fillAttributedTypeLoc() function is only called with AttributeLists of either DeclarationChunk (which is used for each type in a declarator being parsed) or DeclSpec (which captures information about declaration specifiers).
As C++11 attributes actually appertain to declarators, they are moved straight to the declarator’s attr list in distributeFunctionTypeAttrFromDeclSpec() function.
'Put them wherever you like' semantics is not supported for C++11 attributes (but is allowed for GNU attributes, for example).
So when we meet an attribute while parsing the declaration, we cannot be sure if it appertains to either DeclarationChunk or DeclSpec.
This investigation correlates with the history of changes of SemaType.cpp:
• Asserts in fillAttributedTypeLoc() were added on 3 Mar 2011 in r126986 (http://lists.cs.uiuc.edu/pipermail/cfe-commits/Week-of-Mon-20110228/039638.html);
• Distributing C++11 attrs to the declarator was added on 14 Jan 2013 in r172504 (http://lists.cs.uiuc.edu/pipermail/cfe-commits/Week-of-Mon-20130114/071830.html).
Considering all written above I changed asserts in fillAttributedTypeLoc() to nullptr checks.
This fixes PR17424 and related assertion on
[[gnu::fastcall]] void __stdcall foo();