[BUG] ICE in (anonymous namespace)::InitListChecker::CheckListElementTypes(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType&, bool, unsigned int&, clang::InitListExpr*, unsigned int&, bool) [clone .constprop.0]

## Bug Report: ICE in (anonymous namespace)::InitListChecker::CheckListElementTypes(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType&, bool, unsigned int&, clang::InitListExpr*, unsigned int&, bool) [clone .constprop.0]

Clang crashes when compiling the following C code.

**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend

This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).

## Reduced Test Case

> Minimized from the original fuzzer-generated input using `creduce`.

```sh
clang -O0 test.c -o /dev/null
```

```c
struct {
union {
float a;
double b
} named
} c = {{.b = 0}, .name = 0.0}

```

## Crash Output

```
/root/outputs/experiments-on-metamut/surfuzz,clang,1/ZCZlwOrXKGNN_surfuzz_13.c:22:4: error: field designator 'name' does not refer to any field in type 'struct X'; did you mean 'named'?
22 | ,.name \= 1
| ^\~\~\~
| named
/root/outputs/experiments-on-metamut/surfuzz,clang,1/ZCZlwOrXKGNN_surfuzz_13.c:5:5: note: 'named' declared here
5 | } named;
| ^
/root/outputs/experiments-on-metamut/surfuzz,clang,1/ZCZlwOrXKGNN_surfuzz_13.c:22:11: warning: initializer overrides prior initialization of this subobject [-Winitializer-overrides]
22 | ,.name \= 1
| ^
/root/outputs/experiments-on-metamut/surfuzz,clang,1/ZCZlwOrXKGNN_surfuzz_13.c:20:18: note: previous initialization is here
20 | .named \= {.d2 \= 0 }
| ^
clang-22: /root/compilers/llvm-project-release/clang/include/clang/AST/Expr.h:5432: void clang::InitListExpr::setInitializedFieldInUnion(clang::FieldDecl*): Assertion \`(FD \== nullptr || getInitializedFieldInUnion() \== nullptr || getInitializedFieldInUnion() \== FD) && "Only one field of a union may be initialized at a time!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name ZCZlwOrXKGNN_surfuzz_13.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/ZCZlwOrXKGNN_surfuzz_13-d76c47.o -x c /root/outputs/experiments-on-metamut/surfuzz,clang,1/ZCZlwOrXKGNN_surfuzz_13.c
1\. /root/outputs/experiments-on-metamut/surfuzz,clang,1/ZCZlwOrXKGNN_surfuzz_13.c:26:2: current parser token ';'
#0 0x0000557f0755f2d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x0000557f0755bcaf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x0000557f0755bdfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f4a12626520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007f4a1267aa7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007f4a1267aa7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007f4a1267aa7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007f4a12626476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007f4a1260c7f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007f4a1260c71b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007f4a1261de96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x0000557f0a41d099 clang::InitListExpr::setInitializedFieldInUnion(clang::FieldDecl*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x73b4099)
#12 0x0000557f0a448b5c (anonymous namespace)::InitListChecker::CheckStructUnionTypes(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType, llvm::iterator_range, clang::DeclContext::specific_decl_iterator, bool, unsigned int&, clang::InitListExpr*, unsigned int&, bool) SemaInit.cpp:0:0
#13 0x0000557f0a4499ca (anonymous namespace)::InitListChecker::CheckListElementTypes(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType&, bool, unsigned int&, clang::InitListExpr*, unsigned int&, bool) (.constprop.0) SemaInit.cpp:0:0
#14 0x0000557f0a44a966 (anonymous namespace)::InitListChecker::CheckImplicitInitList(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType, unsigned int&, clang::InitListExpr*, unsigned int&) SemaInit.cpp:0:0
#15 0x0000557f0a44b21b (anonymous namespace)::InitListChecker::CheckSubElementType(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType, unsigned int&, clang::InitListExpr*, unsigned int&, bool) SemaInit.cpp:0:0
