[clangd] crash in InlayHints.cpp on trivial FunctionProtoTypeLoc

[npc1054657282]

The usage.c in the git project will result in this.

This is a minimal reproduce:

#include <stdlib.h>
#include <stdio.h>
#include <stdarg.h>

#define NORETURN __attribute__((__noreturn__))
#define NORETURN_PTR __attribute__((__noreturn__))
typedef void (*report_fn)(const char *, va_list params);

static void NORETURN die_builtin(const char *err, va_list params)
{
	exit(128);
}

static NORETURN_PTR report_fn die_routine = die_builtin;

void NORETURN die(const char *err, ...)
{
	va_list params;

	va_start(params, err);
	die_routine(err, params);
	va_end(params);
}

The code itself is valid. But the clangd crash:

I[22:05:07.654] clangd version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b)
I[22:05:07.654] Features: linux+grpc
I[22:05:07.654] PID: 734406
I[22:05:07.654] Working directory: /home/npc1054657282/my_projects/clangd-crash-minimal
I[22:05:07.654] argv[0]: /home/npc1054657282/.vscode-server/data/User/globalStorage/llvm-vs-code-extensions.vscode-clangd/install/19.1.2/clangd_19.1.2/bin/clangd
I[22:05:07.654] argv[1]: --compile-commands-dir=.vscode
E[22:05:07.654] Path specified by --compile-commands-dir does not exist. The argument will be ignored.
I[22:05:07.654] Starting LSP over stdin/stdout
I[22:05:07.655] <-- initialize(0)
I[22:05:07.657] --> reply:initialize(0) 1 ms
I[22:05:07.683] <-- initialized
I[22:05:07.686] <-- textDocument/didOpen
I[22:05:07.688] Failed to find compilation database for /home/npc1054657282/my_projects/clangd-crash-minimal/usage.c
I[22:05:07.688] ASTWorker building file /home/npc1054657282/my_projects/clangd-crash-minimal/usage.c version 464 with command clangd fallback
[/home/npc1054657282/my_projects/clangd-crash-minimal]
/usr/bin/clang -resource-dir=/home/npc1054657282/.vscode-server/data/User/globalStorage/llvm-vs-code-extensions.vscode-clangd/install/19.1.2/clangd_19.1.2/lib/clang/19 -- /home/npc1054657282/my_projects/clangd-crash-minimal/usage.c
I[22:05:07.691] --> textDocument/clangd.fileStatus
I[22:05:07.728] Built preamble of size 398024 for file /home/npc1054657282/my_projects/clangd-crash-minimal/usage.c version 464 in 0.04 seconds
I[22:05:07.730] Indexing c17 standard library in the context of /home/npc1054657282/my_projects/clangd-crash-minimal/usage.c
I[22:05:07.730] --> textDocument/clangd.fileStatus
I[22:05:07.730] --> textDocument/clangd.fileStatus
I[22:05:07.730] --> workspace/semanticTokens/refresh(0)
I[22:05:07.740] <-- reply(0)
I[22:05:07.752] --> textDocument/publishDiagnostics
I[22:05:07.752] --> textDocument/inactiveRegions
I[22:05:07.752] --> textDocument/clangd.fileStatus
I[22:05:07.859] <-- textDocument/documentSymbol(1)
I[22:05:07.859] <-- textDocument/documentLink(2)
I[22:05:07.859] <-- textDocument/inlayHint(3)
I[22:05:07.859] <-- textDocument/semanticTokens/full(4)
I[22:05:07.859] <-- textDocument/codeAction(5)
I[22:05:07.860] --> reply:textDocument/documentSymbol(1) 1 ms
I[22:05:07.860] --> reply:textDocument/documentLink(2) 1 ms
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0  clangd          0x000000000055715b
1  clangd          0x0000000000554fbe
2  clangd          0x0000000000557af6
3  libpthread.so.0 0x00007f15ee7ed1d0
4  clangd          0x00000000016e51ba
5  clangd          0x00000000016e2d2c
6  clangd          0x00000000016dcf39
7  clangd          0x00000000016d1bef
8  clangd          0x00000000016e80aa
9  clangd          0x00000000016cd610
10 clangd          0x00000000016cf545
11 clangd          0x00000000016cad1e
12 clangd          0x00000000015f573f
13 clangd          0x000000000179856c
14 clangd          0x000000000178fa0b
15 clangd          0x000000000178e460
16 clangd          0x000000000190f7c1
17 libpthread.so.0 0x00007f15ee7e23fb
18 libc.so.6       0x00007f15ee4e2e83 clone + 67
Signalled during AST worker action: InlayHints
  Filename: usage.c
  Directory: /home/npc1054657282/my_projects/clangd-crash-minimal
  Command Line: /usr/bin/clang -resource-dir=/home/npc1054657282/.vscode-server/data/User/globalStorage/llvm-vs-code-extensions.vscode-clangd/install/19.1.2/clangd_19.1.2/lib/clang/19 -- /home/npc1054657282/my_projects/clangd-crash-minimal/usage.c
  Version: 464
[Error - 10:05:08 PM] The Clang Language Server server crashed 5 times in the last 3 minutes. The server will not be restarted. See the output for more information.
[Error - 10:05:08 PM] Request textDocument/inlayHint failed.
[object Object]
[Error - 10:05:08 PM] Request textDocument/semanticTokens/full failed.
[object Object]
[Error - 10:05:08 PM] Request textDocument/codeAction failed.
[object Object]

