<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/149479>149479</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Clang 13-15 segfault during template instantiation with ill-formed nested type and RTTI operation
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          Dong-hui-li
      </td>
    </tr>
</table>

<pre>
    ### Description
Clang versions 13-15 crash with segmentation fault when compiling C++20 code that:
1. Declares a local class with the same name as an outer scoped enum
2. Attempts to initialize that class with an enum value
3. Uses `typeid` operator on the invalid object

### Steps to Reproduce
1. Save the following code as `crash.cpp`:
```cpp
#include <typeinfo>

struct scoped {
    enum class scoped2 { RED };
};

template<auto>
struct S {
    void f() {
        class scoped2 e = scoped::scoped2::RED;
        typeid(e);
    }
};

int main() {
 S<scoped::scoped2::RED>{}.f();
}
```

2. Compile with affected Clang versions:
```bash
clang++-13 -std=c++20 crash.cpp
clang++-14 -std=c++20 crash.cpp
clang++-15 -std=c++20 crash.cpp
```

### Expected Behavior
Compiler should report type errors without crashing.

### Actual Behavior
Compiler crashes with segmentation fault during template instantiation.

### Affected Versions
- Clang 13.0.1
- Clang 14.0.0
- Clang 15.0.7

### Environment
- OS: Ubuntu 22.04 LTS
- Architecture: x86_64

### Notes
Clang 11 behaves correctly (reports errors without crashing).

### Expected Behavior
Compiler should report type errors without crashing

### Actual Behavior
Compiler crashes with segmentation fault during template instantiation

### Affected Versions
- Clang 13.0.1
- Clang 14.0.0
- Clang 15.0.7

### Additional Info
- Clang 11 behaves correctly (reports errors without crashing)
- Crash occurs in `Sema::SubstStmt` and `Sema::InstantiateFunctionDefinition`
- Stack trace and preprocessed files generated automatically by compiler
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJy8Vs2O4zYMfhrlQsSQZTs_Bx88yQRYoGiByW6vhSwzsVpZMvST2enTF5KdSWamu2iLYgMjtkWKH_mRIs2dk2eNWJPqgVT7BQ--N7beG31e9kEulVy0pnupCSumC_bohJWjl0YT2uwU12e4oHXSaAd5scwrEJa7Hp6l78HheUDteVSHEw_Kw3OPGoQZRqmkPsOOsAfCHhgFYToE33NPiobQJs9gj0Jxiw44KCO4AqG4c5Nl3yM4PiDo-McdcA0meLTghBmxA9RhILRhGTTe4zB6B96A1NJLruSfE9S9Ra7THrhwFZDQpsjgi0MHZEX9y4iyIysKZkTLvbFgdHJB6gtXsgPT_o7CExo9v5F19Dgm2CccremCwCmwI79g2n4ySpnnyEOKnie0xF8mxpGs6MRFfEhXXEwAUgsVOgRS7JJz-mRI8TjhO2-D8FceyPqB0AYApuimgCcZi0J4etwDWe9JEfVuD7SJrCnukRQ7HvxsfzZ-vLN7MbKDE2EbwrZ3y_H3Fi26u5_fYmBFM0uml6fHGfu6e6adbZCw7U0UfXzrqdQeBi71Wx-OpNh9H-wxaq732ez8jYI7yicElsEu1SzOxXI6ofDYwdsT8C5dLXc9oY2IOlOdL_MCls53pNiLW-W_JvydbvkvdKvv676L51ajj1_HKZIH7PlFGhuP9RSqBdeboDqwOBrrUz4ArTV2OjIm-AlD6nP23m4jfODqb62mPei-2SK6YOORuNYfSO08114mnY9A11T8ek0CbZZzXvIio1l-v1BmNKP3C1VGs_UHUvRFWqOjY0n3lyMpGvjSBu0DMJbREn76fEyixopeehQ-WIxKXzer31ble4M_G4_utWHmObSRF3QgjLUovHoBwjYTz-5bHBO2_RD9_5S-H5W9H5G8putkxOIKPsW-eKf_n3mfjKTBZoQI1oHUsVcfceBTQzmG1vmjH3wcE1x3b6WfXknAQ9AiurfHU5pGRk-ncglHz8Uf4C0XmCyMNo4Ngc5hByep0MEZdRxA2EFsyQP3UnClXqB9mWcq2kVXF9222PIF1vm6Yhu22VbrRV9T2hZVwU50xYuKVtW6qHJeblu-KjDnrFvImlFW0XW-oZuqqtYZr7pVvuX5GruSl2VOSooDlypT6jJkxp4X0rmAdV5uy_V2oXiLyqVvCcbm5sTiZ4Wt44ZlG86OlFRJ593NhJdeYX1NeWxkDs__oJSmApRKLU_GDtiBRheJSWUe6Xv6_PnTPLCl0YtgVd17P6YmzQ6EHc7S96HNhBkIO0R_5ttytCaNc3ZI8TnCDnOIl5r9FQAA__8KTuDE">