[BUG] ICE in clang::CodeGen::CodeGenFunction::EmitScalarExpr(clang::Expr const*, bool)

## Bug Report: ICE in clang::CodeGen::CodeGenFunction::EmitScalarExpr(clang::Expr const*, bool)

Clang crashes when compiling the following C code.

**Compiler**: clang-22 (LLVM 22.1.5, commit 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
**Compilation flags**: -O0
**Platform**: x86_64-linux-gnu
**Component**: frontend

This is a **frontend** crash (reproduces with `-emit-llvm -Xclang -disable-llvm-passes`).

## Reduced Test Case

> Minimized from the original fuzzer-generated input using `creduce`.

```sh
clang -O0 test.c -o /dev/null
```

```c
a;
b() { sizeof *(0 ? (int(*)[a])0 : 0); }

```

## Crash Output

```
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/kOgBgjOYcFUv_surfuzz_24.c:2:20: warning: shift count >= width of type [-Wshift-count-overflow]
2 | (void)sizeof(*(0 << 32,0? (int(*)[n])0 : 0 ));
| ^ \~\~
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/kOgBgjOYcFUv_surfuzz_24.c:2:20: warning: left operand of comma operator has no effect [-Wunused-value]
2 | (void)sizeof(*(0 << 32,0? (int(*)[n])0 : 0 ));
| \~ ^ \~\~
/root/outputs/experiments-on-metamut/surfuzz,gcc,4/kOgBgjOYcFUv_surfuzz_24.c:3:1: warning: non-void function does not return a value [-Wreturn-type]
3 | }
| ^
clang-22: /root/compilers/llvm-project-release/clang/lib/CodeGen/CodeGenFunction.cpp:2440: clang::CodeGen::CodeGenFunction::VlaSizePair clang::CodeGen::CodeGenFunction::getVLASize(const clang::VariableArrayType*): Assertion \`vlaSize && "no size for VLA!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace, preprocessed source, and associated run script.
Stack dump:
0\. Program arguments: /root/objects/llvm-project-release.obj/bin/clang-22 -cc1 -triple x86_64-unknown-linux-gnu -O0 -emit-obj -dumpdir /dev/null- -disable-free -clear-ast-before-backend -main-file-name kOgBgjOYcFUv_surfuzz_24.c -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/root/data -fcoverage-compilation-dir=/root/data -resource-dir /root/objects/llvm-project-release.obj/lib/clang/22 -internal-isystem /root/objects/llvm-project-release.obj/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -faddrsig -fdwarf2-cfi-asm -o /tmp/kOgBgjOYcFUv_surfuzz_24-efbafc.o -x c /root/outputs/experiments-on-metamut/surfuzz,gcc,4/kOgBgjOYcFUv_surfuzz_24.c
1\. /root/outputs/experiments-on-metamut/surfuzz,gcc,4/kOgBgjOYcFUv_surfuzz_24.c:4:1: current parser token 'void'
2\. /root/outputs/experiments-on-metamut/surfuzz,gcc,4/kOgBgjOYcFUv_surfuzz_24.c:1:5: LLVM IR generation of declaration 'PotentiallyEvaluatedSizeofWarn'
3\. /root/outputs/experiments-on-metamut/surfuzz,gcc,4/kOgBgjOYcFUv_surfuzz_24.c:1:5: Generating code for declaration 'PotentiallyEvaluatedSizeofWarn'
#0 0x00005608190ef2d2 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f62d2)
#1 0x00005608190ebcaf llvm::sys::RunSignalHandlers() (/root/objects/llvm-project-release.obj/bin/clang-22+0x44f2caf)
#2 0x00005608190ebdfc SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
#3 0x00007f0202371520 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x42520)
#4 0x00007f02023c5a7c __pthread_kill_implementation ./nptl/./nptl/pthread_kill.c:44:76
#5 0x00007f02023c5a7c __pthread_kill_internal ./nptl/./nptl/pthread_kill.c:78:10
#6 0x00007f02023c5a7c pthread_kill ./nptl/./nptl/pthread_kill.c:89:10
#7 0x00007f0202371476 gsignal ./signal/../sysdeps/posix/raise.c:27:6
#8 0x00007f02023577f3 abort ./stdlib/./stdlib/abort.c:81:7
#9 0x00007f020235771b _nl_load_domain ./intl/./intl/loadmsgcat.c:1177:9
#10 0x00007f0202368e96 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x39e96)
#11 0x0000560819669cf9 clang::CodeGen::CodeGenFunction::getVLASize(clang::VariableArrayType const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a70cf9)
#12 0x00005608194a92bf (anonymous namespace)::ScalarExprEmitter::VisitUnaryExprOrTypeTraitExpr(clang::UnaryExprOrTypeTraitExpr const*) CGExprScalar.cpp:0:0
#13 0x00005608194c4232 clang::CodeGen::CodeGenFunction::EmitScalarExpr(clang::Expr const*, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48cb232)
#14 0x0000560819423e4f clang::CodeGen::CodeGenFunction::EmitAnyExpr(clang::Expr const*, clang::CodeGen::AggValueSlot, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x482ae4f)
#15 0x00005608194240e8 clang::CodeGen::CodeGenFunction::EmitIgnoredExpr(clang::Expr const*) (.part.0) CGExpr.cpp:0:0
#16 0x00005608194c8f21 (anonymous namespace)::ScalarExprEmitter::VisitCastExpr(clang::CastExpr*) CGExprScalar.cpp:0:0
#17 0x00005608194c4232 clang::CodeGen::CodeGenFunction::EmitScalarExpr(clang::Expr const*, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x48cb232)
#18 0x0000560819423e4f clang::CodeGen::CodeGenFunction::EmitAnyExpr(clang::Expr const*, clang::CodeGen::AggValueSlot, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x482ae4f)
#19 0x00005608194240e8 clang::CodeGen::CodeGenFunction::EmitIgnoredExpr(clang::Expr const*) (.part.0) CGExpr.cpp:0:0
#20 0x00005608195f738b clang::CodeGen::CodeGenFunction::EmitStmt(clang::Stmt const*, llvm::ArrayRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x49fe38b)
#21 0x000056081960078b clang::CodeGen::CodeGenFunction::EmitCompoundStmtWithoutScope(clang::CompoundStmt const&, bool, clang::CodeGen::AggValueSlot) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a0778b)
#22 0x00005608196689e3 clang::CodeGen::CodeGenFunction::EmitFunctionBody(clang::Stmt const*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a6f9e3)
#23 0x000056081967de84 clang::CodeGen::CodeGenFunction::GenerateCode(clang::GlobalDecl, llvm::Function*, clang::CodeGen::CGFunctionInfo const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4a84e84)
#24 0x00005608196e1f0d clang::CodeGen::CodeGenModule::EmitGlobalFunctionDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae8f0d)
#25 0x00005608196dcef5 clang::CodeGen::CodeGenModule::EmitGlobalDefinition(clang::GlobalDecl, llvm::GlobalValue*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae3ef5)
#26 0x00005608196ddb83 clang::CodeGen::CodeGenModule::EmitGlobal(clang::GlobalDecl) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4ae4b83)
#27 0x00005608196e7807 clang::CodeGen::CodeGenModule::EmitTopLevelDecl(clang::Decl*) (.part.0) CodeGenModule.cpp:0:0
#28 0x0000560819a63d71 (anonymous namespace)::CodeGeneratorImpl::HandleTopLevelDecl(clang::DeclGroupRef) ModuleBuilder.cpp:0:0
#29 0x0000560819a54cc1 clang::BackendConsumer::HandleTopLevelDecl(clang::DeclGroupRef) (/root/objects/llvm-project-release.obj/bin/clang-22+0x4e5bcc1)
#30 0x000056081b900874 clang::ParseAST(clang::Sema&, bool, bool) (/root/objects/llvm-project-release.obj/bin/clang-22+0x6d07874)
#31 0x0000560819d78987 clang::FrontendAction::Execute() (/root/objects/llvm-project-release.obj/bin/clang-22+0x517f987)
#32 0x0000560819d000e9 clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/root/objects/llvm-project-release.obj/bin/clang-22+0x51070e9)
#33 0x0000560819e7595e clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/root/objects/llvm-project-release.obj/bin/clang-22+0x527c95e)
#34 0x0000560815b80657 cc1_main(llvm::ArrayRef, char const*, void*) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf87657)
#35 0x0000560815b75694 ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#36 0x0000560815b7a907 clang_main(int, char**, llvm::ToolContext const&) (/root/objects/llvm-project-release.obj/bin/clang-22+0xf81907)
#37 0x0000560815a380ea main (/root/objects/llvm-project-release.obj/bin/clang-22+0xe3f0ea)
#38 0x00007f0202358d90 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:58:16
#39 0x00007f0202358e40 call_init ./csu/../csu/libc-start.c:128:20
#40 0x00007f0202358e40 __libc_start_main ./csu/../csu/libc-start.c:379:5
#41 0x0000560815b74cb5 _start (/root/objects/llvm-project-release.obj/bin/clang-22+0xf7bcb5)
clang: error: unable to execute command: Aborted (core dumped)
clang: error: clang frontend command failed due to signal (use -v to see invocation)
clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /root/objects/llvm-project-release.obj/bin
Build config: \+assertions
clang: note: diagnostic msg:
********************
PLEASE ATTACH THE FOLLOWING FILES TO THE BUG REPORT:
Preprocessed source(s) and associated run script(s) are located at:
clang: note: diagnostic msg: /tmp/kOgBgjOYcFUv_surfuzz_24-9f7375.c
clang: note: diagnostic msg: /tmp/kOgBgjOYcFUv_surfuzz_24-9f7375.sh
clang: note: diagnostic msg:
********************

