<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/208290>208290</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            clang 23 crashes with template friends
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            clang:frontend,
            crash
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          avikivity
      </td>
    </tr>
</table>

<pre>
    # Clang crashes (heap corruption) when a class template befriends a member-class-template specialization that then accesses a private member

## Summary

When a class template `data<K>` befriends a *specialization of a member class
template* of another class template — `friend struct tree<K>::template ib<true>;`
— and that specialization is instantiated and actually exercises the friendship
(accesses a private member of `data`), clang corrupts the heap and aborts.

## Reproducer

```cpp
template <typename K> class data;

template <typename K>
struct tree {
    template <bool Const>
    struct ib {
        int get(data<K>* d) { return d->value; }   // uses friendship
    };
};

template <typename K>
class data {
    friend struct tree<K>::template ib<true>;      // befriend member-class-template specialization
    int value;
};

template struct tree<int>::ib<true>;               // instantiate -> crash
```

## Command

```
clang++ -std=c++23 -fsyntax-only friend-member-template-crash.cpp
```

## Actual behavior

The compiler aborts (SIGABRT, exit 134) with a "PLEASE submit a bug report"
message. It is 100% reproducible. In a larger TU it manifests instead as
SIGSEGV mid-compilation — the signature of heap corruption, so the exact fault
address is allocation-dependent. This is a release build (no assertions); an
assertions/ASan build would pinpoint the faulting code.

## Expected behavior

Compiles cleanly. The friend declaration is well-formed and grants `ib<true>`
access to `data::value`.

## What narrows it down

- Removing the `friend` line → compiles fine.
- Making `value` **public** (so friendship is never checked) → compiles fine.
- Never instantiating `tree<int>::ib<true>` → compiles fine.

So the crash is specifically in the friendship access-granting path for a
**member-class-template specialization** named as a friend of a class template.

## Version

```
clang version 23.0.0git (https://github.com/llvm/llvm-project.git 290f3bc2d12e5875a0be386fad8f6a5dfce9d6a3)
Target: x86_64-unknown-linux-gnu
```

Also reproduces with `-std=c++17` and `-std=c++20`.

</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJycVl1v47oR_TX0y0AGTcWy_eAH2UkWi36g2KT3PhaUNLLYUKRAUk7cX18MKTt2NrndXkNAHJMcnjlz5oyk9-pgELdsuWPL-5kcQ2fdVh7VizqqcJpVtjltmchhr6U5QO2k79ADE-sO5QC1dW4cgrKGiQ28dmhAQq2l9xCwH7QMCBW2TqFpPEjosa_QZXFHdtnhB6yV1Oo_kiJB6GSAEGPVNXqPdHJw6kh7UwTGS3pETtCexr6X7pR--_1TDKzgjQyS5fu_sPyBFfwGFRPlBwi2vYBNoRgvz8GYKOO6saE7L1_d9CDYmrPNHd2ZrgAf3FgHCA7xjCAvWX6JCKpi-T64EePSjhWckrlEkqZJpHxAqTwo44M0QcmATdwn6zBKrU-Ab-hqReSFDmFKtlND5G39JbOU2pmtgjOxYWJPOVLxU7FTwFj-eGFlXfDzm4r8wMHZZqwvhSp4euphuGISKOvTgEb2CETLRGYq1S6d_XIz4-UVscBWdAAA4PpEZa2GvTU-pBO0Pp1S1dUZ-igT4ICBifW1VkQJDYmbrXbgMIzOQJOx_OEoNdVrB2x1DwBMPDLxCCNxekM2RWar-ymfy5c_TuydhyuMf1JNKbkJ31n2v9SJ073Eyznbr3K4BaVMuMD6FM3lM8G6kjFkUQhkNNfKudHX3va9NM0HcSXezIGJHRM7yHxoWH5fp39FDlnrTybIt8wafZrYzCYezolk8eJ50unnl5exw6DCTh6VnRT-3CHUth-URje1BJnk0_dv5e7HM_UQvqkAi_wuGqUKXfQd8Y-_PpRPD-DHqlcBJFTjARwO1gUmBONlj97LA87he6B2X3DOxJJ2xP5SlaYlMjwt3QEdPP8TVIBeGtWiD8kfUDYgycGevn97evj2G_SqyRLY5CPvTkOdTRNBhtEhWcFPLr8Hb-M2fJN1gFaOOjBeyqZx6D1hlFrbOgbOGhzQNGjCHJ47lVbBoUbpEapR6YZIMhak9-joiCfHyXcgSXzXvz6WT9JMZ17tqBsYlBksaTP6G-FQ0aQavDWjh7cBa7LH24rtU7U81Bql0SeCePZJaLDW0l1c9hW1zlrr-slkD04aKnDBb9QdhZKcFYJ9HzrUBqmBCn6L7XdydSOds6-eCtfYV5M2ZPADe3uklCi_yzCh2aWVmQZNwTbirDsPrTIx9wz-Jl_oJCv4-V4ackyUw1hpVafvxL23V25FqRo80lDrsH7B5Ht_dM_f4-737p0u_V82QHC-DktKTRqLzUiooi-1qo6TTZkPI216T8hiWQjCIEMHrXUgI9X0_JLfJVrIiKljQJ7lEF8Hbgf9bR1_Q-eTYX5mSHBMyyDyOZ_zgwrxBSqEwRM50QIPKnRjNa9tz8Sj1sfzn2xw9t9YhzmdEhve5lUtmoXA5Xq1lLzCfF20slm3hVw2bY2bppA5NREvn8kSAstLeFsX_yrustG8GPtqMq3M-JYdzPizx5Xa24u9oE9OxQp-a6aLFZWQOuGnJcEnkc-abd5s8o2c4XaxWufLfCWWm1m3XRVVWxW4FDUX-Z1siloUy2KzFC3mWLXtTG0FFwVf8fViw_kyny-WjWwlr4pFscJms2Z3HHup9JwImlt3mCnvR9wKvhYbPtOyQu3jK60QaSLkZeusCdQ_QjCxp4U4YYSg1163jVRX48GzO66VD_49dlBB4zYVUuSXV-DIzEVIkxhno9Pb_6-wTDxG9ORxUwLHrfhvAAAA__-k6ay8">