[clang] [clang][Sema] fix crash on __type_pack_element with dependent packs (GH180307) (PR #180407)

[via cfe-commits]

https://github.com/Serosh-commits updated https://github.com/llvm/llvm-project/pull/180407

>From cf731e642abeece29ee5f397123b28a84bd2a428 Mon Sep 17 00:00:00 2001
From: Serosh-commits <janmejayapanda400 at gmail.com>
Date: Sun, 8 Feb 2026 17:40:06 +0530
Subject: [PATCH 1/2] [clang][sema] fix crash on builtin template ids with
 dependent packs (gh180307)

---
 clang/lib/Sema/SemaTemplate.cpp               | 28 ++++++-------
 .../builtin_templates_invalid_parameters.cpp  | 41 +++++++++++++++++++
 2 files changed, 53 insertions(+), 16 deletions(-)
 create mode 100644 clang/test/SemaCXX/builtin_templates_invalid_parameters.cpp

diff --git a/clang/lib/Sema/SemaTemplate.cpp b/clang/lib/Sema/SemaTemplate.cpp
index 3497ff7856eed..c54392418e25e 100644
--- a/clang/lib/Sema/SemaTemplate.cpp
+++ b/clang/lib/Sema/SemaTemplate.cpp
@@ -3406,10 +3406,22 @@ static QualType checkBuiltinTemplateIdType(
     Sema &SemaRef, ElaboratedTypeKeyword Keyword, BuiltinTemplateDecl *BTD,
     ArrayRef<TemplateArgument> Converted, SourceLocation TemplateLoc,
     TemplateArgumentListInfo &TemplateArgs) {
+  TemplateParameterList *Params = BTD->getTemplateParameters();
+  unsigned RequiredArgs = Params->size();
+  if (Params->hasParameterPack()) {
+    if (Converted.size() < RequiredArgs)
+      return QualType();
+  } else {
+    if (Converted.size() != RequiredArgs)
+      return QualType();
+  }
+
   ASTContext &Context = SemaRef.getASTContext();
 
   switch (BTD->getBuiltinTemplateKind()) {
   case BTK__make_integer_seq: {
+    if (Converted[2].isDependent())
+      return QualType();
     // Specializations of __make_integer_seq<S, T, N> are treated like
     // S<T, 0, ..., N-1>.
 
@@ -3423,8 +3435,6 @@ static QualType checkBuiltinTemplateIdType(
     }
 
     TemplateArgument NumArgsArg = Converted[2];
-    if (NumArgsArg.isDependent())
-      return QualType();
 
     TemplateArgumentListInfo SyntheticTemplateArgs;
     // The type argument, wrapped in substitution sugar, gets reused as the
@@ -3459,12 +3469,6 @@ static QualType checkBuiltinTemplateIdType(
   }
 
   case BTK__type_pack_element: {
-    // Specializations of
-    //    __type_pack_element<Index, T_1, ..., T_N>
-    // are treated like T_Index.
-    assert(Converted.size() == 2 &&
-           "__type_pack_element should be given an index and a parameter pack");
-
     TemplateArgument IndexArg = Converted[0], Ts = Converted[1];
     if (IndexArg.isDependent() || Ts.isDependent())
       return QualType();
@@ -3485,7 +3489,6 @@ static QualType checkBuiltinTemplateIdType(
   }
 
   case BTK__builtin_common_type: {
-    assert(Converted.size() == 4);
     if (llvm::any_of(Converted, [](auto &C) { return C.isDependent(); }))
       return QualType();
 
