[BUG] ICE in EvaluatePointer(clang::Expr const*, (anonymous namespace)::LValue&, (anonymous namespace)::EvalInfo&, bool)

## Bug Report: ICE in EvaluatePointer(clang::Expr const*, (anonymous namespace)::LValue&, (anonymous namespace)::EvalInfo&, bool)

Clang crashes when compiling the following C code.

**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend

This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).

## Reduced Test Case

> Minimized from the original fuzzer-generated input using `creduce`.

```sh
clang -O0 test.c -o /dev/null
```

```c
void(a ;
b() {
extern a[] int c;
a[0] = c
```

## Crash Output

```
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:3:6: error: expected ')'
3 | (e \+ 3, a, e - 3, b, c, d, e \+ 3, e \+ 4, e \+ 5);
| ^
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:3:3: note: to match this '('
3 | (e \+ 3, a, e - 3, b, c, d, e \+ 3, e \+ 4, e \+ 5);
| ^
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:3:4: error: variable has incomplete type 'void'
3 | (e \+ 3, a, e - 3, b, c, d, e \+ 3, e \+ 4, e \+ 5);
| ^
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:4:1: error: extraneous closing brace ('}')
4 | }
| ^
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:9:17: warning: GCC does not allow 'format' attribute in this position on a function definition [-Wgcc-compat]
9 | __attribute__ ((format (printf, 1, 3)))
| ^
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:9:17: error: format argument not a string type
8 | foo (int a,...)
| \~\~\~\~\~
9 | __attribute__ ((format (printf, 1, 3)))
| ^ \~
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:12:3: error: use of undeclared identifier 'va_list'
12 | va_list ap;
| ^\~\~\~\~\~\~
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:13:3: error: call to undeclared library function 'va_start' with type 'void (struct __va_list_tag *, ...)'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
13 | va_start (ap, c);
| ^
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:13:3: note: include the header or explicitly provide a declaration for 'va_start'
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:13:13: error: use of undeclared identifier 'ap'
13 | va_start (ap, c);
| ^\~
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:13:17: error: use of undeclared identifier 'c'
13 | va_start (ap, c);
| ^
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:15:13: error: call to undeclared function 'va_arg'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
15 | int d \= va_arg (ap, int);
| ^
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:15:21: error: use of undeclared identifier 'ap'
15 | int d \= va_arg (ap, int);
| ^\~
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:15:25: error: expected expression
15 | int d \= va_arg (ap, int);
| ^
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:16:21: error: use of undeclared identifier 'ap'
16 | int f \= va_arg (ap, int);
| ^\~
/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:16:25: error: expected expression
16 | int f \= va_arg (ap, int);
| ^
clang-22: /root/compilers/llvm-project-release/clang/lib/AST/ExprConstant.cpp:1679: void {anonymous}::LValue::addUnsizedArray({anonymous}::EvalInfo&, const clang::Expr*, clang::QualType): Assertion \`getType(Base).getNonReferenceType()->isPointerType() || getType(Base).getNonReferenceType()->isArrayType()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name cwuQLdKeBeYT_surfuzz_14.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/cwuQLdKeBeYT_surfuzz_14-a80bdb.o -x c /root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c
1\. /root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:18:5: current parser token 'e'
2\. /root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:10:1: parsing function body 'foo'
3\. /root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:10:1: in compound statement ('{}')
4\. /root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c:14:3: in compound statement ('{}')
#0 0x000055b188a432d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x000055b188a3fcaf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x000055b188a3fdfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f2bdce6f520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007f2bdcec3a7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007f2bdcec3a7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007f2bdcec3a7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007f2bdce6f476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007f2bdce557f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007f2bdce5571b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007f2bdce66e96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x000055b18c577d37 (anonymous namespace)::LValue::addUnsizedArray((anonymous namespace)::EvalInfo&, clang::Expr const*, clang::QualType) ExprConstant.cpp:0:0
#12 0x000055b18c62ae74 (anonymous namespace)::PointerExprEvaluator::VisitCastExpr(clang::CastExpr const*) ExprConstant.cpp:0:0
#13 0x000055b18c5a6a82 EvaluatePointer(clang::Expr const*, (anonymous namespace)::LValue&, (anonymous namespace)::EvalInfo&, bool) ExprConstant.cpp:0:0
#14 0x000055b18c5d5dc3 (anonymous namespace)::LValueExprEvaluator::VisitArraySubscriptExpr(clang::ArraySubscriptExpr const*) ExprConstant.cpp:0:0
#15 0x000055b18c59da99 EvaluateLValue(clang::Expr const*, (anonymous namespace)::LValue&, (anonymous namespace)::EvalInfo&, bool) ExprConstant.cpp:0:0
#16 0x000055b18c5c26cf Evaluate(clang::APValue&, (anonymous namespace)::EvalInfo&, clang::Expr const*) ExprConstant.cpp:0:0
#17 0x000055b18c5fe492 (anonymous namespace)::IntExprEvaluator::VisitBinaryOperator(clang::BinaryOperator const*) ExprConstant.cpp:0:0
#18 0x000055b18c5c27e0 Evaluate(clang::APValue&, (anonymous namespace)::EvalInfo&, clang::Expr const*) ExprConstant.cpp:0:0
#19 0x000055b18c5c31b1 EvaluateAsRValue((anonymous namespace)::EvalInfo&, clang::Expr const*, clang::APValue&) ExprConstant.cpp:0:0
#20 0x000055b18c5c8d04 clang::Expr::EvaluateForOverflow(clang::ASTContext const&) const (/root/objects/llvm-project-release.obj/bin/clang-22+0x807bd04)
#21 0x000055b18b49ef66 clang::Sema::CheckForIntOverflow(clang::Expr const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6f51f66)
#22 0x000055b18b4e04a4 clang::Sema::CheckCompletedExpr(clang::Expr*, clang::SourceLocation, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6f934a4)
#23 0x000055b18b88920e clang::Sema::ActOnFinishFullExpr(clang::Expr*, clang::SourceLocation, bool, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x733c20e)
#24 0x000055b18bbbaf0f clang::Sema::ActOnExprStmt(clang::ActionResult, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x766df0f)
#25 0x000055b18b36ab84 clang::Parser::ParseExprStatement(clang::Parser::ParsedStmtContext) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e1db84)
#26 0x000055b18b363d80 clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&, clang::LabelDecl*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e16d80)
#27 0x000055b18b364703 clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::LabelDecl*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e17703)
#28 0x000055b18b36b361 clang::Parser::ParseCompoundStatementBody(bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e1e361)
#29 0x000055b18b36ba68 void llvm::function_ref::callback_fn(long) ParseStmt.cpp:0:0
#30 0x000055b18cdb6a73 clang::StackExhaustionHandler::runWithSufficientStackSpace(clang::SourceLocation, llvm::function_ref) (/root/objects/llvm-project-release.obj/bin/clang-22+0x8869a73)
#31 0x000055b18b35cb6a clang::Parser::ParseCompoundStatement(bool, unsigned int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e0fb6a)
#32 0x000055b18b362b01 clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&, clang::LabelDecl*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e15b01)
#33 0x000055b18b364703 clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::LabelDecl*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e17703)
#34 0x000055b18b36b361 clang::Parser::ParseCompoundStatementBody(bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e1e361)
#35 0x000055b18b36bb3f clang::Parser::ParseFunctionStatementBody(clang::Decl*, clang::Parser::ParseScope&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6e1eb3f)
#36 0x000055b18b26fcab clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::LateParsedAttrList*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d22cab)
#37 0x000055b18b2b242d clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d6542d)
#38 0x000055b18b26a7e1 clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1d7e1)
#39 0x000055b18b26b00f clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1e00f)
#40 0x000055b18b273896 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d26896)
#41 0x000055b18b274915 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d27915)
#42 0x000055b18b25488a clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d0788a)
#43 0x000055b1896cc987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#44 0x000055b1896540e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#45 0x000055b1897c995e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#46 0x000055b1854d4657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#47 0x000055b1854c9694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#48 0x000055b1854ce907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#49 0x000055b18538c0ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#50 0x00007f2bdce56d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#51 0x00007f2bdce56e40 call_init ./csu/../csu/libc-start.c:128:20
#52 0x00007f2bdce56e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#53 0x000055b1854c8cb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/cwuQLdKeBeYT_surfuzz_14-2270fa.c
clang: note: diagnostic msg: /tmp/cwuQLdKeBeYT_surfuzz_14-2270fa.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```

## Preprocessed Source & Run Script

**Preprocessed source** (`/tmp/cwuQLdKeBeYT_surfuzz_14-2270fa.c`):

