[clang] [clang][Sema] fix crash on invalid expression with trailing return type and template keyword (PR #191972)

[Erich Keane via cfe-commits]

================
@@ -1514,7 +1514,8 @@ Sema::ActOnCXXTypeConstructExpr(ParsedType TypeRep,
                                           RParenOrBraceLoc, ListInitialization);
   if (Result.isInvalid())
     Result = CreateRecoveryExpr(TInfo->getTypeLoc().getBeginLoc(),
-                                RParenOrBraceLoc, exprs, Ty);
+                                RParenOrBraceLoc, exprs, Ty->isIncompleteType() ? QualType() : Ty);
----------------
erichkeane wrote:

I don't think that condition is the right one, just bypassing the assert is incorrect.  I don't particularly understand after a few minutes of debugging the 'state' teh compiler is in, that is a bit of a 'nonsense' reproducer as it is from a fuzzer.

That said, I would probably look at:

 `Sema::ActOnStartCXXMemberReference`.  This is where we  get the type out of the expression.  I note that if you change `enum` to `class` there, we fall down a different path and end up returning `ExprError` from that function, so we probably want to do something similar., perhaps around 7050.  At that point, we can check `Base->containsError()`, mixed with `isIncomplete` and skip the `MayBePseudoDestructor`?

Probably should spend some time debugging in that area, but th at is where I would immediately look.

https://github.com/llvm/llvm-project/pull/191972