[llvmbot]

@llvm/issue-subscribers-clangd

Author: None (npc1054657282)

The `usage.c` in the `git` project will result in this.

This is a minimal reproduce:

#include <stdlib.h>
#include <stdio.h>
#include <stdarg.h>

#define NORETURN __attribute__((__noreturn__))
#define NORETURN_PTR __attribute__((__noreturn__))
typedef void (*report_fn)(const char *, va_list params);

static void NORETURN die_builtin(const char *err, va_list params)
{
	exit(128);
}

static NORETURN_PTR report_fn die_routine = die_builtin;

void NORETURN die(const char *err, ...)
{
	va_list params;

	va_start(params, err);
	die_routine(err, params);
	va_end(params);
}

The code itself is valid. But the clangd crash:

I[22:05:07.654] clangd version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b)
I[22:05:07.654] Features: linux+grpc
I[22:05:07.654] PID: 734406
I[22:05:07.654] Working directory: /home/npc1054657282/my_projects/clangd-crash-minimal
I[22:05:07.654] argv[0]: /home/npc1054657282/.vscode-server/data/User/globalStorage/llvm-vs-code-extensions.vscode-clangd/install/19.1.2/clangd_19.1.2/bin/clangd
I[22:05:07.654] argv[1]: --compile-commands-dir=.vscode
E[22:05:07.654] Path specified by --compile-commands-dir does not exist. The argument will be ignored.
I[22:05:07.654] Starting LSP over stdin/stdout
I[22:05:07.655] <-- initialize(0)
I[22:05:07.657] --> reply:initialize(0) 1 ms
I[22:05:07.683] <-- initialized
I[22:05:07.686] <-- textDocument/didOpen
I[22:05:07.688] Failed to find compilation database for /home/npc1054657282/my_projects/clangd-crash-minimal/usage.c
I[22:05:07.688] ASTWorker building file /home/npc1054657282/my_projects/clangd-crash-minimal/usage.c version 464 with command clangd fallback
[/home/npc1054657282/my_projects/clangd-crash-minimal]
/usr/bin/clang -resource-dir=/home/npc1054657282/.vscode-server/data/User/globalStorage/llvm-vs-code-extensions.vscode-clangd/install/19.1.2/clangd_19.1.2/lib/clang/19 -- /home/npc1054657282/my_projects/clangd-crash-minimal/usage.c
I[22:05:07.691] --> textDocument/clangd.fileStatus
I[22:05:07.728] Built preamble of size 398024 for file /home/npc1054657282/my_projects/clangd-crash-minimal/usage.c version 464 in 0.04 seconds
I[22:05:07.730] Indexing c17 standard library in the context of /home/npc1054657282/my_projects/clangd-crash-minimal/usage.c
I[22:05:07.730] --> textDocument/clangd.fileStatus
I[22:05:07.730] --> textDocument/clangd.fileStatus
I[22:05:07.730] --> workspace/semanticTokens/refresh(0)
I[22:05:07.740] <-- reply(0)
I[22:05:07.752] --> textDocument/publishDiagnostics
I[22:05:07.752] --> textDocument/inactiveRegions
I[22:05:07.752] --> textDocument/clangd.fileStatus
I[22:05:07.859] <-- textDocument/documentSymbol(1)
I[22:05:07.859] <-- textDocument/documentLink(2)
I[22:05:07.859] <-- textDocument/inlayHint(3)
I[22:05:07.859] <-- textDocument/semanticTokens/full(4)
I[22:05:07.859] <-- textDocument/codeAction(5)
I[22:05:07.860] --> reply:textDocument/documentSymbol(1) 1 ms
I[22:05:07.860] --> reply:textDocument/documentLink(2) 1 ms
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump without symbol names (ensure you have llvm-symbolizer in your PATH or set the environment var `LLVM_SYMBOLIZER_PATH` to point to it):
0  clangd          0x000000000055715b
1  clangd          0x0000000000554fbe
2  clangd          0x0000000000557af6
3  libpthread.so.0 0x00007f15ee7ed1d0
4  clangd          0x00000000016e51ba
5  clangd          0x00000000016e2d2c
6  clangd          0x00000000016dcf39
7  clangd          0x00000000016d1bef
8  clangd          0x00000000016e80aa
9  clangd          0x00000000016cd610
10 clangd          0x00000000016cf545
11 clangd          0x00000000016cad1e
12 clangd          0x00000000015f573f
13 clangd          0x000000000179856c
14 clangd          0x000000000178fa0b
15 clangd          0x000000000178e460
16 clangd          0x000000000190f7c1
17 libpthread.so.0 0x00007f15ee7e23fb
18 libc.so.6       0x00007f15ee4e2e83 clone + 67
Signalled during AST worker action: InlayHints
  Filename: usage.c
  Directory: /home/npc1054657282/my_projects/clangd-crash-minimal
  Command Line: /usr/bin/clang -resource-dir=/home/npc1054657282/.vscode-server/data/User/globalStorage/llvm-vs-code-extensions.vscode-clangd/install/19.1.2/clangd_19.1.2/lib/clang/19 -- /home/npc1054657282/my_projects/clangd-crash-minimal/usage.c
  Version: 464
[Error - 10:05:08 PM] The Clang Language Server server crashed 5 times in the last 3 minutes. The server will not be restarted. See the output for more information.
[Error - 10:05:08 PM] Request textDocument/inlayHint failed.
[object Object]
[Error - 10:05:08 PM] Request textDocument/semanticTokens/full failed.
[object Object]
[Error - 10:05:08 PM] Request textDocument/codeAction failed.
[object Object]

[carsonRadtke]

Smaller repro (w/ symbols):

typedef void (*report_fn)(const char *);

void die_builtin(const char *err);

