[clang] [clang] Bail out if the result of function template instantiation is not a function type. (PR #69459)

[via cfe-commits]

https://github.com/VitaNuo updated https://github.com/llvm/llvm-project/pull/69459

>From d8305b64a464e5cd992c836ef13d452f62235442 Mon Sep 17 00:00:00 2001
From: Viktoriia Bakalova <bakalova at google.com>
Date: Wed, 18 Oct 2023 12:55:04 +0000
Subject: [PATCH 1/2] [clang] Bail out if the result of function template
 instantiation is not a function.

---
 clang/lib/Sema/SemaTemplateInstantiate.cpp         |  4 +++-
 .../function-decl-nested-type-alias.cpp            | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)
 create mode 100644 clang/test/SemaTemplate/function-decl-nested-type-alias.cpp

diff --git a/clang/lib/Sema/SemaTemplateInstantiate.cpp b/clang/lib/Sema/SemaTemplateInstantiate.cpp
index 23de64080a070ca..dfd7cc284eb6b73 100644
--- a/clang/lib/Sema/SemaTemplateInstantiate.cpp
+++ b/clang/lib/Sema/SemaTemplateInstantiate.cpp
@@ -2662,7 +2662,9 @@ TypeSourceInfo *Sema::SubstFunctionDeclType(TypeSourceInfo *T,
   } else {
     Result = Instantiator.TransformType(TLB, TL);
   }
-  if (Result.isNull())
+  // When clang goes into recovery mode, it might substitute
+  // the incorrect function type with a primitive (e.g., int).
+  if (Result.isNull() || !Result->isFunctionType())
     return nullptr;
 
   return TLB.getTypeSourceInfo(Context, Result);
diff --git a/clang/test/SemaTemplate/function-decl-nested-type-alias.cpp b/clang/test/SemaTemplate/function-decl-nested-type-alias.cpp
new file mode 100644
index 000000000000000..139706f73d24dba
--- /dev/null
+++ b/clang/test/SemaTemplate/function-decl-nested-type-alias.cpp
@@ -0,0 +1,14 @@
+// RUN: %clang_cc1 -x c++ -std=c++14 -fsyntax-only -verify %s
+
+template <class A>
+using Type = typename A::NestedType; // expected-error {{type 'float' cannot be used prior to '::' because it has no members}}
+
+template <typename T>
+void Func() {
+  using MyType = Type<T>(); // expected-note {{in instantiation of template type alias 'Type' requested here}}
+  MyType var;
+}
+
+void Test() {
+  Func<float>(); // expected-note {{in instantiation of function template specialization 'Func<float>' requested here}}
+}
\ No newline at end of file

>From 4d9b1a68e9c7396951b08e816236e0aa6ff705ce Mon Sep 17 00:00:00 2001
From: Viktoriia Bakalova <bakalova at google.com>
Date: Wed, 18 Oct 2023 13:06:09 +0000
Subject: [PATCH 2/2] [clang] Add comments.

---
 clang/lib/Sema/SemaTemplateInstantiate.cpp                  | 4 ++--
 clang/test/SemaTemplate/function-decl-nested-type-alias.cpp | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/clang/lib/Sema/SemaTemplateInstantiate.cpp b/clang/lib/Sema/SemaTemplateInstantiate.cpp
index dfd7cc284eb6b73..d7d5ce19b75a965 100644
--- a/clang/lib/Sema/SemaTemplateInstantiate.cpp
+++ b/clang/lib/Sema/SemaTemplateInstantiate.cpp
@@ -2662,8 +2662,8 @@ TypeSourceInfo *Sema::SubstFunctionDeclType(TypeSourceInfo *T,
   } else {
     Result = Instantiator.TransformType(TLB, TL);
   }
-  // When clang goes into recovery mode, it might substitute
-  // the incorrect function type with a primitive (e.g., int).
+  // When there are errors resolving types, clang may use IntTy as a fallback,
+  // breaking our assumption that function declarations have function types.
   if (Result.isNull() || !Result->isFunctionType())
     return nullptr;
 
diff --git a/clang/test/SemaTemplate/function-decl-nested-type-alias.cpp b/clang/test/SemaTemplate/function-decl-nested-type-alias.cpp
index 139706f73d24dba..4bca990f69046b5 100644
--- a/clang/test/SemaTemplate/function-decl-nested-type-alias.cpp
+++ b/clang/test/SemaTemplate/function-decl-nested-type-alias.cpp
@@ -6,6 +6,8 @@ using Type = typename A::NestedType; // expected-error {{type 'float' cannot be
 template <typename T>
 void Func() {
   using MyType = Type<T>(); // expected-note {{in instantiation of template type alias 'Type' requested here}}
+  // This is a function declaration, not a variable declaration!
+  // After substitution, we do not have a valid function type, and used to crash.
   MyType var;
 }