ-IA2rEBUVoK-saRCVRG2Q4KhoCF-jhVIgNRMc3cuOfzGr9BISv_-hbdu3KC07qtGdEMhL3_VtqG4E0R5OzDIdrLxw6PDSm8Nn-1vDtm2IBuSFhX5qgZMtoHsvvHWkL4zo186lDVEKFciwu_DCwvQcMLZd2TC6VwyhwsOZh_ORFgihTjG-RgJ54Q2qgDZmGQ9nd0KYmeFi0A_ne2gIGaBntH0QrEIlkcdLFV5YmF6DfqLrXtyO-7HE9xopgK1CekM00sa0awEKlYR-QVogasw5C9L5eNJSm96q27bHht1zx9cefmd-jHPiOymE9vBd0zxsZ60U_wZq_ncYd8c4bboKRi2L5b2H724fWznfeOEiiH0jyBLQD7H8mf7-kwJ935M76v6fjjR9a26tuPdKAxRnes7UL13T7OksvLRAHg70zAtvmfoMNUjgFAbJRowZhxPjmx7GZnlQigmuECXcw6lGG_IASO5mot7i2MMpqglroBqY_PThdrG8Raort0wjgspujSS0QmpD-2RvMr3pyjkV24HBYyKZUh0oD98hwis00In0BoadaeypJaHg4QK1ElopKCgFFVKik32zmUmUEpTZICQ7jhSVrNXzs2b3556ff5JiLckWEbnutsC1GkwuWmviIVrNYBetBiPPyM4caqZtlMB3JeMHHzDeg2br6iuR9SxCszWaCSOXtK2R3um203OFZlvDBZrNHrNkRtR2pp64Jo9eeMO4hgbNai5mDyBLocD0o9kSzWZrSmdaiIZuCONeePMsXjNYcdKqjdBoVlPRCDmrGFlzoTSjql_DMu00e2Ex0LsLKoEhzAsLELUJJy2RCiQiGgGvkKhRzRroR-Jh5EFAuAgCL1yEhl7GlSZcM6JNgKk7Tq1fV1AzznoXx-k4KNj9UHg4HSKGh0Mf-Y_-7p-wpBSqDFn36nfUk-o_fJKMa2v8-96DssMgSb6uhNISyNZuiwIxrvtNkr2RC3j4nf84wNunIoM_mOAnZU5P4S8aILxrP_IlW3NidnvHbZquUCPMKpdAa8A4aLGLNshwlKHCuMxnoOIB5FMP778IrxqzaDYw6YwpBNfwqOcmf4YL3_67XyIclkjLLPKBRjjG_qBaw0oP3z1mySqJZg3j3eNszbu-g86VmCcWuJ3iwI5cmXmS1xS1eiOBVKsvJvW_agE731kgnoKO0gStleXiteCjNHFkJ65snKV1iEhpguyrJNuJjuT0SHJQvlpmUDoyM1dmmEOevE6mneLIzMdel5Z-7ifROIHeAG0-Q33Io-MGJ5culveD8yEquNLDdh-N-AWUhuoXsoVlC5TVDOQHQSeDljacfRCUmI006fzNlEMGgS16C1QK0UyGmF4i7WSz0ntei7N4yBaqkbRR1_1Q-i2GlPWBKT0WNR1_KCSKaflhMf8349V0dcE_VvJXBZ-BKKPpm0eZwZyH8hyHge_aG4dZVj5r70IC0fD_3dTfY5-3844fYWprScfUTvpLaBZHQezQD1vSf3rXsaY6u7GnlvhztL5mf77EiZ4x07P-9QIbvrmVBiM4VsITK1FI07_eSs9SV_zzn0sqWmuVC9Nl2HDoCp34FUV-VIeOWSXAvSRc1UJuvdAcugkX_GkrOoXMAV61tkTNXS94vy-XhdxXw3s5P8O2BHnM-bjdEmCMdSwSjqsxo0rkqhLEAa0ursqxEt8LP3bh4yQl2cXhHx_hTcsHQe3mME42DSJD_6vVSybqUZqSv0i9fjOa4PQ9dkpdRcI8SJPTAWbZlerEJckJCA7DP3eNZh_gAZpTMfVccH82wkySxCH_v33i7AlxYkzmMkbLKg5OpQ6D0rWn6R0ZxDBXQW1U6CPzlFanc3FRNa0Wjpr5RE0a5dHL1fyNKWadZdEwok6rN-q6RH4YMI-Vwv5EKUiTqL8VPBz8d7chKwn1cAOChtu73Y6kpGlKQr-sau6Fxfndcqz36RRsWoeS-U9soCGWeDhtyLasiIfTA26c7S4rzoQHg-FkiMBOpZgFCU0Dx-Ht3c7t44Z0yvC2u4HoL3g6_r9Mb5ZdXTPKYLgIWvbBL3t2w7_UIm_vOYOOjudg13PSKMnJM3HyB1v-7feOVdBhwK2tQlpVEFw85Rl-lnqrj7nsW1-d8PCkropqoNHF1SjEthUdr45VcXucIP8qtSb1VpxhP3rGP4-BjAD8TVzQ6uC44KTqorjGZ86sI77uhuhxs7_c_qPIM-o8TD66anD_e4n0ZdRz9J8UazQIyvq0_p9AGr_7BLxifH1gwyzs4exymA0kB7NTLiVZiKvsDOYF1R_5La8-1nbfNBbtr5zpO0nWxuUmdttPvP91N6I_q1q95i2Reu7vNtLpXZNPwIVxdiaqnwW3-_bvjQ-3PZYxk-4XLklCkqp2Luc-2W-DRp_vRWu37nEy-tiS3zv4pKVbvpiB_5Ciaz-bRHt7oizf8_GzqLoG3m9bIU1O13CZKDCo6fDg3lwleY5DcsSD_QL4yF16hS68cwdIDmanfIjiCNPIOQ4XooJ_AF_YYLM7eQPtNAxNF_GyAYiD1EnzUVoDDnMnIkpTrvDqBNQLgewxOCAjF2RKywrQJKuaZfvAR-E0o-e1uogvDzgdRZy0HWUQEh_cWzgL-aDPwz5PTasIR9-LnKgGfI4CTkr2KQTUhHcarLbEyBh917uQkjzZwFLQDZGHq0ETaArktuHCHssuo0eP0lEjddWo8jwjaEd-EdzbSDFSZrklTfMbUC3k-23bnNQpcU8xRsbx9yI5qiR7AHkyP4WZGzayJE_ytzyv9msPPlQEhdhuCa-mm_qkDZUexonWrE4MByN-tGR8PaSR3sD7CasVfXy0bxG8cFESxehK2eEDi85g07DSkjCtdt0TcaRpzJ4QctRvhoyKNetEPecvOiL_JMrT9sin38IndTQyxanv2vuezx1fkhqaJ4fOH32wHRCPPT_ypy5Wx0599h_nIpPi8ZwvRMEkpdMsrs4SZ21HjjLmjk0nmE8mmgHnrkmfGbpwip2Rbm9cQBi1HYealjpVHr2al59Eqc6T8pMoj-6OnwvNez9oCTMuYF_GvJzHwVl-CJuGLIdNtxyL4xin8TnkN6PPTuFwomI4Z4UfyOYFyllLj8NfNEnsUEZDeNtVKDv8NqwshqDwx2n7rWsSi8yB7tSGfkkqAhEyoN967V60s_b06VNe5a98C2anODKnj55yiHy0WplpK6WJ1KuRci9eBSJ3lWxayUUhoF7-29vMCN-vPu4OFwiktN-G9N6G6uGEgeiwI_r3vOgr0xsEj0z3z-GDMDIwOwVo9oC0QAoAsVHZn09e8UvQneRg9qSZPHlPfVVdh1Ue5uQKroMU50keJ5F_tbkOMS59vy4zGgPkIYWcZHFcZTn1wzqusyt2jX0cBT4Og9j3I39eAiV1leKM-hjiqvQiH7aENXOzV-ZCrq_sK-LrIAijJL1qSAmNsn_JgPEuOOxIsE-aC9NhH70KPrN_EXBono43tdK3b8ZIwwgJ6-HttBcugtS0xzdX8to-bC67tfIiv2FKqwM8zXRj_7Silx7f_E1edPdPNKFCRL_0bd1VJ5vr73_lPZjo4Rr_XwAAAP__OG94jw">