__attribute__((noreturn))  report_fn die_routine = die_builtin;

void foo(const char *err )
{
	die_routine(err);
}

I[15:33:40.354] clangd version 21.0.0git (https://github.com/carsonRadtke/llvm-project.git d0fb83531b07f608da064ed98e6213f32a5544e9)
I[15:33:40.355] Features: mac+debug+xpc
I[15:33:40.355] PID: 95466
I[15:33:40.355] Working directory: /Users/carson/Downloads
I[15:33:40.355] argv[0]: /Users/carson/repos/llvm-project/build/bin/clangd
I[15:33:40.357] Starting LSP over stdin/stdout
I[15:33:40.360] <-- initialize(0)
I[15:33:40.390] --> reply:initialize(0) 29 ms
I[15:33:40.391] <-- initialized
I[15:33:40.391] <-- textDocument/didOpen
I[15:33:40.399] Failed to find compilation database for /Users/carson/Downloads/blah.c
I[15:33:40.399] <-- textDocument/documentSymbol(1)
I[15:33:40.400] ASTWorker building file /Users/carson/Downloads/blah.c version 68 with command clangd fallback
[/Users/carson/Downloads]
/Library/Developer/CommandLineTools/usr/bin/clang -resource-dir=/Users/carson/repos/llvm-project/build/lib/clang/21 -isysroot /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk -- /Users/carson/Downloads/blah.c
I[15:33:40.400] <-- textDocument/codeAction(2)
I[15:33:40.400] <-- textDocument/documentLink(3)
I[15:33:40.401] <-- textDocument/inlayHint(4)
I[15:33:40.424] --> textDocument/clangd.fileStatus
I[15:33:40.529] Built preamble of size 815132 for file /Users/carson/Downloads/blah.c version 68 in 0.10 seconds
I[15:33:40.529] --> workspace/semanticTokens/refresh(0)
I[15:33:40.529] <-- reply(0)
I[15:33:40.594] <-- textDocument/foldingRange(5)
I[15:33:40.595] --> reply:textDocument/foldingRange(5) 0 ms
I[15:33:40.616] Indexing c17 standard library in the context of /Users/carson/Downloads/blah.c
I[15:33:40.626] --> textDocument/publishDiagnostics
I[15:33:40.627] --> textDocument/inactiveRegions
I[15:33:40.629] --> reply:textDocument/documentSymbol(1) 230 ms
I[15:33:40.631] --> reply:textDocument/codeAction(2) 230 ms
I[15:33:40.631] --> reply:textDocument/documentLink(3) 230 ms
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
I[15:33:40.694] <-- textDocument/documentSymbol(6)
I[15:33:40.879] <-- textDocument/codeAction(7)
I[15:33:41.145] Indexed c17 standard library: 3968 symbols, 13 filtered
 #0 0x0000000100f2a000 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/Users/carson/repos/llvm-project/build/bin/clangd+0x100556000)
 #1 0x0000000100f2a638 PrintStackTraceSignalHandler(void*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x100556638)
 #2 0x0000000100f2826c llvm::sys::RunSignalHandlers() (/Users/carson/repos/llvm-project/build/bin/clangd+0x10055426c)
 #3 0x0000000100f2bab8 SignalHandler(int, __siginfo*, void*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x100557ab8)
 #4 0x000000019cf38624 (/usr/lib/system/libsystem_platform.dylib+0x1804ac624)
 #5 0x0000000101390404 clang::ParmVarDecl::isExplicitObjectParameter() const (/Users/carson/repos/llvm-project/build/bin/clangd+0x1009bc404)
 #6 0x00000001039a7aa4 clang::clangd::(anonymous namespace)::maybeDropCxxExplicitObjectParameters(llvm::ArrayRef<clang::ParmVarDecl const*>) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102fd3aa4)
 #7 0x00000001039a7170 clang::clangd::(anonymous namespace)::InlayHintVisitor::processCall(clang::clangd::(anonymous namespace)::Callee, clang::SourceLocation, llvm::ArrayRef<clang::Expr const*>) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102fd3170)
