[clang] Segmentation fault with `static_assert(__builtin_is_implicit_lifetime(int __attribute__((btf_type_tag("user"))) *))`

[Zingam]

The following libc++ lit test causes a segmentation fault:

#include <cassert>

template <typename T>
constexpr void test1() {
    assert(true);
    static_assert(__builtin_is_implicit_lifetime(int __attribute__((btf_type_tag("user"))) *));
}

constexpr bool test() {
  test1<int>();
  return true;
}

int main(int, char**) {
  test();
  static_assert(test());

  return 0;
}

# .---command stderr------------
# | PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
# | Stack dump:
# | 0.  Program arguments: /usr/lib/llvm-20/bin/clang -cc1 -triple x86_64-unknown-linux-gnu -emit-obj -dumpdir /home/h/Projects/llvm-project/build/default.debug.libcxx.clang-20/test/std/utilities/meta/meta.unary/meta.unary.prop/Output/is_implicit.pass.cpp.dir/t.tmp.exe- -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name is_implicit.pass.cpp -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/home/h/Projects/llvm-project/build/default.debug.libcxx.clang-20/test/std/utilities/meta/meta.unary/meta.unary.prop -fcoverage-compilation-dir=/home/h/Projects/llvm-project/build/default.debug.libcxx.clang-20/test/std/utilities/meta/meta.unary/meta.unary.prop -nostdinc++ -resource-dir /usr/lib/llvm-20/lib/clang/20 -I /home/h/Projects/llvm-project/build/default.debug.libcxx.clang-20/include/c++/v1 -I /home/h/Projects/llvm-project/build/default.debug.libcxx.clang-20/include/c++/v1 -I /home/h/Projects/llvm-project/libcxx/test/support -D _LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER -D _LIBCPP_ENABLE_EXPERIMENTAL -D _LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG -internal-isystem /usr/lib/llvm-20/lib/clang/20/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -Werror -Wall -Wctad-maybe-unsupported -Wextra -Wshadow -Wundef -Wunused-template -Wno-unused-command-line-argument -Wno-attributes -Wno-pessimizing-move -Wno-noexcept-type -Wno-atomic-alignment -Wno-reserved-module-identifier -Wdeprecated-copy -Wdeprecated-copy-dtor -Wno-user-defined-literals -Wno-tautological-compare -Wsign-compare -Wunused-variable -Wunused-parameter -Wunreachable-code -Wno-unused-local-typedef -Wno-local-type-template-args -Wno-c++11-extensions -Wno-unknown-pragmas -Wno-pass-failed -Wno-mismatched-new-delete -Wno-redundant-move -Wno-self-move -Werror=thread-safety -Wuser-defined-warnings -std=c++26 -fdeprecated-macro -ferror-limit 19 -pthread -fgnuc-version=4.2.1 -fno-implicit-modules -fskip-odr-check-in-gmf -fcxx-exceptions -fexceptions -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/lit-tmp-azt46ovm/is_implicit-847fa8.o -x c++ /home/h/Projects/llvm-project/libcxx/test/std/utilities/meta/meta.unary/meta.unary.prop/is_implicit.pass.cpp
# | 1.  /home/h/Projects/llvm-project/libcxx/test/std/utilities/meta/meta.unary/meta.unary.prop/is_implicit.pass.cpp:10:14: current parser token ')'
# | 2.  /home/h/Projects/llvm-project/libcxx/test/std/utilities/meta/meta.unary/meta.unary.prop/is_implicit.pass.cpp:9:23: parsing function body 'test'
# | 3.  /home/h/Projects/llvm-project/libcxx/test/std/utilities/meta/meta.unary/meta.unary.prop/is_implicit.pass.cpp:9:23: in compound statement ('{}')
# | 4.  /home/h/Projects/llvm-project/libcxx/test/std/utilities/meta/meta.unary/meta.unary.prop/is_implicit.pass.cpp:4:16: instantiating function definition 'test1<int>'
# | #0 0x00007fd805f4babf llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/usr/lib/llvm-20/bin/../lib/libLLVM.so.20.0+0xf62abf)
# | #1 0x00007fd805f497d9 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-20/bin/../lib/libLLVM.so.20.0+0xf607d9)
# | #2 0x00007fd805f4c210 (/usr/lib/llvm-20/bin/../lib/libLLVM.so.20.0+0xf63210)
# | #3 0x00007fd804a7f320 (/lib/x86_64-linux-gnu/libc.so.6+0x45320)
# | #4 0x00007fd80e3fea20 clang::ObjCObjectTypeLoc::initializeLocal(clang::ASTContext&, clang::SourceLocation) (/usr/lib/llvm-20/bin/../lib/libclang-cpp.so.20.0+0x1333a20)
# | #5 0x00007fd80de35242 clang::ASTContext::getTrivialTypeSourceInfo(clang::QualType, clang::SourceLocation) const (/usr/lib/llvm-20/bin/../lib/libclang-cpp.so.20.0+0xd6a242)
# | #6 0x00007fd80ef17ff5 clang::Sema::SubstType(clang::QualType, clang::MultiLevelTemplateArgumentList const&, clang::SourceLocation, clang::DeclarationName) (/usr/lib/llvm-20/bin/../lib/libclang-cpp.so.20.0+0x1e4cff5)
# | #7 0x000055c21f13384c
# | clang++-20: error: unable to execute command: Segmentation fault
# | clang++-20: error: clang frontend command failed due to signal (use -v to see invocation)
# | Ubuntu clang version 20.0.0 (++20240828081755+22e55ba3293f-1~exp1~20240828081902.377)
# | Target: x86_64-unknown-linux-gnu
# | Thread model: posix
# | InstalledDir: /usr/lib/llvm-20/bin
# | clang++-20: note: diagnostic msg:
# | ********************
# |
# | PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
# | Preprocessed source(s) and associated run script(s) are located at:
# | clang++-20: note: diagnostic msg: /tmp/lit-tmp-azt46ovm/is_implicit-3295e8.cpp
# | clang++-20: note: diagnostic msg: /tmp/lit-tmp-azt46ovm/is_implicit-3295e8.sh
# | clang++-20: note: diagnostic msg:
# |
# | ********************
# `-----------------------------
# error: command failed with exit status: 1