#16 0x0000557f0a44419b (anonymous namespace)::InitListChecker::CheckDesignatedInitializer(clang::InitializedEntity const&, clang::InitListExpr*, clang::DesignatedInitExpr*, unsigned int, clang::QualType&, clang::DeclContext::specific_decl_iterator*, llvm::APSInt*, unsigned int&, clang::InitListExpr*, unsigned int&, bool, bool) (.constprop.1) SemaInit.cpp:0:0
#17 0x0000557f0a446ebc (anonymous namespace)::InitListChecker::CheckDesignatedInitializer(clang::InitializedEntity const&, clang::InitListExpr*, clang::DesignatedInitExpr*, unsigned int, clang::QualType&, clang::DeclContext::specific_decl_iterator*, llvm::APSInt*, unsigned int&, clang::InitListExpr*, unsigned int&, bool, bool) (.constprop.0) SemaInit.cpp:0:0
#18 0x0000557f0a44824f (anonymous namespace)::InitListChecker::CheckStructUnionTypes(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType, llvm::iterator_range, clang::DeclContext::specific_decl_iterator, bool, unsigned int&, clang::InitListExpr*, unsigned int&, bool) SemaInit.cpp:0:0
#19 0x0000557f0a4499ca (anonymous namespace)::InitListChecker::CheckListElementTypes(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType&, bool, unsigned int&, clang::InitListExpr*, unsigned int&, bool) (.constprop.0) SemaInit.cpp:0:0
#20 0x0000557f0a43228d (anonymous namespace)::InitListChecker::CheckExplicitInitList(clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType&, clang::InitListExpr*, bool) (.constprop.0) SemaInit.cpp:0:0
#21 0x0000557f0a432d27 (anonymous namespace)::InitListChecker::InitListChecker(clang::Sema&, clang::InitializedEntity const&, clang::InitListExpr*, clang::QualType&, bool, bool, bool, llvm::SmallVectorImpl*) SemaInit.cpp:0:0
#22 0x0000557f0a433103 diagnoseListInit(clang::Sema&, clang::InitializedEntity const&, clang::InitListExpr*) SemaInit.cpp:0:0
#23 0x0000557f0a439300 clang::InitializationSequence::Diagnose(clang::Sema&, clang::InitializedEntity const&, clang::InitializationKind const&, llvm::ArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x73d0300)
#24 0x0000557f0a43b3e5 clang::InitializationSequence::Perform(clang::Sema&, clang::InitializedEntity const&, clang::InitializationKind const&, llvm::MutableArrayRef, clang::QualType*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x73d23e5)
#25 0x0000557f0a15c1c0 clang::Sema::AddInitializerToDecl(clang::Decl*, clang::Expr*, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x70f31c0)
#26 0x0000557f09db6b41 clang::Parser::ParseDeclarationAfterDeclaratorAndAttributes(clang::Declarator&, clang::Parser::ParsedTemplateInfo const&, clang::Parser::ForRangeInit*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d4db41)
#27 0x0000557f09dcdce3 clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d64ce3)
#28 0x0000557f09d867e1 clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1d7e1)
#29 0x0000557f09d8700f clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d1e00f)
#30 0x0000557f09d8f896 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d26896)
#31 0x0000557f09d90915 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d27915)
#32 0x0000557f09d7088a clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d0788a)
#33 0x0000557f081e8987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#34 0x0000557f081700e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#35 0x0000557f082e595e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#36 0x0000557f03ff0657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#37 0x0000557f03fe5694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#38 0x0000557f03fea907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#39 0x0000557f03ea80ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#40 0x00007f4a1260dd90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#41 0x00007f4a1260de40 call_init ./csu/../csu/libc-start.c:128:20
#42 0x00007f4a1260de40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#43 0x0000557f03fe4cb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/ZCZlwOrXKGNN_surfuzz_13-875914.c
clang: note: diagnostic msg: /tmp/ZCZlwOrXKGNN_surfuzz_13-875914.sh
clang: note: diagnostic msg:
********************
EXIT_CODE: 1
```

