[BUG] ICE in (anonymous namespace)::X86_64ABIInfo::classifyArgumentType(clang::QualType, unsigned int, unsigned int&, unsigned int&, bool, bool) const

## Bug Report: ICE in (anonymous namespace)::X86_64ABIInfo::classifyArgumentType(clang::QualType, unsigned int, unsigned int&, unsigned int&, bool, bool) const

Clang crashes when compiling the following C code.

**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend

This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).

## Reduced Test Case

> Minimized from the original fuzzer-generated input using `creduce`.

```sh
clang -O0 test.c -o /dev/null
```

```c
struct {
int a[]
} a;
b() { c(a); }

```

## Crash Output

```
clang-22: /root/compilers/llvm-project-release/llvm/lib/IR/Type.cpp:319: static llvm::IntegerType* llvm::IntegerType::get(llvm::LLVMContext&, unsigned int): Assertion \`NumBits >= MIN_INT_BITS && "bitwidth too small"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name giEijNpuJmSi_surfuzz_19.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/giEijNpuJmSi_surfuzz_19-9b9fb5.o -x c /root/outputs/experiments-on-metamut/surfuzz,clang,2/giEijNpuJmSi_surfuzz_19.c
1\. /root/outputs/experiments-on-metamut/surfuzz,clang,2/giEijNpuJmSi_surfuzz_19.c:40:1: current parser token 'int'
2\. /root/outputs/experiments-on-metamut/surfuzz,clang,2/giEijNpuJmSi_surfuzz_19.c:10:1: LLVM IR generation of declaration 'foo'
3\. /root/outputs/experiments-on-metamut/surfuzz,clang,2/giEijNpuJmSi_surfuzz_19.c:10:1: Generating code for declaration 'foo'
4\. /root/outputs/experiments-on-metamut/surfuzz,clang,2/giEijNpuJmSi_surfuzz_19.c:18:5: LLVM IR generation of compound statement ('{}')
5\. /root/outputs/experiments-on-metamut/surfuzz,clang,2/giEijNpuJmSi_surfuzz_19.c:23:2: LLVM IR generation of compound statement ('{}')
#0 0x000055c09ca6c2d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x000055c09ca68caf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x000055c09ca68dfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007fd0a3c26520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007fd0a3c7aa7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007fd0a3c7aa7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007fd0a3c7aa7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007fd0a3c26476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007fd0a3c0c7f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007fd0a3c0c71b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007fd0a3c1de96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x000055c09c397bbd llvm::IntegerType::get(llvm::LLVMContext&, unsigned int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x3e21bbd)
#12 0x000055c09d237c91 (anonymous namespace)::X86_64ABIInfo::getIndirectResult(clang::QualType, unsigned int) const X86.cpp:0:0
#13 0x000055c09d23fdd0 (anonymous namespace)::X86_64ABIInfo::classifyArgumentType(clang::QualType, unsigned int, unsigned int&, unsigned int&, bool, bool) const X86.cpp:0:0
#14 0x000055c09d240316 (anonymous namespace)::X86_64ABIInfo::EmitVAArg(clang::CodeGen::CodeGenFunction&, clang::CodeGen::Address, clang::QualType, clang::CodeGen::AggValueSlot) const X86.cpp:0:0
#15 0x000055c09d2cf799 clang::CodeGen::CodeGenFunction::EmitVAArg(clang::VAArgExpr*, clang::CodeGen::Address&, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4d59799)
#16 0x000055c09cde8030 clang::StmtVisitorBase::Visit(clang::Stmt*) CGExprAgg.cpp:0:0
#17 0x000055c09cde8d2a (anonymous namespace)::AggExprEmitter::Visit(clang::Expr*) CGExprAgg.cpp:0:0
#18 0x000055c09cde912c clang::CodeGen::CodeGenFunction::EmitAggExpr(clang::Expr const*, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x487312c)
#19 0x000055c09cde998c (anonymous namespace)::AggExprEmitter::VisitBinAssign(clang::BinaryOperator const*) CGExprAgg.cpp:0:0
#20 0x000055c09cde8d2a (anonymous namespace)::AggExprEmitter::Visit(clang::Expr*) CGExprAgg.cpp:0:0
#21 0x000055c09cde912c clang::CodeGen::CodeGenFunction::EmitAggExpr(clang::Expr const*, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x487312c)
#22 0x000055c09cda0ff7 clang::CodeGen::CodeGenFunction::EmitAnyExpr(clang::Expr const*, clang::CodeGen::AggValueSlot, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x482aff7)
#23 0x000055c09cda10e8 clang::CodeGen::CodeGenFunction::EmitIgnoredExpr(clang::Expr const*) (.part.0) CGExpr.cpp:0:0
#24 0x000055c09cf7438b clang::CodeGen::CodeGenFunction::EmitStmt(clang::Stmt const*, llvm::ArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x49fe38b)