[llvmbot]

@llvm/issue-subscribers-clang-frontend

Author: Hristo Hristov (Zingam)

The following libc++ lit test causes a segmentation fault:

#include <cassert>

template <typename T>
constexpr void test1() {
    assert(true);
    static_assert(__builtin_is_implicit_lifetime(int __attribute__((btf_type_tag("user"))) *));
}

constexpr bool test() {
  test1<int>();
  return true;
}

int main(int, char**) {
  test();
  static_assert(test());

  return 0;
}

# .---command stderr------------
# | PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
# | Stack dump:
# | 0.  Program arguments: /usr/lib/llvm-20/bin/clang -cc1 -triple x86_64-unknown-linux-gnu -emit-obj -dumpdir /home/h/Projects/llvm-project/build/default.debug.libcxx.clang-20/test/std/utilities/meta/meta.unary/meta.unary.prop/Output/is_implicit.pass.cpp.dir/t.tmp.exe- -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name is_implicit.pass.cpp -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/home/h/Projects/llvm-project/build/default.debug.libcxx.clang-20/test/std/utilities/meta/meta.unary/meta.unary.prop -fcoverage-compilation-dir=/home/h/Projects/llvm-project/build/default.debug.libcxx.clang-20/test/std/utilities/meta/meta.unary/meta.unary.prop -nostdinc++ -resource-dir /usr/lib/llvm-20/lib/clang/20 -I /home/h/Projects/llvm-project/build/default.debug.libcxx.clang-20/include/c++/v1 -I /home/h/Projects/llvm-project/build/default.debug.libcxx.clang-20/include/c++/v1 -I /home/h/Projects/llvm-project/libcxx/test/support -D _LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER -D _LIBCPP_ENABLE_EXPERIMENTAL -D _LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG -internal-isystem /usr/lib/llvm-20/lib/clang/20/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/14/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -Werror -Wall -Wctad-maybe-unsupported -Wextra -Wshadow -Wundef -Wunused-template -Wno-unused-command-line-argument -Wno-attributes -Wno-pessimizing-move -Wno-noexcept-type -Wno-atomic-alignment -Wno-reserved-module-identifier -Wdeprecated-copy -Wdeprecated-copy-dtor -Wno-user-defined-literals -Wno-tautological-compare -Wsign-compare -Wunused-variable -Wunused-parameter -Wunreachable-code -Wno-unused-local-typedef -Wno-local-type-template-args -Wno-c++11-extensions -Wno-unknown-pragmas -Wno-pass-failed -Wno-mismatched-new-delete -Wno-redundant-move -Wno-self-move -Werror=thread-safety -Wuser-defined-warnings -std=c++26 -fdeprecated-macro -ferror-limit 19 -pthread -fgnuc-version=4.2.1 -fno-implicit-modules -fskip-odr-check-in-gmf -fcxx-exceptions -fexceptions -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/lit-tmp-azt46ovm/is_implicit-847fa8.o -x c++ /home/h/Projects/llvm-project/libcxx/test/std/utilities/meta/meta.unary/meta.unary.prop/is_implicit.pass.cpp
# | 1.  /home/h/Projects/llvm-project/libcxx/test/std/utilities/meta/meta.unary/meta.unary.prop/is_implicit.pass.cpp:10:14: current parser token ')'
# | 2.  /home/h/Projects/llvm-project/libcxx/test/std/utilities/meta/meta.unary/meta.unary.prop/is_implicit.pass.cpp:9:23: parsing function body 'test'
# | 3.  /home/h/Projects/llvm-project/libcxx/test/std/utilities/meta/meta.unary/meta.unary.prop/is_implicit.pass.cpp:9:23: in compound statement ('{}')
# | 4.  /home/h/Projects/llvm-project/libcxx/test/std/utilities/meta/meta.unary/meta.unary.prop/is_implicit.pass.cpp:4:16: instantiating function definition 'test1<int>'
# | #<!-- -->0 0x00007fd805f4babf llvm::sys::PrintStackTrace(llvm::raw_ostream&amp;, int) (/usr/lib/llvm-20/bin/../lib/libLLVM.so.20.0+0xf62abf)
# | #<!-- -->1 0x00007fd805f497d9 llvm::sys::RunSignalHandlers() (/usr/lib/llvm-20/bin/../lib/libLLVM.so.20.0+0xf607d9)
# | #<!-- -->2 0x00007fd805f4c210 (/usr/lib/llvm-20/bin/../lib/libLLVM.so.20.0+0xf63210)
# | #<!-- -->3 0x00007fd804a7f320 (/lib/x86_64-linux-gnu/libc.so.6+0x45320)
# | #<!-- -->4 0x00007fd80e3fea20 clang::ObjCObjectTypeLoc::initializeLocal(clang::ASTContext&amp;, clang::SourceLocation) (/usr/lib/llvm-20/bin/../lib/libclang-cpp.so.20.0+0x1333a20)
# | #<!-- -->5 0x00007fd80de35242 clang::ASTContext::getTrivialTypeSourceInfo(clang::QualType, clang::SourceLocation) const (/usr/lib/llvm-20/bin/../lib/libclang-cpp.so.20.0+0xd6a242)
# | #<!-- -->6 0x00007fd80ef17ff5 clang::Sema::SubstType(clang::QualType, clang::MultiLevelTemplateArgumentList const&amp;, clang::SourceLocation, clang::DeclarationName) (/usr/lib/llvm-20/bin/../lib/libclang-cpp.so.20.0+0x1e4cff5)
# | #<!-- -->7 0x000055c21f13384c
# | clang++-20: error: unable to execute command: Segmentation fault
# | clang++-20: error: clang frontend command failed due to signal (use -v to see invocation)
# | Ubuntu clang version 20.0.0 (++20240828081755+22e55ba3293f-1~exp1~20240828081902.377)
# | Target: x86_64-unknown-linux-gnu
# | Thread model: posix
# | InstalledDir: /usr/lib/llvm-20/bin
# | clang++-20: note: diagnostic msg:
# | ********************
# |
# | PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
# | Preprocessed source(s) and associated run script(s) are located at:
# | clang++-20: note: diagnostic msg: /tmp/lit-tmp-azt46ovm/is_implicit-3295e8.cpp
# | clang++-20: note: diagnostic msg: /tmp/lit-tmp-azt46ovm/is_implicit-3295e8.sh
# | clang++-20: note: diagnostic msg:
# |
# | ********************
# `-----------------------------
# error: command failed with exit status: 1

