[clang] Fix a nullptr-access crash in CheckTemplateArgument.

[hokein]

Summary

It is possible that we can pass a null ParamType to
CheckNonTypeTemplateParameter -- the ParamType var can be reset to a null
type on Line 6940, and the followed bailout if is not entered.

[adamcz]

clang/lib/Sema/SemaTemplate.cpp

6965

So this can only happen when Result is TDK_AlreadyDiagnosed above, right? In that case, I would handle such case explicitly in the code above, like:
if (Result == TDK_AlreadyDiagnosed) return ExprError();
else if (Result != TDK_Success) { ... }
Seems like it would be more readable.

However, I am definitely not opposed to keeping this check here as well, in case there are other ways to get into this situation.

[hokein]

address review comment.

clang/lib/Sema/SemaTemplate.cpp

6965

right. I think either of them works, switched to your version.

clang/lib/Sema/SemaTemplate.cpp

if (isa<DeducedTemplateSpecializationType>(DeducedT)) {
           DeduceAutoType(TSI->getTypeLoc(), DeductionArg, ParamType, Info,
                          /*DependentDeduction=*/true,
                          // We do not check constraints right now because the
                          // immediately-declared constraint of the auto type is
                          // also an associated constraint, and will be checked
                          // along with the other associated constraints after
                          // checking the template argument list.
                          /*IgnoreConstraints=*/true);
-      if (Result != TDK_Success && Result != TDK_AlreadyDiagnosed) {
+      if (Result == TDK_AlreadyDiagnosed) {
+        if (ParamType.isNull())
+          return ExprError();
+      } else if (Result != TDK_Success) {
         Diag(Arg->getExprLoc(),
              diag::err_non_type_template_parm_type_deduction_failure)
             << Param->getDeclName() << Param->getType() << Arg->getType()
             << Arg->getSourceRange();
         Diag(Param->getLocation(), diag::note_template_param_here);
         return ExprError();
       }
     }
     // CheckNonTypeTemplateParameterType will produce a diagnostic if there's
     // an error. The error message normally references the parameter
     // declaration, but here we'll pass the argument location because that's
     // where the parameter type is deduced.
     ParamType = CheckNonTypeTemplateParameterType(ParamType, Arg->getExprLoc());
     if (ParamType.isNull()) {
       Diag(Param->getLocation(), diag::note_template_param_here);
       return ExprError();
     }
   }

clang/test/SemaTemplate/temp_arg_nontype_cxx1z.cpp

namespace TypeSuffix {
   template <auto N> struct F {};
   template <> struct F<'a'> { using type = unsigned char; }; // expected-note {{'F<'a'>::type' declared here}}
   F<'b'>::type f;                                            // expected-error {{no type named 'type' in 'TypeSuffix::F<'b'>'; did you mean 'F<'a'>::type'?}}
 
   template <auto... N> struct X {};
   X<1, 1u>::type y; // expected-error {{no type named 'type' in 'TypeSuffix::X<1, 1U>'}}
   X<1, 1>::type z; // expected-error {{no type named 'type' in 'TypeSuffix::X<1, 1>'}}
 }
+
+namespace no_crash {
+template <class T>
+class Base {
+public:
+  template <class> class EntryPointSpec {};
+  template <auto Method>
+  using EntryPoint = EntryPointSpec<T>;
+};
+
+class Derived : Base<Derived>{
+  template <class...> class Spec {};
+
+  void Invalid(Undefined) const; // expected-error {{unknown type name 'Undefined'}}
+  void crash() {
+    return Spec{
+        EntryPoint<&Invalid>()
+    };
+  }
+};
+} // no_crash