[clang] Bail out if the result of function template instantiation is not a function type. (#69459)

Author: VitaNuo

clang/lib/Sema/SemaTemplateInstantiate.cpp

@@ -2662,7 +2662,9 @@ TypeSourceInfo *Sema::SubstFunctionDeclType(TypeSourceInfo *T,
   } else {
     Result = Instantiator.TransformType(TLB, TL);
   }
-  if (Result.isNull())
+  // When there are errors resolving types, clang may use IntTy as a fallback,
+  // breaking our assumption that function declarations have function types.
+  if (Result.isNull() || !Result->isFunctionType())
     return nullptr;
 
   return TLB.getTypeSourceInfo(Context, Result);

clang/test/SemaTemplate/function-decl-nested-type-alias.cpp

@@ -0,0 +1,16 @@
+// RUN: %clang_cc1 -x c++ -std=c++14 -fsyntax-only -verify %s
+
+template <class A>
+using Type = typename A::NestedType; // expected-error {{type 'float' cannot be used prior to '::' because it has no members}}
+
+template <typename T>
+void Func() {
+  using MyType = Type<T>(); // expected-note {{in instantiation of template type alias 'Type' requested here}}
+  // This is a function declaration, not a variable declaration!
+  // After substitution, we do not have a valid function type, and used to crash.
+  MyType var;
+}
+
+void Test() {
+  Func<float>(); // expected-note {{in instantiation of function template specialization 'Func<float>' requested here}}
+}