#25 0x000055c09cf7d78b clang::CodeGen::CodeGenFunction::EmitCompoundStmtWithoutScope(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a0778b)
#26 0x000055c09cf7db44 clang::CodeGen::CodeGenFunction::EmitCompoundStmt(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a07b44)
#27 0x000055c09cf7dd6a clang::CodeGen::CodeGenFunction::EmitSimpleStmt(clang::Stmt const*, llvm::ArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a07d6a)
#28 0x000055c09cf74211 clang::CodeGen::CodeGenFunction::EmitStmt(clang::Stmt const*, llvm::ArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x49fe211)
#29 0x000055c09cf75f14 clang::CodeGen::CodeGenFunction::EmitSwitchStmt(clang::SwitchStmt const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x49fff14)
#30 0x000055c09cf7d78b clang::CodeGen::CodeGenFunction::EmitCompoundStmtWithoutScope(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a0778b)
#31 0x000055c09cf7db44 clang::CodeGen::CodeGenFunction::EmitCompoundStmt(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a07b44)
#32 0x000055c09cf7dd6a clang::CodeGen::CodeGenFunction::EmitSimpleStmt(clang::Stmt const*, llvm::ArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a07d6a)
#33 0x000055c09cf74211 clang::CodeGen::CodeGenFunction::EmitStmt(clang::Stmt const*, llvm::ArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x49fe211)
#34 0x000055c09cf79ad2 clang::CodeGen::CodeGenFunction::EmitForStmt(clang::ForStmt const&, llvm::ArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a03ad2)
#35 0x000055c09cf7d78b clang::CodeGen::CodeGenFunction::EmitCompoundStmtWithoutScope(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a0778b)
#36 0x000055c09cfe59e3 clang::CodeGen::CodeGenFunction::EmitFunctionBody(clang::Stmt const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a6f9e3)
#37 0x000055c09cffae84 clang::CodeGen::CodeGenFunction::GenerateCode(clang::GlobalDecl, llvm::Function*, clang::CodeGen::CGFunctionInfo const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a84e84)
#38 0x000055c09d05ef0d clang::CodeGen::CodeGenModule::EmitGlobalFunctionDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae8f0d)
#39 0x000055c09d059ef5 clang::CodeGen::CodeGenModule::EmitGlobalDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae3ef5)
#40 0x000055c09d05ab83 clang::CodeGen::CodeGenModule::EmitGlobal(clang::GlobalDecl) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae4b83)
#41 0x000055c09d064807 clang::CodeGen::CodeGenModule::EmitTopLevelDecl(clang::Decl*) (.part.0) CodeGenModule.cpp:0:0
#42 0x000055c09d3e0d71 (anonymous namespace)::CodeGeneratorImpl::HandleTopLevelDecl(clang::DeclGroupRef) ModuleBuilder.cpp:0:0
#43 0x000055c09d3d1cc1 clang::BackendConsumer::HandleTopLevelDecl(clang::DeclGroupRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4e5bcc1)
#44 0x000055c09f27d874 clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d07874)
#45 0x000055c09d6f5987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#46 0x000055c09d67d0e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#47 0x000055c09d7f295e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#48 0x000055c0994fd657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#49 0x000055c0994f2694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#50 0x000055c0994f7907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#51 0x000055c0993b50ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#52 0x00007fd0a3c0dd90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#53 0x00007fd0a3c0de40 call_init ./csu/../csu/libc-start.c:128:20
#54 0x00007fd0a3c0de40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#55 0x000055c0994f1cb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/giEijNpuJmSi_surfuzz_19-65fc13.c
clang: note: diagnostic msg: /tmp/giEijNpuJmSi_surfuzz_19-65fc13.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```

## Preprocessed Source & Run Script

**Preprocessed source** (`/tmp/giEijNpuJmSi_surfuzz_19-65fc13.c`):

```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/giEijNpuJmSi_surfuzz_19.c"
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* stdarg.h expanded by -frewrite-includes */
#include
#else /* stdarg.h expanded by -frewrite-includes */
# 1 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/giEijNpuJmSi_surfuzz_19.c"
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 1 3
/*===---- stdarg.h - Variable argument handling ----------------------------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