```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c"
void
#pragma mark -v-
(e + 3, a, e - 3, b, c, d, e + 3, e + 4, e + 5);
}

#pragma GCC diagnostic ignored "-Wvariadic-macros"
void
foo (int a,...)
__attribute__ ((format (printf, 1, 3)))
{
extern int e[];
va_list ap;
va_start (ap, c);
{
int d = va_arg (ap, int);
int f = va_arg (ap, int);
e[0] = a + d;
e[1] = c + f;
}
va_end (ap);
if (a != 2 || c != 2)
__builtin_abort ();
}
int
main ()
{
int e[10];
foo (1, e, 1, e);
return 0;
}

```

**Run script** (`/tmp/cwuQLdKeBeYT_surfuzz_14-2270fa.sh`):

```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "cwuQLdKeBeYT_surfuzz_14.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/cwuQLdKeBeYT_surfuzz_14-a80bdb.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,clang,1/cwuQLdKeBeYT_surfuzz_14.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "cwuQLdKeBeYT_surfuzz_14.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "cwuQLdKeBeYT_surfuzz_14-2270fa.c"

```

* found via a fuzzer

[cwuQLdKeBeYT_surfuzz_14-2270fa.c](https://github.com/user-attachments/files/29128127/cwuQLdKeBeYT_surfuzz_14-2270fa.c)
[cwuQLdKeBeYT_surfuzz_14-2270fa.sh](https://github.com/user-attachments/files/29128126/cwuQLdKeBeYT_surfuzz_14-2270fa.sh)

Reproduce the crash with the reduced C testcase and the shown clang command, then inspect ExprConstant.cpp around LValue::addUnsizedArray and EvaluatePointer. Done means the testcase no longer triggers the assertion or compiler crash while still reporting diagnostics.

Written by the indexing model from the issue text.