[Clang] prevent recovery call expression from proceeding with explicit attributes and undeclared templates

Author: a-tarasyuk

clang/docs/ReleaseNotes.rst

@@ -424,6 +424,8 @@ Bug Fixes to C++ Support
 - Fixed an assertion failure in debug mode, and potential crashes in release mode, when
   diagnosing a failed cast caused indirectly by a failed implicit conversion to the type of the constructor parameter.
 - Fixed an assertion failure by adjusting integral to boolean vector conversions (#GH108326)
+- Fixed an assertion failure when invoking recovery call expressions with explicit attributes
+  and undeclared templates. (#GH107047, #GH49093)
 
 Bug Fixes to AST Handling
 ^^^^^^^^^^^^^^^^^^^^^^^^^

clang/include/clang/Sema/Sema.h

@@ -6753,7 +6753,9 @@ class Sema final : public SemaBase {
   ///
   /// Return \c true if the error is unrecoverable, or \c false if the caller
   /// should attempt to recover using these lookup results.
-  bool DiagnoseDependentMemberLookup(const LookupResult &R);
+  bool DiagnoseDependentMemberLookup(
+      const LookupResult &R,
+      TemplateArgumentListInfo *ExplicitTemplateArgs = nullptr);
 
   /// Diagnose an empty lookup.
   ///

clang/lib/Sema/SemaExpr.cpp

@@ -2385,7 +2385,15 @@ static void emitEmptyLookupTypoDiagnostic(
                          SemaRef.PDiag(NoteID));
 }
 
-bool Sema::DiagnoseDependentMemberLookup(const LookupResult &R) {
+bool Sema::DiagnoseDependentMemberLookup(
+    const LookupResult &R, TemplateArgumentListInfo *ExplicitTemplateArgs) {
+  auto IsTemplated = [](NamedDecl *D) { return D->isTemplated(); };
+  if (ExplicitTemplateArgs && !llvm::all_of(R, IsTemplated)) {
+    Diag(R.getNameLoc(), diag::err_non_template_in_template_id)
+        << R.getLookupName();
+    return true;
+  }
+
   // During a default argument instantiation the CurContext points
   // to a CXXMethodDecl; but we can't apply a this-> fixit inside a
   // function parameter list, hence add an explicit check.
@@ -2487,7 +2495,7 @@ bool Sema::DiagnoseEmptyLookup(Scope *S, CXXScopeSpec &SS, LookupResult &R,
           R.resolveKind();
         }
 
-        return DiagnoseDependentMemberLookup(R);
+        return DiagnoseDependentMemberLookup(R, ExplicitTemplateArgs);
       }
 
       R.clear();

clang/lib/Sema/SemaOverload.cpp

@@ -13860,7 +13860,7 @@ BuildRecoveryCallExpr(Sema &SemaRef, Scope *S, Expr *Fn,
     // enclosing class.
     // FIXME: We should also explain why the candidates found by name lookup
     // were not viable.
-    if (SemaRef.DiagnoseDependentMemberLookup(R))
+    if (SemaRef.DiagnoseDependentMemberLookup(R, ExplicitTemplateArgs))
       return ExprError();
   } else {
     // We had viable candidates and couldn't recover; let the caller diagnose

clang/test/SemaTemplate/recovery-crash-cxx20.cpp

@@ -0,0 +1,32 @@
+// RUN: %clang_cc1 -fsyntax-only -verify -std=c++20 %s
+
+namespace GH49093 {
+  class B {
+  public:
+    static int a() { return 0; }
+    decltype(a< 0 >(0)) test; // expected-error {{'a' does not name a template but is followed by template arguments}}
+  };
+
+  struct C {
+      static int a() { return 0; }
+      decltype(a < 0 > (0)) test; // expected-error {{'a' does not name a template but is followed by template arguments}}
+  };
+
+  void test_is_bool(bool t) {}
+  void test_is_bool(int t) {}
+
+  int main() {
+    B b;
+    test_is_bool(b.test);
+
+    C c;
+    test_is_bool(c.test);
+  }
+}
+
+namespace GH107047 {
+  struct A {
+    static constexpr auto test() { return 1; }
+    static constexpr int s = test< 1 >(); // expected-error {{'test' does not name a template but is followed by template arguments}}
+  };
+}