[clang] [Clang][Sema] Fix crash in CheckNonTypeTemplateParameterType with invalid type (PR #186200)

[Krystian Stasiowski via cfe-commits]

https://github.com/sdkrystian created https://github.com/llvm/llvm-project/pull/186200

When a non-type template parameter has a type containing an undeduced placeholder type that is invalid (e.g., a function returning a function), `SubstAutoTypeSourceInfoDependent` can return null if the type is invalid. `CheckNonTypeTemplateParameterType` was not handling this case and would dereference the null pointer.

Fixes #177545

>From 046639848cbe188700b4fa9090f245de7dc62288 Mon Sep 17 00:00:00 2001
From: Krystian Stasiowski <sdkrystian at gmail.com>
Date: Mon, 26 Jan 2026 15:28:29 -0500
Subject: [PATCH 1/2] [Clang] Fix crash in CheckNonTypeTemplateParameterType
 with invalid type

SubstAutoTypeSourceInfoDependent can return null when transforming an
invalid type containing decltype(auto). Handle this case by returning
QualType() to signal failure.

Fixes #177545
---
 clang/lib/Sema/SemaTemplate.cpp             | 5 ++++-
 clang/test/SemaTemplate/deduction-crash.cpp | 5 +++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/clang/lib/Sema/SemaTemplate.cpp b/clang/lib/Sema/SemaTemplate.cpp
index 9b0bec20618a0..9194ee5e2bee9 100644
--- a/clang/lib/Sema/SemaTemplate.cpp
+++ b/clang/lib/Sema/SemaTemplate.cpp
@@ -1342,7 +1342,10 @@ QualType Sema::CheckNonTypeTemplateParameterType(TypeSourceInfo *&TSI,
     //    - an identifier associated by name lookup with a non-type
     //      template-parameter declared with a type that contains a
     //      placeholder type (7.1.7.4),
-    TSI = SubstAutoTypeSourceInfoDependent(TSI);
+    TypeSourceInfo *NewTSI = SubstAutoTypeSourceInfoDependent(TSI);
+    if (!NewTSI)
+      return QualType();
+    TSI = NewTSI;
   }
 
   return CheckNonTypeTemplateParameterType(TSI->getType(), Loc);
diff --git a/clang/test/SemaTemplate/deduction-crash.cpp b/clang/test/SemaTemplate/deduction-crash.cpp
index 99ca0b365ff6f..7c3e92af068e9 100644
--- a/clang/test/SemaTemplate/deduction-crash.cpp
+++ b/clang/test/SemaTemplate/deduction-crash.cpp
@@ -172,3 +172,8 @@ namespace PR51872_part1 {
   // expected-error at -1 {{no viable constructor or deduction guide for deduction of template arguments of 'T1'}}
   // expected-note at -7  {{candidate template ignored: could not match 'PR51872_part1::T1<value-parameter-0-0>' against 'int'}}
 }
+
+namespace GH177545 {
+  template<decltype(auto)()() volatile throw() -> char> // expected-error {{'decltype(auto)' can only be used as a return type in a function declaration}}
+  struct T2;                                            // expected-error at -1 {{function cannot return function type 'auto () volatile throw() -> decltype(auto)'}}
+}

>From 4ebf3d74cc9e18aad8642a50a3c9cdd7a50ad4b8 Mon Sep 17 00:00:00 2001
From: Krystian Stasiowski <sdkrystian at gmail.com>
Date: Thu, 12 Mar 2026 13:52:27 -0400
Subject: [PATCH 2/2] [FOLD] add release note

---
 clang/docs/ReleaseNotes.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/clang/docs/ReleaseNotes.rst b/clang/docs/ReleaseNotes.rst
index 3617786f09595..35e637e7290cc 100644
--- a/clang/docs/ReleaseNotes.rst
+++ b/clang/docs/ReleaseNotes.rst
@@ -322,6 +322,7 @@ Bug Fixes in This Version
 - Fixed a crash when parsing ``#pragma clang attribute`` arguments for attributes that forbid arguments. (#GH182122)
 - Fixed a bug with multiple-include optimization (MIOpt) state not being preserved in some cases during lexing, which could suppress header-guard mismatch diagnostics and interfere with include-guard optimization. (#GH180155)
 - Fixed a crash when normalizing constraints involving concept template parameters whose index coincided with non-concept template parameters in the same parameter mapping.
+- Fixed a crash when substituting into a non-type template parameter that has a type containing an undeduced placeholder type.
 
 Bug Fixes to Compiler Builtins
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^