 #8 0x00000001039a6bc4 clang::clangd::(anonymous namespace)::InlayHintVisitor::VisitCallExpr(clang::CallExpr*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102fd2bc4)
 #9 0x000000010397f884 clang::RecursiveASTVisitor<clang::clangd::(anonymous namespace)::InlayHintVisitor>::WalkUpFromCallExpr(clang::CallExpr*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102fab884)
#10 0x000000010397f694 clang::RecursiveASTVisitor<clang::clangd::(anonymous namespace)::InlayHintVisitor>::TraverseCallExpr(clang::CallExpr*, llvm::SmallVectorImpl<llvm::PointerIntPair<clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits<clang::Stmt*>, llvm::PointerIntPairInfo<clang::Stmt*, 1u, llvm::PointerLikeTypeTraits<clang::Stmt*>>>>*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102fab694)
#11 0x000000010396e458 clang::RecursiveASTVisitor<clang::clangd::(anonymous namespace)::InlayHintVisitor>::dataTraverseNode(clang::Stmt*, llvm::SmallVectorImpl<llvm::PointerIntPair<clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits<clang::Stmt*>, llvm::PointerIntPairInfo<clang::Stmt*, 1u, llvm::PointerLikeTypeTraits<clang::Stmt*>>>>*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102f9a458)
#12 0x0000000103943fd4 clang::RecursiveASTVisitor<clang::clangd::(anonymous namespace)::InlayHintVisitor>::TraverseStmt(clang::Stmt*, llvm::SmallVectorImpl<llvm::PointerIntPair<clang::Stmt*, 1u, bool, llvm::PointerLikeTypeTraits<clang::Stmt*>, llvm::PointerIntPairInfo<clang::Stmt*, 1u, llvm::PointerLikeTypeTraits<clang::Stmt*>>>>*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102f6ffd4)
#13 0x00000001039d0e18 clang::RecursiveASTVisitor<clang::clangd::(anonymous namespace)::InlayHintVisitor>::TraverseFunctionHelper(clang::FunctionDecl*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102ffce18)
#14 0x000000010393b0d0 clang::RecursiveASTVisitor<clang::clangd::(anonymous namespace)::InlayHintVisitor>::TraverseFunctionDecl(clang::FunctionDecl*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102f670d0)
#15 0x0000000103935100 clang::RecursiveASTVisitor<clang::clangd::(anonymous namespace)::InlayHintVisitor>::TraverseDecl(clang::Decl*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102f61100)
#16 0x0000000103935ef4 clang::RecursiveASTVisitor<clang::clangd::(anonymous namespace)::InlayHintVisitor>::TraverseTranslationUnitDecl(clang::TranslationUnitDecl*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102f61ef4)
#17 0x0000000103934aa0 clang::RecursiveASTVisitor<clang::clangd::(anonymous namespace)::InlayHintVisitor>::TraverseDecl(clang::Decl*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102f60aa0)
#18 0x00000001039334d8 clang::RecursiveASTVisitor<clang::clangd::(anonymous namespace)::InlayHintVisitor>::TraverseAST(clang::ASTContext&) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102f5f4d8)
#19 0x0000000103933384 clang::clangd::inlayHints(clang::clangd::ParsedAST&, std::__1::optional<clang::clangd::Range>, clang::clangd::InlayHintOptions) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102f5f384)