/*
* This header is designed to be included multiple times. If any of the __need_
* macros are defined, then only that subset of interfaces are provided. This
* can be useful for POSIX headers that need to not expose all of stdarg.h, but
* need to use some of its interfaces. Otherwise this header provides all of
* the expected interfaces.
*
* When clang modules are enabled, this header is a textual header to support
* the multiple include behavior. As such, it doesn't directly declare anything
* so that it doesn't add duplicate declarations to all of its includers'
* modules.
*/
#if 0 /* disabled by -frewrite-includes */
#if defined(__MVS__) && __has_include_next()
#endif
#endif /* disabled by -frewrite-includes */
#if 0 /* evaluated by -frewrite-includes */
# 23 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#undef __need___va_list
#undef __need_va_list
#undef __need_va_arg
#undef __need___va_copy
#undef __need_va_copy
#if 0 /* expanded by -frewrite-includes */
#include <__stdarg_header_macro.h>
#endif /* expanded by -frewrite-includes */
# 28 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 29 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#if 0 /* expanded by -frewrite-includes */
#include_next
#endif /* expanded by -frewrite-includes */
# 29 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 30 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#else
# 32 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#if 0 /* disabled by -frewrite-includes */
#if !defined(__need___va_list) && !defined(__need_va_list) && \
!defined(__need_va_arg) && !defined(__need___va_copy) && \
!defined(__need_va_copy)
#endif
#endif /* disabled by -frewrite-includes */
#if 1 /* evaluated by -frewrite-includes */
# 35 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#define __need___va_list
#define __need_va_list
#define __need_va_arg
#define __need___va_copy
/* GCC always defines __va_copy, but does not define va_copy unless in c99 mode
* or -ansi is not specified, since it was not part of C90.
*/
#if 0 /* disabled by -frewrite-includes */
#if (defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L) || \
(defined(__cplusplus) && __cplusplus >= 201103L) || \
!defined(__STRICT_ANSI__)
#endif
#endif /* disabled by -frewrite-includes */
#if 1 /* evaluated by -frewrite-includes */
# 45 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#define __need_va_copy
#endif
# 47 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* __stdarg_header_macro.h expanded by -frewrite-includes */
#include <__stdarg_header_macro.h>
#else /* __stdarg_header_macro.h expanded by -frewrite-includes */
# 47 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_header_macro.h" 1 3
/*===---- __stdarg_header_macro.h ------------------------------------------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

#ifndef __STDARG_H
#define __STDARG_H
#endif
# 13 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_header_macro.h" 3
#endif /* __stdarg_header_macro.h expanded by -frewrite-includes */
# 48 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 2 3
#endif
# 49 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#ifdef __need___va_list
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* __stdarg___gnuc_va_list.h expanded by -frewrite-includes */
#include <__stdarg___gnuc_va_list.h>
#else /* __stdarg___gnuc_va_list.h expanded by -frewrite-includes */
# 51 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg___gnuc_va_list.h" 1 3
/*===---- __stdarg___gnuc_va_list.h - Definition of __gnuc_va_list ---------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

#ifndef __GNUC_VA_LIST
#define __GNUC_VA_LIST
typedef __builtin_va_list __gnuc_va_list;
#endif
# 14 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg___gnuc_va_list.h" 3
#endif /* __stdarg___gnuc_va_list.h expanded by -frewrite-includes */
# 52 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 2 3
#undef __need___va_list
#endif /* defined(__need___va_list) */
# 54 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#ifdef __need_va_list
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* __stdarg_va_list.h expanded by -frewrite-includes */
#include <__stdarg_va_list.h>
#else /* __stdarg_va_list.h expanded by -frewrite-includes */
# 56 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_list.h" 1 3
/*===---- __stdarg_va_list.h - Definition of va_list -----------------------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

#ifndef _VA_LIST
#define _VA_LIST
typedef __builtin_va_list va_list;
#endif
# 14 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_list.h" 3
#endif /* __stdarg_va_list.h expanded by -frewrite-includes */
# 57 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 2 3
#undef __need_va_list
#endif /* defined(__need_va_list) */
# 59 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#ifdef __need_va_arg
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* __stdarg_va_arg.h expanded by -frewrite-includes */
#include <__stdarg_va_arg.h>
#else /* __stdarg_va_arg.h expanded by -frewrite-includes */
# 61 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h" 1 3
/*===---- __stdarg_va_arg.h - Definitions of va_start, va_arg, va_end-------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

#ifndef va_arg

#if 0 /* disabled by -frewrite-includes */
#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 202311L
#endif
#endif /* disabled by -frewrite-includes */
#if 0 /* evaluated by -frewrite-includes */
# 13 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h" 3
/* C23 uses a special builtin. */
#define va_start(...) __builtin_c23_va_start(__VA_ARGS__)
#else
# 16 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h" 3
/* Versions before C23 do require the second parameter. */
#define va_start(ap, param) __builtin_va_start(ap, param)
#endif
# 19 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h" 3
#define va_end(ap) __builtin_va_end(ap)
#define va_arg(ap, type) __builtin_va_arg(ap, type)