[cor3ntin]

@MitalAshok

[MitalAshok]

There's an assertion failure with templates containing a BTFTagAttributedType. Here's the message: https://godbolt.org/z/vYhsasePY

template <typename T>
void test1() {
  static_assert(!__is_void(int __attribute__((btf_type_tag("user"))) *));
}
void test() {
  test1<int>();
}

Unexpected TreeTransform for BTFTagAttributedType
UNREACHABLE executed at /llvm/llvm-project/clang/lib/Sema/TreeTransform.h:7459!
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0.	Program arguments: /cmake-build-debug/bin/clang++ -cc1 -fsyntax-only test.cpp
1.	<eof> parser at end of file
2.	test.cpp:2:6: instantiating function definition 'test1<int>'
 #0 0x0000562073d0da4d llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /llvm/llvm-project/llvm/lib/Support/Unix/Signals.inc:723:11
 #1 0x0000562073d0df3b PrintStackTraceSignalHandler(void*) /llvm/llvm-project/llvm/lib/Support/Unix/Signals.inc:798:1
 #2 0x0000562073d0bfa6 llvm::sys::RunSignalHandlers() /llvm/llvm-project/llvm/lib/Support/Signals.cpp:105:5
 #3 0x0000562073d0e6f5 SignalHandler(int) /llvm/llvm-project/llvm/lib/Support/Unix/Signals.inc:413:1
 #4 0x00007f3f386c9520 (/lib/x86_64-linux-gnu/libc.so.6+0x42520)
 #5 0x00007f3f3871d9fc __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
 #6 0x00007f3f3871d9fc __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
 #7 0x00007f3f3871d9fc pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
 #8 0x00007f3f386c9476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
 #9 0x00007f3f386af7f3 abort ./stdlib/./stdlib/abort.c:81:7
#10 0x0000562073c3cfa0 llvm::install_out_of_memory_new_handler() /llvm/llvm-project/llvm/lib/Support/ErrorHandling.cpp:195:0
#11 0x000056207a38b6c0 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformBitIntType(clang::TypeLocBuilder&, clang::BitIntTypeLoc) /llvm/llvm-project/clang/lib/Sema/TreeTransform.h:7017:0
#12 0x000056207a2c4002 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformType(clang::TypeLocBuilder&, clang::TypeLoc) /cmake-build-debug/tools/clang/include/clang/AST/TypeNodes.inc:32:1
#13 0x000056207a391479 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformPointerType(clang::TypeLocBuilder&, clang::PointerTypeLoc) /llvm/llvm-project/clang/lib/Sema/TreeTransform.h:5341:20
#14 0x000056207a2c4be2 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformType(clang::TypeLocBuilder&, clang::TypeLoc) /cmake-build-debug/tools/clang/include/clang/AST/TypeNodes.inc:68:1
#15 0x000056207a35c5c8 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformTypeTraitExpr(clang::TypeTraitExpr*) /llvm/llvm-project/clang/lib/Sema/TreeTransform.h:13903:34
#16 0x000056207a2cd4b3 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformExpr(clang::Expr*) /cmake-build-debug/tools/clang/include/clang/AST/StmtNodes.inc:68:1
#17 0x000056207a35bff0 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformUnaryOperator(clang::UnaryOperator*) /llvm/llvm-project/clang/lib/Sema/TreeTransform.h:12094:15
#18 0x000056207a2cd432 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformExpr(clang::Expr*) /cmake-build-debug/tools/clang/include/clang/AST/StmtNodes.inc:50:1
#19 0x000056207a2cd354 clang::Sema::SubstExpr(clang::Expr*, clang::MultiLevelTemplateArgumentList const&) /llvm/llvm-project/clang/lib/Sema/SemaTemplateInstantiate.cpp:4282:23
#20 0x000056207a3ddcd4 clang::TemplateDeclInstantiator::VisitStaticAssertDecl(clang::StaticAssertDecl*) /llvm/llvm-project/clang/lib/Sema/SemaTemplateInstantiateDecl.cpp:1527:15
#21 0x000056207a3c5361 clang::declvisitor::Base<std::add_pointer, clang::TemplateDeclInstantiator, clang::Decl*>::Visit(clang::Decl*) /cmake-build-debug/tools/clang/include/clang/AST/DeclNodes.inc:72:1
#22 0x000056207a45ebe4 clang::Sema::SubstDecl(clang::Decl*, clang::DeclContext*, clang::MultiLevelTemplateArgumentList const&)::$_0::operator()() const /llvm/llvm-project/clang/lib/Sema/SemaTemplateInstantiateDecl.cpp:4140:27
#23 0x000056207a45ebb5 void llvm::function_ref<void ()>::callback_fn<clang::Sema::SubstDecl(clang::Decl*, clang::DeclContext*, clang::MultiLevelTemplateArgumentList const&)::$_0>(long) /llvm/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:45:5
#24 0x00005620728d2d29 llvm::function_ref<void ()>::operator()() const /llvm/llvm-project/llvm/include/llvm/ADT/STLFunctionalExtras.h:68:5
