[clang] [clang] Fix crash when `__builtin_function_start` is given an invalid first parameter (PR #155506)

[via cfe-commits]

https://github.com/Mr-Anyone created https://github.com/llvm/llvm-project/pull/155506

Prevent a crash in `__builtin_function_start` by adding a check for an invalid first parameter.

fixes #113323

>From 3bb8b9fa901324a2bef20a112ffa957a82bea84b Mon Sep 17 00:00:00 2001
From: Vincent <llvm at viceroygroup.ca>
Date: Thu, 14 Aug 2025 21:50:47 +0800
Subject: [PATCH] [clang] Fix crash when __builtin_function_start is given an
 invalid first parameter

Prevent a crash in __builtin_function_start by adding a check for an invalid first parameter.

fixes #113323
---
 clang/docs/ReleaseNotes.rst     | 2 ++
 clang/lib/Sema/SemaChecking.cpp | 3 +++
 clang/test/SemaCXX/gh113323.cpp | 5 +++++
 3 files changed, 10 insertions(+)
 create mode 100644 clang/test/SemaCXX/gh113323.cpp

diff --git a/clang/docs/ReleaseNotes.rst b/clang/docs/ReleaseNotes.rst
index 9a05eea9de8ac..9cd8a10b72c36 100644
--- a/clang/docs/ReleaseNotes.rst
+++ b/clang/docs/ReleaseNotes.rst
@@ -258,6 +258,8 @@ Bug Fixes in This Version
   targets that treat ``_Float16``/``__fp16`` as native scalar types. Previously
   the warning was silently lost because the operands differed only by an implicit
   cast chain. (#GH149967).
+- Fix crash in ``__builtin_function_start`` by checking for invalid
+  first parameter. (#GH113323).
 - Fixed a crash with incompatible pointer to integer conversions in designated
   initializers involving string literals. (#GH154046)
 - Clang now emits a frontend error when a function marked with the `flatten` attribute
diff --git a/clang/lib/Sema/SemaChecking.cpp b/clang/lib/Sema/SemaChecking.cpp
index 6e777fb9aec8e..d137ccb95d295 100644
--- a/clang/lib/Sema/SemaChecking.cpp
+++ b/clang/lib/Sema/SemaChecking.cpp
@@ -286,6 +286,9 @@ static bool BuiltinFunctionStart(Sema &S, CallExpr *TheCall) {
   if (S.checkArgCount(TheCall, 1))
     return true;
 
+  if(TheCall->getArg(0)->containsErrors())
+      return true;
+
   ExprResult Arg = S.DefaultFunctionArrayLvalueConversion(TheCall->getArg(0));
   if (Arg.isInvalid())
     return true;
diff --git a/clang/test/SemaCXX/gh113323.cpp b/clang/test/SemaCXX/gh113323.cpp
new file mode 100644
index 0000000000000..c753407b6932b
--- /dev/null
+++ b/clang/test/SemaCXX/gh113323.cpp
@@ -0,0 +1,5 @@
+// RUN: %clang_cc1 -fsyntax-only -verify %s
+
+int a() {} // expected-warning {{non-void function does not return a value}}
+constexpr void (*d)() = a; // expected-error {{cannot initialize a variable of type}}
+const void *f = __builtin_function_start(d);