#endif
# 23 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_arg.h" 3
#endif /* __stdarg_va_arg.h expanded by -frewrite-includes */
# 62 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 2 3
#undef __need_va_arg
#endif /* defined(__need_va_arg) */
# 64 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#ifdef __need___va_copy
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* __stdarg___va_copy.h expanded by -frewrite-includes */
#include <__stdarg___va_copy.h>
#else /* __stdarg___va_copy.h expanded by -frewrite-includes */
# 66 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg___va_copy.h" 1 3
/*===---- __stdarg___va_copy.h - Definition of __va_copy -------------------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

#ifndef __va_copy
#define __va_copy(d, s) __builtin_va_copy(d, s)
#endif
# 13 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg___va_copy.h" 3
#endif /* __stdarg___va_copy.h expanded by -frewrite-includes */
# 67 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 2 3
#undef __need___va_copy
#endif /* defined(__need___va_copy) */
# 69 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#ifdef __need_va_copy
#if defined(__CLANG_REWRITTEN_INCLUDES) || defined(__CLANG_REWRITTEN_SYSTEM_INCLUDES) /* __stdarg_va_copy.h expanded by -frewrite-includes */
#include <__stdarg_va_copy.h>
#else /* __stdarg_va_copy.h expanded by -frewrite-includes */
# 71 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
# 1 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_copy.h" 1 3
/*===---- __stdarg_va_copy.h - Definition of va_copy------------------------===
*
* Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
* See https://llvm.org/LICENSE.txt for license information.
* SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
*
*===-----------------------------------------------------------------------===
*/

#ifndef va_copy
#define va_copy(dest, src) __builtin_va_copy(dest, src)
#endif
# 13 "/root/objects/llvm-project-release.obj/lib/clang/22/include/__stdarg_va_copy.h" 3
#endif /* __stdarg_va_copy.h expanded by -frewrite-includes */
# 72 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 2 3
#undef __need_va_copy
#endif /* defined(__need_va_copy) */
# 74 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3

#endif /* __MVS__ */
# 76 "/root/objects/llvm-project-release.obj/lib/clang/22/include/stdarg.h" 3
#endif /* stdarg.h expanded by -frewrite-includes */
# 2 "/root/outputs/experiments-on-metamut/surfuzz,clang,2/giEijNpuJmSi_surfuzz_19.c" 2

static int fails = 0;
struct S
{
int a[];
};
struct S a[3];
void
foo (int z,...)
{
struct S arg, *p;
va_list ap;
int j = 0, k = 0;
int i;
va_start (ap, z);
for (i = 2; i < 4; ++i)
{
p = 0;
j++;
k += 2;
switch ((z << 4) | i)
{
case 0x12:
case 0x13:
p = &a[2];
arg = va_arg (ap, struct S);
break;
default:
++fails;
break;
}
if (p && p->a[2] != arg.a[2])
++fails;
if (fails)
break;
}
va_end (ap);
}
int
main ()
{
a[2].a[2] = -49026;
check (1, a[2], a[2]);
if (fails)
abort ();
return 0;
}

```

**Run script** (`/tmp/giEijNpuJmSi_surfuzz_19-65fc13.sh`):

```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,clang,2/giEijNpuJmSi_surfuzz_19.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "giEijNpuJmSi_surfuzz_19.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/giEijNpuJmSi_surfuzz_19-9b9fb5.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,clang,2/giEijNpuJmSi_surfuzz_19.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "giEijNpuJmSi_surfuzz_19.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "giEijNpuJmSi_surfuzz_19-65fc13.c"

```

* found via a fuzzer

[giEijNpuJmSi_surfuzz_19-65fc13.c](https://github.com/user-attachments/files/29127911/giEijNpuJmSi_surfuzz_19-65fc13.c)
[giEijNpuJmSi_surfuzz_19-65fc13.sh](https://github.com/user-attachments/files/29127912/giEijNpuJmSi_surfuzz_19-65fc13.sh)

Reproduce the crash with the reduced test.c command and begin at X86.cpp, especially X86_64ABIInfo::getIndirectResult and classifyArgumentType in the stack trace. Use the failing path through EmitVAArg and llvm/lib/IR/Type.cpp to determine why an invalid integer width is requested. Done means the reduced input no longer aborts and the regression is covered by an appropriate compiler test.

Written by the indexing model from the issue text.