[BUG] ICE in clang::Sema::ProcessDeclAttributes(clang::Scope*, clang::Decl*, clang::Declarator const&)

## Bug Report: ICE in clang::Sema::ProcessDeclAttributes(clang::Scope*, clang::Decl*, clang::Declarator const&)

Clang crashes when compiling the following C code.

**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend

This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).

## Reduced Test Case

> Minimized from the original fuzzer-generated input using `creduce`.

```sh
clang -O0 test.c -o /dev/null
```

```c
__attribute__((callback(1))) a(;

```

## Crash Output

```
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:2:16: error: redefinition of 'cb0' as different kind of symbol
2 | typedef void (*cb0)(void);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:1:6: note: previous definition is here
1 | void cb0(void);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:4:16: error: redefinition of 'cb1' as different kind of symbol
4 | typedef void (*cb1)(void);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:3:13: note: previous definition is here
3 | static void cb1(void);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:6:16: error: redefinition of 'cb2' as different kind of symbol
6 | typedef void (*cb2)(void);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:5:13: note: previous definition is here
5 | static void cb2(void);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:8:16: error: redefinition of 'cb3' as different kind of symbol
8 | typedef void (*cb3)(void);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:7:13: note: previous definition is here
7 | static void cb3(void);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:10:16: error: 'callback' attribute callee does not have function type
10 | __attribute__((callback(1))) void cb5(int);
| ^\~\~\~\~\~\~\~\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:11:16: error: redefinition of 'cb5' as different kind of symbol
11 | typedef void (*cb5)(int);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:10:35: note: previous definition is here
10 | __attribute__((callback(1))) void cb5(int);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:12:16: error: 'callback' attribute callee does not have function type
12 | __attribute__((callback(1))) void cb6(long);
| ^\~\~\~\~\~\~\~\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:13:16: error: redefinition of 'cb6' as different kind of symbol
13 | typedef void (*cb6)(long);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:12:35: note: previous definition is here
12 | __attribute__((callback(1))) void cb6(long);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:14:16: error: 'callback' attribute callee does not have function type
14 | __attribute__((callback(1))) void cb7(short);
| ^\~\~\~\~\~\~\~\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:15:16: error: redefinition of 'cb7' as different kind of symbol
15 | typedef void (*cb7)(short);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:14:35: note: previous definition is here
14 | __attribute__((callback(1))) void cb7(short);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:17:57: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int]
17 | __attribute__((callback(1, -1, -1))) void cb8(long int, cb1);
| ^
| int
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:17:16: error: 'callback' attribute callee does not have function type
17 | __attribute__((callback(1, -1, -1))) void cb8(long int, cb1);
| ^\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:18:31: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int]
18 | typedef void (*cb8)(long int, cb1);
| ^
| int
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:18:16: error: redefinition of 'cb8' as different kind of symbol
18 | typedef void (*cb8)(long int, cb1);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:17:43: note: previous definition is here
17 | __attribute__((callback(1, -1, -1))) void cb8(long int, cb1);
| ^
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:19:57: error: expected identifier
19 | __attribute__((callback(1, -1, -1))) void cb9(cb1, cb7, short, cb3);
| ^
clang-22: /root/compilers/llvm-project-release/llvm/include/llvm/Support/Casting.h:572: decltype(auto) llvm::cast(From*) [with To \= clang::FunctionProtoType; From \= const clang::FunctionType]: Assertion \`isa(Val) && "cast() argument of incompatible type!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name rIPpYmWfvDYp_surfuzz_29.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/rIPpYmWfvDYp_surfuzz_29-7656d4.o -x c /root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c
1\. /root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c:19:68: current parser token ';'
#0 0x000055fd159c52d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x000055fd159c1caf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x000055fd159c1dfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f72db490520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007f72db4e4a7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007f72db4e4a7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007f72db4e4a7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007f72db490476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007f72db4767f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007f72db47671b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007f72db487e96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x000055fd185da3a8 clang::getFunctionOrMethodNumParams(clang::Decl const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x710b3a8)
#12 0x000055fd185f96c5 handleCallbackAttr(clang::Sema&, clang::Decl*, clang::ParsedAttr const&) SemaDeclAttr.cpp:0:0
#13 0x000055fd1861add0 clang::Sema::ProcessDeclAttributes(clang::Scope*, clang::Decl*, clang::Declarator const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x714bdd0)
#14 0x000055fd185cbd60 clang::Sema::ActOnFunctionDeclarator(clang::Scope*, clang::Declarator&, clang::DeclContext*, clang::TypeSourceInfo*, clang::LookupResult&, llvm::MutableArrayRef, bool&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x70fcd60)
#15 0x000055fd185d093e clang::Sema::HandleDeclarator(clang::Scope*, clang::Declarator&, llvm::MutableArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x710193e)
#16 0x000055fd185d17cc clang::Sema::ActOnDeclarator(clang::Scope*, clang::Declarator&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x71027cc)
#17 0x000055fd1821bfaa clang::Parser::ParseDeclarationAfterDeclaratorAndAttributes(clang::Declarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::ForRangeInit*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d4cfaa)
#18 0x000055fd18233ce3 clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d64ce3)
#19 0x000055fd181ec7e1 clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1d7e1)
#20 0x000055fd181ed00f clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1e00f)
#21 0x000055fd181f5896 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d26896)
#22 0x000055fd181f6915 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d27915)
#23 0x000055fd181d688a clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d0788a)
#24 0x000055fd1664e987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#25 0x000055fd165d60e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#26 0x000055fd1674b95e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#27 0x000055fd12456657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#28 0x000055fd1244b694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#29 0x000055fd12450907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#30 0x000055fd1230e0ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#31 0x00007f72db477d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#32 0x00007f72db477e40 call_init ./csu/../csu/libc-start.c:128:20
#33 0x00007f72db477e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#34 0x000055fd1244acb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/rIPpYmWfvDYp_surfuzz_29-286b8b.c
clang: note: diagnostic msg: /tmp/rIPpYmWfvDYp_surfuzz_29-286b8b.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```

## Preprocessed Source & Run Script

**Preprocessed source** (`/tmp/rIPpYmWfvDYp_surfuzz_29-286b8b.c`):

