[clang] [clang][Sema] fix crash on __type_pack_element with dependent packs (GH180307) (PR #180407)

[via cfe-commits]

https://github.com/Serosh-commits updated https://github.com/llvm/llvm-project/pull/180407

>From 99a7cd2f824e1c0c34200631ddca9ee41d480d06 Mon Sep 17 00:00:00 2001
From: Serosh-commits <janmejayapanda400 at gmail.com>
Date: Sun, 8 Feb 2026 17:40:06 +0530
Subject: [PATCH] [clang][sema] fix crash on builtin template ids with
 dependent packs (gh180307)

---
 clang/lib/Sema/SemaTemplate.cpp               | 23 ++++++++--------
 .../builtin_templates_invalid_parameters.cpp  | 26 +++++++++++++++++++
 2 files changed, 38 insertions(+), 11 deletions(-)
 create mode 100644 clang/test/SemaCXX/builtin_templates_invalid_parameters.cpp

diff --git a/clang/lib/Sema/SemaTemplate.cpp b/clang/lib/Sema/SemaTemplate.cpp
index 3497ff7856eed..47db53f512a0c 100644
--- a/clang/lib/Sema/SemaTemplate.cpp
+++ b/clang/lib/Sema/SemaTemplate.cpp
@@ -3406,10 +3406,16 @@ static QualType checkBuiltinTemplateIdType(
     Sema &SemaRef, ElaboratedTypeKeyword Keyword, BuiltinTemplateDecl *BTD,
     ArrayRef<TemplateArgument> Converted, SourceLocation TemplateLoc,
     TemplateArgumentListInfo &TemplateArgs) {
+  if (Converted.size() < BTD->getTemplateParameters()->size())
+    return QualType();
+
   ASTContext &Context = SemaRef.getASTContext();
 
   switch (BTD->getBuiltinTemplateKind()) {
   case BTK__make_integer_seq: {
+    assert(Converted.size() == 3);
+    if (Converted[2].isDependent())
+      return QualType();
     // Specializations of __make_integer_seq<S, T, N> are treated like
     // S<T, 0, ..., N-1>.
 
@@ -3423,8 +3429,6 @@ static QualType checkBuiltinTemplateIdType(
     }
 
     TemplateArgument NumArgsArg = Converted[2];
-    if (NumArgsArg.isDependent())
-      return QualType();
 
     TemplateArgumentListInfo SyntheticTemplateArgs;
     // The type argument, wrapped in substitution sugar, gets reused as the
@@ -3459,15 +3463,12 @@ static QualType checkBuiltinTemplateIdType(
   }
 
   case BTK__type_pack_element: {
-    // Specializations of
-    //    __type_pack_element<Index, T_1, ..., T_N>
-    // are treated like T_Index.
     assert(Converted.size() == 2 &&
            "__type_pack_element should be given an index and a parameter pack");
+    if (Converted[0].isDependent() || Converted[1].isDependent())
+      return QualType();
 
     TemplateArgument IndexArg = Converted[0], Ts = Converted[1];
-    if (IndexArg.isDependent() || Ts.isDependent())
-      return QualType();
 
     llvm::APSInt Index = IndexArg.getAsIntegral();
     assert(Index >= 0 && "the index used with __type_pack_element should be of "
@@ -3486,7 +3487,7 @@ static QualType checkBuiltinTemplateIdType(
 
   case BTK__builtin_common_type: {
     assert(Converted.size() == 4);
-    if (llvm::any_of(Converted, [](auto &C) { return C.isDependent(); }))
+    if (Converted[3].isDependent())
       return QualType();
 
     TemplateName BaseTemplate = Converted[0].getAsTemplate();
@@ -3509,14 +3510,14 @@ static QualType checkBuiltinTemplateIdType(
 
   case BTK__hlsl_spirv_type: {
     assert(Converted.size() == 4);
+    if (llvm::any_of(Converted,
+                     [](const TemplateArgument &A) { return A.isDependent(); }))
+      return QualType();
 
     if (!Context.getTargetInfo().getTriple().isSPIRV()) {
       SemaRef.Diag(TemplateLoc, diag::err_hlsl_spirv_only) << BTD;
     }
 
-    if (llvm::any_of(Converted, [](auto &C) { return C.isDependent(); }))
-      return QualType();
-
     uint64_t Opcode = Converted[0].getAsIntegral().getZExtValue();
     uint64_t Size = Converted[1].getAsIntegral().getZExtValue();
     uint64_t Alignment = Converted[2].getAsIntegral().getZExtValue();
diff --git a/clang/test/SemaCXX/builtin_templates_invalid_parameters.cpp b/clang/test/SemaCXX/builtin_templates_invalid_parameters.cpp
new file mode 100644
index 0000000000000..0209ffad6eec5
--- /dev/null
+++ b/clang/test/SemaCXX/builtin_templates_invalid_parameters.cpp
@@ -0,0 +1,26 @@
+// RUN: %clang_cc1 -fsyntax-only -verify -std=c++11 %s
+// expected-error@* {{template argument for non-type template parameter must be an expression}}
+
+using SizeT = decltype(sizeof(int));
+
+// Dependent cases that previously crashed but now return QualType() gracefully.
+template <SizeT... Seq> // expected-note {{template parameter is declared here}}
+using gh180307 = __type_pack_element<Seq...>;
+
+template <typename T>
+using gh180307_bis = __make_integer_seq<gh180307, T>;
+// expected-note at -1 {{template template argument has different template parameters than its corresponding template template parameter}}
+
+// Eager expansion checks: Built-in templates should expand even if the
+// destination template OR the type argument is dependent, provided the size is known.
+template <template <typename T, T... Ints> class Seq>
+using test_make_integer_seq_eager = __make_integer_seq<Seq, int, 2>;
+
+template <typename T, T... Ints> struct MySeq;
+using check_eager = test_make_integer_seq_eager<MySeq>;
+using check_eager = MySeq<int, 0, 1>;
+
+template <typename T>
+using test_make_integer_seq_type_dependent = __make_integer_seq<MySeq, T, 2>;
+using check_type_eager = test_make_integer_seq_type_dependent<int>;
+using check_type_eager = MySeq<int, 0, 1>;