#20 0x0000000103621f48 clang::clangd::ClangdServer::inlayHints(llvm::StringRef, std::__1::optional<clang::clangd::Range>, llvm::unique_function<void (llvm::Expected<std::__1::vector<clang::clangd::InlayHint, std::__1::allocator<clang::clangd::InlayHint>>>)>)::$_0::operator()(llvm::Expected<clang::clangd::InputsAndAST>) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102c4df48)
#21 0x0000000103621e10 void llvm::detail::UniqueFunctionBase<void, llvm::Expected<clang::clangd::InputsAndAST>>::CallImpl<clang::clangd::ClangdServer::inlayHints(llvm::StringRef, std::__1::optional<clang::clangd::Range>, llvm::unique_function<void (llvm::Expected<std::__1::vector<clang::clangd::InlayHint, std::__1::allocator<clang::clangd::InlayHint>>>)>)::$_0>(void*, llvm::Expected<clang::clangd::InputsAndAST>&) (/Users/carson/repos/llvm-project/build/bin/clangd+0x102c4de10)
#22 0x0000000103c948fc llvm::unique_function<void (llvm::Expected<clang::clangd::InputsAndAST>)>::operator()(llvm::Expected<clang::clangd::InputsAndAST>) (/Users/carson/repos/llvm-project/build/bin/clangd+0x1032c08fc)
#23 0x0000000103cb1650 clang::clangd::(anonymous namespace)::ASTWorker::runWithAST(llvm::StringRef, llvm::unique_function<void (llvm::Expected<clang::clangd::InputsAndAST>)>, clang::clangd::TUScheduler::ASTActionInvalidation)::$_0::operator()() (/Users/carson/repos/llvm-project/build/bin/clangd+0x1032dd650)
#24 0x0000000103cb12b4 void llvm::detail::UniqueFunctionBase<void>::CallImpl<clang::clangd::(anonymous namespace)::ASTWorker::runWithAST(llvm::StringRef, llvm::unique_function<void (llvm::Expected<clang::clangd::InputsAndAST>)>, clang::clangd::TUScheduler::ASTActionInvalidation)::$_0>(void*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x1032dd2b4)
#25 0x00000001036694d8 llvm::unique_function<void ()>::operator()() (/Users/carson/repos/llvm-project/build/bin/clangd+0x102c954d8)
#26 0x0000000103ca2850 void llvm::function_ref<void ()>::callback_fn<llvm::unique_function<void ()>>(long) (/Users/carson/repos/llvm-project/build/bin/clangd+0x1032ce850)
#27 0x0000000100dfd708 llvm::function_ref<void ()>::operator()() const (/Users/carson/repos/llvm-project/build/bin/clangd+0x100429708)
#28 0x0000000103c9c240 clang::clangd::(anonymous namespace)::ASTWorker::runTask(llvm::StringRef, llvm::function_ref<void ()>) (/Users/carson/repos/llvm-project/build/bin/clangd+0x1032c8240)
#29 0x0000000103c9b65c clang::clangd::(anonymous namespace)::ASTWorker::run() (/Users/carson/repos/llvm-project/build/bin/clangd+0x1032c765c)
#30 0x0000000103c9b048 clang::clangd::(anonymous namespace)::ASTWorker::create(llvm::StringRef, clang::clangd::GlobalCompilationDatabase const&, clang::clangd::TUScheduler::ASTCache&, clang::clangd::TUScheduler::HeaderIncluderCache&, clang::clangd::AsyncTaskRunner*, clang::clangd::Semaphore&, clang::clangd::TUScheduler::Options const&, clang::clangd::ParsingCallbacks&)::$_0::operator()() const (/Users/carson/repos/llvm-project/build/bin/clangd+0x1032c7048)
#31 0x0000000103c9afd0 void llvm::detail::UniqueFunctionBase<void>::CallImpl<clang::clangd::(anonymous namespace)::ASTWorker::create(llvm::StringRef, clang::clangd::GlobalCompilationDatabase const&, clang::clangd::TUScheduler::ASTCache&, clang::clangd::TUScheduler::HeaderIncluderCache&, clang::clangd::AsyncTaskRunner*, clang::clangd::Semaphore&, clang::clangd::TUScheduler::Options const&, clang::clangd::ParsingCallbacks&)::$_0>(void*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x1032c6fd0)
