<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/158422>158422</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [clang-tidy] bugprone-sizeof-expression crashes for templated types on clang 21.1.1
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang,
            clang-tidy
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          sfc-gh-mheimel
      </td>
    </tr>
</table>

<pre>
    **Summary**
`clang-tidy` crashes (often, but not always) when the **`bugprone-sizeof-expression`** check analyzes a `sizeof` applied to a templated array variable inside a function template. The crash appears in `ASTContext::getTypeInfoImpl` (sometimes preceded by `TypeOfExprType::desugar()`), suggesting recursion while computing type info for a dependent `ConstantArrayType`.

**Minimal repro**

```cpp
// playground.cpp
template <typename T>
void test() {
 T in[10];
  for (int j = 0; j < sizeof in; ++j) {}
}
```

**Command**
(also reproduces with `sizeof(in)`)

```bash
clang-tidy --checks=-*,bugprone-sizeof-expression playground.cpp
```

**Observed behavior**
* Segfaults in \~8/10 runs (non-deterministic); sometimes succeeds.
* Two common stacks seen (trimmed tops):

Crash 1:

```
#0  clang::TypeOfExprType::desugar() const
#1 clang::ASTContext::getTypeInfoImpl(clang::Type const*) const
#2 clang::ASTContext::getTypeInfoImpl(clang::Type const*) const
    ... (repeats many times) ...
Segmentation fault (core dumped)
```

Crash 2:

```
#0  clang::ASTContext::getTypeInfoImpl(clang::Type const*) const
#1  clang::ASTContext::getTypeInfoInChars(clang::QualType) const
#2 clang::ASTContext::getTypeSizeInChars(clang::QualType) const
#3 clang::tidy::bugprone::SizeofExpressionCheck::check(...)
#4 clang::ast_matchers::internal::MatchASTVisitor::MatchVisitor::visitMatch(...)
Segmentation fault (core dumped)
```

Matcher dump right before the crash (from `clang-tidy` output):

```
ASTMatcher: Processing 'bugprone-sizeof-expression' against:
  ForStmt : <playground.cpp:4:3, col:40>
--- Bound Nodes Begin ---
  loop-expr       - { ForStmt : <playground.cpp:4:3, col:40> }
  sizeof-arg-type - { ConstantArrayType : T[10] }
  sizeof-expr     - { UnaryExprOrTypeTraitExpr : <playground.cpp:4:23, col:30> }
--- Bound Nodes End ---
```

**Notes / patterns**

* The crash only manifests when the array element type is a template (`T in[10];`).
* The matcher dump shows `sizeof-arg-type` as `ConstantArrayType : T[10]`.
* Looks like computing size for a dependent array type can trigger recursion in `getTypeInfoImpl()`.
* Disabling `bugprone-sizeof-expression` avoids the crash.
* Replacing the templated type with a regular one (e.g., `int in[10];`) does **not** crash in my testing.
* Wrapping the code in `// NOLINTBEGIN(bugprone-sizeof-expression) ... // NOLINTEND(bugprone-sizeof-expression)` does not avoid the crash.

</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJysV0Fv47wR_TX0ZSBBomxLPvgg20kRYDdpa7c9FrQ0lrihSIGkkvUe-tsLknYsJ_mS3cUGQSJS5JuZxxnOEzOGNxJxSWYrMttM2GBbpZfmUEVNG3Ut8g7FZK_q45LQktByO3Qd08cwIElJ5kklmGwiy-sjmSdQaWZaNEBooQ4WJaFr2A8WpLLAxDM7GkIX8NyiBNsinIDmyX5oeq0kRob_QHWI8Huv0RiuJJknYRVULVaPwCQTxx9ogAGZJ2G5s8z6XnCswSpgYLHrBbNYA9OaHeGJac72AoFLw2sEBodBVpYr-bI0hl2LwX-HhUwb4NLZKLe7tZIWv1uSlSQrG7S7Y4938qDuul4444QWRnVoeYcGeo0V1ljD_ui2u7UPh5vvvXZPAaJGMzRME1oQuvARLhxTZmgaNJbLBjRWg3bxw3PLBUKlun7wb-yxd3EcFByUBgY19ihrlNYZWytpLJO2dGF7e_MkdgeVlIHFr1zyjgnQ2Gt1OUd_lOG36nu_-pbQW-gFOzZaDbKOw_yZLiDZ2nkiWYewI9kNSconxWuwaGyIC0i-IkkJO-CSzFZpQmYbkvkp7zqhBZcWvgHJNpCQbOUf1xDO1G3KVkDoitDVtzNcvnG-hb9nh8fhrVXXMVlfAqMFE0aFcOuhQgPP3Laj1HFOXA7hmoo9My1JykuKQxT5LDQk20TeyPqvM_ctee-6_LA3qJ9cumDLnrjSI-dL2GJzYIOwIRln6_8VhN6mCehB-iqTSkY1WtQdl9xYXrkoshVc0tEMVYVYm_iEuHtWLps6JcFYVj0aMIjSYVnNu86XUG88zCk11r4o0pfxVRg0SwA8QyG1P013qFyOhq3peOdndUaLV2ZOSI6uK1T651EBAOI4dixp7JFZAx2TR_AUu4Vx7PjdYtOhtMzfLP7c3I5KaYR66HqsTzl2nQeBX_pz_P4xltKfhpXrlmlzjfyPgQl_wL9O_Zb_wF_BzMaYvtH4p3PhhdHWV9_NS_GtXZmGV75iCS3cEQX6aTYdYzJj_9sxW7WoTZjh0qKWTITRV_eu3O7-zQ23So8mr2ae3MBPj439Xkp8De74JaB501rY48Ftsi9ditDioFUHb5qwGmw_2HEFj9HL7e6ETrIS_q5V5RiTDRCaf9CGaQ6sYdydikcFuFV6azsLDoZk61e3XVZOSVZmrq1VyhE5TUKXiKIIVm4Z3KsaDayw4RKiKPKgQqnem4XwE7lr_7dMQWgTcOonEdNN5HtngHzTKT347tyoXu9-cSns_pdk-uiy7cFfczvNuHXDDz2kIxezkYuvGbmR9YmPdxvGvbJeYd1Cz6zLU3PVx90V_5IjSoqju6n4AY01F-EVZBEKdLl5khRmJJxccjnt8qp1-yYZj6x04zw1rXo2l9b6wriXZ-ZdeXJN-lms0BK-KPVoQPDHsfRxuG9UTwjFh1AxCVbzpkE9ElBBxb29J0PXPxvccMP2wtfBJ3IUmBM65lKJZ4h_Yi9Y5TVaiyMN6n3zsoOBxmYQTIOSnmOMm9glBZknTgu9wzbUyp-2syCVPWthf7pcQnf0iovL5uzFfzTr-7MTlarxRMBJ0d0_fLm7361u_nZ3T2jxUcEvTh1vtO3mfvPZJkeQd9lL_iAJx0RN6mVWL7IFm-AyzWd5Ps-ynE7aZY5VschZltM8L5IqKXCRTJOcJjiv68WeTfiSJnSWLNIsTbN5kseLIsuTpEhSzNL5fDon0wQ7xkUsxFMXK91MuDEDLtNZMaV0ItgehfHfOpSG659SQtfnUbg_KXVfQnrpMKL90BgyTQQ31lxQLbfCfzONts028IESPH8Wudy9zgsD7rXDAZrGaZxOBi2WrbW9b0We_IbbdtjHleoIvXVenP5FvVbfsLKE3vpAjZOGIdanJf1_AAAA__8PT05m">