[clang] fix frontend crash in auto type templates

[inclyc]

Summary

Reported by https://github.com/llvm/llvm-project/issues/57142

In this case, AutoTypes.FindNodeOrInsertPos found appropriate AT
value and should return that directly, however before this patch we
assumed that it always get InsertPos back and create a new AT for
it. In fact InsertPos is a nullptr, which causes segmentfault.

[inclyc]

improve test case

[inclyc]

.

[inclyc]

rename

[inclyc]

update comments

[inclyc]

rebase

[inclyc]

.

[mizvekov]

clang/lib/AST/ASTContext.cpp

5735–5736

The original code is correct, AutoTypes.FindNodeOrInsertPos(ID, InsertPos) returning non-null should be impossible here, as we are just refreshing the insert position after having possibly invalidated it when we created the canonical node.

We had looked for the node before and didn't find it, so finding it just after having created the canonical node means this is a canonicalization bug.

I think this could have used an assert on the return value to better explain that is going on.

FWIW, someone else already started working on this bug some time ago, and I made some comments there which I think explain the problem better: See https://reviews.llvm.org/D126172

Might be worth a ping since might have stalled on it though.

clang/lib/AST/ASTContext.cpp

if (!IsCanon) {
     if (DeducedType.isNull()) {
       SmallVector<TemplateArgument, 4> CanonArgs;
       bool AnyNonCanonArgs =
           ::getCanonicalTemplateArguments(*this, TypeConstraintArgs, CanonArgs);
       if (AnyNonCanonArgs) {
         Canon = getAutoTypeInternal(QualType(), Keyword, IsDependent, IsPack,
                                     TypeConstraintConcept, CanonArgs, true);
         // Find the insert position again.
-        AutoTypes.FindNodeOrInsertPos(ID, InsertPos);
+        if (AutoType *AT = AutoTypes.FindNodeOrInsertPos(ID, InsertPos))
+          return QualType(AT, 0);
       }
     } else {
       Canon = DeducedType.getCanonicalType();
     }
   }
 
   void *Mem = Allocate(sizeof(AutoType) +
                            sizeof(TemplateArgument) * TypeConstraintArgs.size(),

clang/test/SemaCXX/sugared-auto.cpp

 decltype(auto) f2() { return Animal(); }
 auto x2 = f2();
 N t2 = x2; // expected-error {{lvalue of type 'Animal' (aka 'int')}}
 
 auto x3 = [a = Animal()] { return a; }();
 N t3 = x3; // expected-error {{lvalue of type 'Animal' (aka 'int')}}
 
 } // namespace function_basic
+
+namespace issue57142 {
+
+// Should not crash here
+// Reported by https://github.com/llvm/llvm-project/issues/57142
+
+
+// Only crashes if `tuple` is defined outside of the buggy namespace
+namespace outer {
+    template <class... Types> class tuple;
+} // namespace outer
+
+namespace {
+struct false_type {
+  static const bool value = false;
+};
+
+template<template<typename...> class, typename>
+struct IsTemplateOf : false_type {};
+
+template<class T, template<typename...> class ATemplate>
+concept InitFrom = IsTemplateOf<ATemplate, T>::value;
+
+
+static void buggy_func(
+    const InitFrom<outer::tuple> auto& C // crashed here in #57142
+); 
+} // namespace
+
+} // namespace issue57142