#25 0x00005620756bf6ed clang::runWithSufficientStackSpace(llvm::function_ref<void ()>, llvm::function_ref<void ()>) /llvm/llvm-project/clang/include/clang/Basic/Stack.h:52:3
#26 0x0000562078ad0550 clang::Sema::runWithSufficientStackSpace(clang::SourceLocation, llvm::function_ref<void ()>) /llvm/llvm-project/clang/lib/Sema/Sema.cpp:577:1
#27 0x000056207a3ece07 clang::Sema::SubstDecl(clang::Decl*, clang::DeclContext*, clang::MultiLevelTemplateArgumentList const&) /llvm/llvm-project/clang/lib/Sema/SemaTemplateInstantiateDecl.cpp:4142:10
#28 0x000056207a3a3744 (anonymous namespace)::TemplateInstantiator::TransformDefinition(clang::SourceLocation, clang::Decl*) /llvm/llvm-project/clang/lib/Sema/SemaTemplateInstantiate.cpp:1862:9
#29 0x000056207a3a0892 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformDeclStmt(clang::DeclStmt*) /llvm/llvm-project/clang/lib/Sema/TreeTransform.h:8316:11
#30 0x000056207a2cc27f clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformStmt(clang::Stmt*, clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::StmtDiscardKind) /cmake-build-debug/tools/clang/include/clang/AST/StmtNodes.inc:1538:1
#31 0x000056207a36f4f6 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformCompoundStmt(clang::CompoundStmt*, bool) /llvm/llvm-project/clang/lib/Sema/TreeTransform.h:7877:38
#32 0x000056207a3a1707 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformCompoundStmt(clang::CompoundStmt*) /llvm/llvm-project/clang/lib/Sema/TreeTransform.h:7859:23
#33 0x000056207a2cc343 clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::TransformStmt(clang::Stmt*, clang::TreeTransform<(anonymous namespace)::TemplateInstantiator>::StmtDiscardKind) /cmake-build-debug/tools/clang/include/clang/AST/StmtNodes.inc:1562:1
#34 0x000056207a2cae36 clang::Sema::SubstStmt(clang::Stmt*, clang::MultiLevelTemplateArgumentList const&) /llvm/llvm-project/clang/lib/Sema/SemaTemplateInstantiate.cpp:4253:23
#35 0x000056207a3ef111 clang::Sema::InstantiateFunctionDefinition(clang::SourceLocation, clang::FunctionDecl*, bool, bool, bool) /llvm/llvm-project/clang/lib/Sema/SemaTemplateInstantiateDecl.cpp:5229:14
#36 0x000056207a3f1ab5 clang::Sema::PerformPendingInstantiations(bool) /llvm/llvm-project/clang/lib/Sema/SemaTemplateInstantiateDecl.cpp:6454:13
#37 0x0000562078ad21c5 clang::Sema::ActOnEndOfTranslationUnitFragment(clang::Sema::TUFragmentKind) /llvm/llvm-project/clang/lib/Sema/Sema.cpp:1154:3
#38 0x0000562078ad25e8 clang::Sema::ActOnEndOfTranslationUnit() /llvm/llvm-project/clang/lib/Sema/Sema.cpp:1186:5
#39 0x0000562078912be6 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr<clang::DeclGroupRef>&, clang::Sema::ModuleImportState&) /llvm/llvm-project/clang/lib/Parse/Parser.cpp:727:5
#40 0x000056207890d99c clang::ParseAST(clang::Sema&, bool, bool) /llvm/llvm-project/clang/lib/Parse/ParseAST.cpp:171:16
#41 0x00005620752f12e1 clang::ASTFrontendAction::ExecuteAction() /llvm/llvm-project/clang/lib/Frontend/FrontendAction.cpp:1194:1
#42 0x00005620752f0cfc clang::FrontendAction::Execute() /llvm/llvm-project/clang/lib/Frontend/FrontendAction.cpp:1082:7
#43 0x000056207520aa46 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) /llvm/llvm-project/clang/lib/Frontend/CompilerInstance.cpp:1061:23
#44 0x00005620754d1c67 clang::ExecuteCompilerInvocation(clang::CompilerInstance*) /llvm/llvm-project/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:280:8
#45 0x0000562071de1959 cc1_main(llvm::ArrayRef<char const*>, char const*, void*) /llvm/llvm-project/clang/tools/driver/cc1_main.cpp:285:13
#46 0x0000562071dd42b2 ExecuteCC1Tool(llvm::SmallVectorImpl<char const*>&, llvm::ToolContext const&) /llvm/llvm-project/clang/tools/driver/driver.cpp:215:5
#47 0x0000562071dd301b clang_main(int, char**, llvm::ToolContext const&) /llvm/llvm-project/clang/tools/driver/driver.cpp:256:5
#48 0x0000562071e08105 main /cmake-build-debug/tools/clang/tools/driver/clang-driver.cpp:17:3
#49 0x00007f3f386b0d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#50 0x00007f3f386b0e40 call_init ./csu/../csu/libc-start.c:128:20
#51 0x00007f3f386b0e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#52 0x0000562071dd2aa5 _start (/cmake-build-debug/bin/clang+++0x5b9faa5)