#32 0x00000001036694d8 llvm::unique_function<void ()>::operator()() (/Users/carson/repos/llvm-project/build/bin/clangd+0x102c954d8)
#33 0x0000000104115a90 clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1::operator()() (/Users/carson/repos/llvm-project/build/bin/clangd+0x103741a90)
#34 0x0000000104115a3c auto void llvm::thread::GenericThreadProxy<std::__1::tuple<clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1>>(void*)::'lambda'(auto&&, auto&&...)::operator()<clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1&>(auto&&, auto&&...) const (/Users/carson/repos/llvm-project/build/bin/clangd+0x103741a3c)
#35 0x00000001041159f0 decltype(std::declval<auto>()(std::declval<auto>()...)) std::__1::__invoke[abi:nn190102]<void llvm::thread::GenericThreadProxy<std::__1::tuple<clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1>>(void*)::'lambda'(auto&&, auto&&...), clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1&>(auto&&, auto&&...) (/Users/carson/repos/llvm-project/build/bin/clangd+0x1037419f0)
#36 0x00000001041159c4 decltype(auto) std::__1::__apply_tuple_impl[abi:nn190102]<void llvm::thread::GenericThreadProxy<std::__1::tuple<clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1>>(void*)::'lambda'(auto&&, auto&&...), std::__1::tuple<clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1>&, 0ul>(auto&&, std::__1::tuple<clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1>&, std::__1::__tuple_indices<0ul>) (/Users/carson/repos/llvm-project/build/bin/clangd+0x1037419c4)
#37 0x0000000104115960 decltype(auto) std::__1::apply[abi:nn190102]<void llvm::thread::GenericThreadProxy<std::__1::tuple<clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1>>(void*)::'lambda'(auto&&, auto&&...), std::__1::tuple<clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1>&>(auto&&, std::__1::tuple<clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1>&) (/Users/carson/repos/llvm-project/build/bin/clangd+0x103741960)
#38 0x000000010411592c void llvm::thread::GenericThreadProxy<std::__1::tuple<clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1>>(void*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x10374192c)
#39 0x0000000104115600 void* llvm::thread::ThreadProxy<std::__1::tuple<clang::clangd::AsyncTaskRunner::runAsync(llvm::Twine const&, llvm::unique_function<void ()>)::$_1>>(void*) (/Users/carson/repos/llvm-project/build/bin/clangd+0x103741600)
#40 0x000000019cefec0c (/usr/lib/system/libsystem_pthread.dylib+0x180472c0c)
#41 0x000000019cef9b80 (/usr/lib/system/libsystem_pthread.dylib+0x18046db80)
Signalled during AST worker action: InlayHints
  Filename: blah.c
  Directory: /Users/carson/Downloads
  Command Line: /Library/Developer/CommandLineTools/usr/bin/clang -resource-dir=/Users/carson/repos/llvm-project/build/lib/clang/21 -isysroot /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk -- /Users/carson/Downloads/blah.c
  Version: 68
[Error - 3:33:43 PM] The Clang Language Server server crashed 1 times in the last 3 minutes. The server will not be restarted. See the output for more information.
[Error - 3:33:43 PM] Request textDocument/inlayHint failed.
[object Object]
[Error - 3:33:43 PM] Request textDocument/documentSymbol failed.
[object Object]
[Error - 3:33:43 PM] Request textDocument/codeAction failed.
[object Object]