## Preprocessed Source & Run Script

**Preprocessed source** (`/tmp/ZCZlwOrXKGNN_surfuzz_13-875914.c`):

```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,clang,1/ZCZlwOrXKGNN_surfuzz_13.c"
struct X {
union {
float f3;
double d2;
} named;
union {
int i;
float f;
union {
float f2;
double d;
};
};
struct {
int a;
float b;
};
};
static struct X x = {
.named = {.d2 = 0 }
,.i = 0
,.name = 1
,.f = 0
,.f2 = 0
,.d = 0.0
};
void f(void) {
x.i = 0;
x.f = 0.0;
x.f2 = x.f;
x.d = x.f;
x.f3 = 0;
x.a = 0;
xc.d = 0.0;
xc.f = 0;
xc.a = 0;
}
static struct X y = {.d = 0 };
static const float xq = y.f3;
static const float xqc = y.f2;
const float xq = y.f3;
const float xqc = y.f2;
struct X2 {
union {
int i;
float f;
double d;
} named;
union {
int i;
float f;
union {
float f;
double d;
};
};
struct {
int a;
float b;
};
};
const float xq2 = y.f;
const float xqc2 = y.d;
int main(void) {
return 0;
}
struct foo { union { int A; int B; }; int Y; };
static int tmp = 0;
struct foo foo = {.A = 0 };
const int X = foo.A;
static int tmp2 = 64;
const int X = 2;
static int tmp3 = 64;
const long long_tmp4 = 42;
int x;
struct y { };
union {
int x;
float y;
double z;
double zz;
};
int z;
void zz(void);
};
union {
int int_val;
float float_val;
};
static union {
int int_val2;
float float_val2;
};
void f(void) {
int_val2 = 0;
float_val2 = 0.0;
}
void g(void) {
union {
int i;
float f2;
};
i = 0;
f2 = 0.0;
}
struct s0 { union { int f0; }; };
typedef struct { };
struct s1 {
int f0;
union {
int f0;
};
};
struct {};
struct s2 {
union {
int a;
}
};
typedef struct {
int x;
} a_struct;
int tmp = (a_struct) { .x = 0 };
struct s {
struct { int i; };
int a[];
};
struct s3 {
struct { int A __attribute__((deprecated)); };
};
void deprecated_anonymous_struct_member(void) {
struct s3 s;
s.A = 1;
}

```

**Run script** (`/tmp/ZCZlwOrXKGNN_surfuzz_13-875914.sh`):

```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,clang,1/ZCZlwOrXKGNN_surfuzz_13.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "ZCZlwOrXKGNN_surfuzz_13.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/ZCZlwOrXKGNN_surfuzz_13-d76c47.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,clang,1/ZCZlwOrXKGNN_surfuzz_13.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "ZCZlwOrXKGNN_surfuzz_13.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "ZCZlwOrXKGNN_surfuzz_13-875914.c"

```

* found via a fuzzer

[ZCZlwOrXKGNN_surfuzz_13-875914.c](https://github.com/user-attachments/files/29128200/ZCZlwOrXKGNN_surfuzz_13-875914.c)
[ZCZlwOrXKGNN_surfuzz_13-875914.sh](https://github.com/user-attachments/files/29128199/ZCZlwOrXKGNN_surfuzz_13-875914.sh)

Reproduce the crash with the supplied clang -O0 test.c command, then inspect SemaInit.cpp around InitListChecker::CheckStructUnionTypes, CheckListElementTypes, and CheckDesignatedInitializer. Add regression coverage for the reduced C initializer and verify that clang reports the invalid field without asserting or aborting.

Written by the indexing model from the issue text.