llvm-project/clang/lib/Sema/TreeTransform.h

Lines 7455 to 7460 in cd3667d

	template <typename Derived>
	QualType TreeTransform<Derived>::TransformBTFTagAttributedType(
	TypeLocBuilder &TLB, BTFTagAttributedTypeLoc TL) {
	// The BTFTagAttributedType is available for C only.
	llvm_unreachable("Unexpected TreeTransform for BTFTagAttributedType");
	}

This crash also happens for using X = int __attribute__((btf_type_tag("user"))) *; and int i = sizeof(int __attribute__((btf_type_tag("user"))) *);, which create a BTFTagAttributedType node: https://godbolt.org/z/Yj3dErc7q

Also a bit concerning that there's a TransformBitIntType in the call stack when there's no _BitInt

[cor3ntin]

I think the assertions don't make sense. afaict there is nothing that would prevent a c++ program to create those.
So we should probably implement the TreeTransform
@AaronBallman

[shafik]

Looks like a clang-15 regression: https://godbolt.org/z/9zM3668zW

[AaronBallman]

Well that's certainly a surprise!

def BTFTypeTag : TypeAttr {
  let Spellings = [Clang<"btf_type_tag">];
  let Args = [StringArgument<"BTFTypeTag">];
  let Documentation = [BTFTypeTagDocs];
  let LangOpts = [COnly];
}

So this should only be available in C, not C++. However, it seems that the code to actually prohibit this in C is not being called in processTypeAttrs().