[Clang] fix crash due to incorrect argument position in merging deduced template arguments

clang/docs/ReleaseNotes.rst

@@ -760,6 +760,7 @@ Bug Fixes to C++ Support
   missing placeholder return type. (#GH78694)
 - Fixed a bug where bounds of partially expanded pack indexing expressions were checked too early. (#GH116105)
 - Fixed an assertion failure caused by using ``consteval`` in condition in consumed analyses. (#GH117385)
+- Fix a crash caused by incorrect argument position in merging deduced template arguments. (#GH113659)
 
 Bug Fixes to AST Handling
 ^^^^^^^^^^^^^^^^^^^^^^^^^

clang/lib/Sema/SemaTemplateDeduction.cpp

@@ -376,14 +376,15 @@ checkDeducedTemplateArguments(ASTContext &Context,
     for (TemplateArgument::pack_iterator
              XA = X.pack_begin(),
              XAEnd = X.pack_end(), YA = Y.pack_begin(), YAEnd = Y.pack_end();
-         XA != XAEnd; ++XA, ++YA) {
+         XA != XAEnd; ++XA) {
       if (YA != YAEnd) {
         TemplateArgument Merged = checkDeducedTemplateArguments(
             Context, DeducedTemplateArgument(*XA, X.wasDeducedFromArrayBound()),
             DeducedTemplateArgument(*YA, Y.wasDeducedFromArrayBound()));
         if (Merged.isNull() && !(XA->isNull() && YA->isNull()))
           return DeducedTemplateArgument();
         NewPack.push_back(Merged);
+        ++YA;
       } else {
         NewPack.push_back(*XA);
       }

clang/test/SemaTemplate/template-args-deduction-aggregates.cpp

@@ -0,0 +1,12 @@
+// RUN: %clang_cc1 -fsyntax-only -verify %s -std=c++20
+
+// expected-no-diagnostics
+
+namespace GH113659 {
+template <class... Args> struct S {};
+struct T {};
+struct U {};
+
+template <class... Args> struct B : S<Args...>, Args... {};
+B b{S<T, U>{}};
+}