```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c"
void cb0(void);
typedef void (*cb0)(void);
static void cb1(void);
typedef void (*cb1)(void);
static void cb2(void);
typedef void (*cb2)(void);
static void cb3(void);
typedef void (*cb3)(void);
static void cb4(void);
__attribute__((callback(1))) void cb5(int);
typedef void (*cb5)(int);
__attribute__((callback(1))) void cb6(long);
typedef void (*cb6)(long);
__attribute__((callback(1))) void cb7(short);
typedef void (*cb7)(short);

__attribute__((callback(1, -1, -1))) void cb8(long int, cb1);
typedef void (*cb8)(long int, cb1);
__attribute__((callback(1, -1, -1))) void cb9(cb1, cb7, short, cb3);
typedef void (*cb9)(cb1, cb7, short, cb3);
__attribute__((callback(1, 3))) void cb10(cb3, cb2, char);
typedef void (*cb10)(cb3,
__attribute__((callback(1, 2, 2), alias("a1"))) struct foo0 alias1(void (*callback)(void));
typedef void (*cb1)(struct foo1 *, int);
__attribute__((callback(1, 3, 3), alias("alias2"))) struct foo2 alias2(struct foo2*, int, void (*callback)(struct foo2 *, int));
__attribute__((callback(1, 2, 2), alias("a2"))) struct foo2 a2(void (*callback)(struct foo2* f, int i));
__attribute__((alias("a3"))) struct foo4 alias3(struct foo3* s, int, int, void (*callback)(struct foo4 *, int));
__attribute__((callback(1, 4, 4))) struct foo4 a3(struct foo3* s, int, int, void (*callback)(struct foo4 *, int));
__attribute__((callback(1, 2, 2))) void a4(void (*callback)(void), 0);
__attribute__((callback(1, 2, 3))) void args_1(void (*callback)(int, double), int a, double b) { no_args(cb0); }
__attribute__((callback(2, 3, 3))) void args_2a(int a, void (*callback)(double, double), double b);
__attribute__((callback(callback, b, b))) void args_2b(int a, void (*callback)(double, double), double b);
__attribute__((callback(2, -1, -1))) void args_3a(int a, void (*callback)(double, double), double b) { args_2a(a, callback, b); }
__attribute__((callback(callback, __, __))) void args_3b(int a, void (*callback)(double, double), double b) { args_2b(a, callback, b); }

```

**Run script** (`/tmp/rIPpYmWfvDYp_surfuzz_29-286b8b.sh`):

```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "rIPpYmWfvDYp_surfuzz_29.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/rIPpYmWfvDYp_surfuzz_29-7656d4.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/rIPpYmWfvDYp_surfuzz_29.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "rIPpYmWfvDYp_surfuzz_29.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "rIPpYmWfvDYp_surfuzz_29-286b8b.c"

```

* found via a fuzzer

[rIPpYmWfvDYp_surfuzz_29-286b8b.c](https://github.com/user-attachments/files/29127620/rIPpYmWfvDYp_surfuzz_29-286b8b.c)
[rIPpYmWfvDYp_surfuzz_29-286b8b.sh](https://github.com/user-attachments/files/29127621/rIPpYmWfvDYp_surfuzz_29-286b8b.sh)

Start by reproducing the crash with the reduced C case and the shown clang command. Trace clang::Sema::ProcessDeclAttributes through handleCallbackAttr in SemaDeclAttr.cpp, using the stack trace as the entry point. Add regression coverage and verify that this malformed declaration no longer triggers an assertion or crash.

Written by the indexing model from the issue text.