@@ -3508,8 +3511,6 @@ static QualType checkBuiltinTemplateIdType(
   }
 
   case BTK__hlsl_spirv_type: {
-    assert(Converted.size() == 4);
-
     if (!Context.getTargetInfo().getTriple().isSPIRV()) {
       SemaRef.Diag(TemplateLoc, diag::err_hlsl_spirv_only) << BTD;
     }
@@ -3537,12 +3538,7 @@ static QualType checkBuiltinTemplateIdType(
     return Context.getHLSLInlineSpirvType(Opcode, Size, Alignment, Operands);
   }
   case BTK__builtin_dedup_pack: {
-    assert(Converted.size() == 1 && "__builtin_dedup_pack should be given "
-                                    "a parameter pack");
     TemplateArgument Ts = Converted[0];
-    // Delay the computation until we can compute the final result. We choose
-    // not to remove the duplicates upfront before substitution to keep the code
-    // simple.
     if (Ts.isDependent())
       return QualType();
     assert(Ts.getKind() == clang::TemplateArgument::Pack);
diff --git a/clang/test/SemaCXX/builtin_templates_invalid_parameters.cpp b/clang/test/SemaCXX/builtin_templates_invalid_parameters.cpp
new file mode 100644
index 0000000000000..dd74bbd1d900d
--- /dev/null
+++ b/clang/test/SemaCXX/builtin_templates_invalid_parameters.cpp
@@ -0,0 +1,41 @@
+// RUN: %clang_cc1 -fsyntax-only -verify -std=c++11 %s
+// expected-error@* 2 {{template argument for non-type template parameter must be an expression}}
+
+using SizeT = decltype(sizeof(int));
+
+// Dependent cases that previously crashed but now return QualType() gracefully.
+template <SizeT... Seq> // expected-note {{template parameter is declared here}}
+using gh180307 = __type_pack_element<Seq...>;
+
+template <typename T>
+using gh180307_bis = __make_integer_seq<gh180307, T>;
+// expected-note at -1 {{template template argument has different template parameters than its corresponding template template parameter}}
+
+// Eager expansion checks: Built-in templates should expand even if the
+// destination template OR the type argument is dependent, provided the size is known.
+template <template <typename T, T... Ints> class Seq>
+using test_make_integer_seq_eager = __make_integer_seq<Seq, int, 2>;
+
+template <typename T, T... Ints> struct MySeq;
+using check_eager = test_make_integer_seq_eager<MySeq>;
+using check_eager = MySeq<int, 0, 1>;
+
+template <typename T>
+using test_make_integer_seq_type_dependent = __make_integer_seq<MySeq, T, 2>;
+using check_type_eager = test_make_integer_seq_type_dependent<int>;
+using check_type_eager = MySeq<int, 0, 1>;
+
+// Too many arguments tests
+template <int N> struct S; // expected-note {{template parameter is declared here}}
+using too_many_args = __make_integer_seq<S, int, 10, int>; 
+// expected-note at -1 {{template template argument has different template parameters than its corresponding template template parameter}}
+
+// Too few arguments tests
+template <SizeT Index>
+using too_few_args = __type_pack_element<Index>;
+
+// Verify that too_few_args doesn't crash on instantiation either
+// (It should just be an invalid type)
+template <SizeT I> struct Wrap {
+  using type = too_few_args<I>;
+};

>From 8ffca73b3fc88fada9231716525abac112bf7a55 Mon Sep 17 00:00:00 2001
From: Serosh-commits <janmejayapanda400 at gmail.com>
Date: Thu, 12 Feb 2026 22:11:43 +0530
Subject: [PATCH 2/2] [clang][sema] address reviewer feedback for builtin
 template crash (gh180307)

---
 clang/lib/Sema/SemaTemplate.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/clang/lib/Sema/SemaTemplate.cpp b/clang/lib/Sema/SemaTemplate.cpp
index c54392418e25e..274235c6b226e 100644
--- a/clang/lib/Sema/SemaTemplate.cpp
+++ b/clang/lib/Sema/SemaTemplate.cpp
@@ -3426,9 +3426,13 @@ static QualType checkBuiltinTemplateIdType(
     // S<T, 0, ..., N-1>.
 
     QualType OrigType = Converted[1].getAsType();
+    if (OrigType->isDependentType())
+      return QualType();
+
     // C++14 [inteseq.intseq]p1:
     //   T shall be an integer type.
-    if (!OrigType->isDependentType() && !OrigType->isIntegralType(Context)) {
+    assert(!OrigType->isDependentType());
+    if (!OrigType->isIntegralType(Context)) {
       SemaRef.Diag(TemplateArgs[1].getLocation(),
                    diag::err_integer_sequence_integral_element_type);
       return QualType();