[HighCommander4]

cc @zyn0217

Params.front() is null here.

Params is coming from FunctionProtoTypeLoc::getParams() here.

It's not clear to me whether we just need a null check on Params.front(), or if the elements of FunctionProtoTypeLoc::getParams() should never be null indicating a deeper bug.

[HighCommander4]

(Adjusted issue title to more accurately reflect the issue as we understand it so far.)

[HighCommander4]

It's not clear to me whether we just need a null check on Params.front(), or if the elements of FunctionProtoTypeLoc::getParams() should never be null indicating a deeper bug.

I did some more investigation to understand why we get a FunctionProtoTypeLoc with null parameters. Repeating the testcase (slightly simplified) for reference:

typedef void (*report_fn)(const char *);
__attribute__((noreturn)) report_fn die_routine;
void foo(const char *err) {
    die_routine(err);
}

• The type created for the typedef report_fn is a TypedefType which wraps a PointerType which wraps a FunctionProtoType.
  • The corresponding TypeLoc built at this location is fine, i.e. its contained FunctionProtoTypeLoc contains non-null parameters.
  • If the code example is modified to remove the __attribute__((noreturn)), it's this "good" FunctionProtoTypeLoc that's found by getPrototypeLoc, via this branch.
• When creating the type of die_routine, however (with the __attribute__((noreturn)) present), something interesting happens. We start with the type of report_fn, which is the mentioned TypedefType, but then we need to apply the __attribute__((noreturn)), which affects the type, to it.
  • But __attribute__((noreturn)) is modelled as a modifier on FunctionProtoType. So we need to unwrap the TypedefType to get at the contained FunctionProtoType, apply the modifier, and then re-wrap it.
  • This is handled by FunctionTypeUnwrapper. It handles the unwrapping and re-wrapping of the PointerType fine, but when it comes to the TypedefType, that's "sugar" and it's not re-wrapped. A code comment acknowledges that this operation loses source information.
  • As a result, the type of the variable die_routine is just a PointerType; the TypedefType is gone.
  • When building a TypeLoc for the variable's type, we now need to synthesize a FunctionProtoTypeLoc for the PointerType's contained FunctionProtoType. But a function type was not actually written at this location. The function type is written at the typedef's definition, and we've lost the information that would allow us to find that. So we synthesize a "trivial" FunctionProtoTypeLoc will null parameters and such. (This happens in TypeSpecLocFiller::VisitTypeLoc. Note that, while that function contains a "FIXME", I don't think addressing it would fix this, as I don't think a FunctionProtoType is a "typespec type" and the information we would need to populate a proper FunctionProtoTypeLoc is already lost by this point.)
  • In the inlay hints code, getPrototypeLoc now takes the second branch (we can't take the first branch because the variable doesn't have a TypedefType), and we find the "bad" (trivial) FunctionProtoTypeLoc with the null parameters.

I think the fundamental issue here is clang's modeling of function type attributes like noreturn. There's no representation for "noreturn applied to a typedef wrapping a function type" that would be distinct from "a typedef wrapping a noreturn function type", and representing the first thing as if it were the second loses some information.

I don't think we can avoid sometimes having a "trivial" FunctionProtoTypeLoc in the AST without addressing this type modeling issue. (FunctionTypeUnwrapper can't just re-wrap a modified function type into a TypedefType, since a TypedefType is associated with a typedef declaration, which is not something we can just invent, and a typedef declaration has a single type, e.g. either with noreturn or without noreturn.)

So, for the purposes of fixing this crash, we should just get the inlay hints code to guard against a trivial FunctionProtoTypeLoc. This means we won't get a parameter name hint for the affected call until the type modeling issue is addressed, but we won't crash.