```

## Preprocessed Source & Run Script

**Preprocessed source** (`/tmp/kOgBgjOYcFUv_surfuzz_24-9f7375.c`):

```c
# 1 ""
# 1 "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/kOgBgjOYcFUv_surfuzz_24.c"
int PotentiallyEvaluatedSizeofWarn(int n) {
(void)sizeof(*(0 << 32,0? (int(*)[n])0 : 0 ));
}
void PotentiallyEvaluatedComplexLhsWarn(int n) {
__llvm__cml(0 << 32,(int(*)[n])0);
}
void PotentiallyEvaluatedTypeofWarn(int n) {
__typeof(*(0 << 32,(int(*)[n])0)) x;
(void)x;
}
void PotentiallyEvaluatedArrayBoundWarn(int n) {
(void)*(int(*)[(0 << 32,n)])0;
}

```

**Run script** (`/tmp/kOgBgjOYcFUv_surfuzz_24-9f7375.sh`):

```sh
# Crash reproducer for clang version 22.1.5 (https://github.com/llvm/llvm-project.git 5ea218a153f4d2f815b8244eab3e4b4ba5e00e6c)
# Driver args: "-O0" "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/kOgBgjOYcFUv_surfuzz_24.c" "-o" "/dev/null"
# Original command: "/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "kOgBgjOYcFUv_surfuzz_24.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-resource-dir" "/root/objects/llvm-project-release.obj/lib/clang/22" "-internal-isystem" "/root/objects/llvm-project-release.obj/lib/clang/22/include" "-internal-isystem" "/usr/local/include" "-internal-isystem" "/usr/lib/gcc/x86_64-linux-gnu/12/../../../../x86_64-linux-gnu/include" "-internal-externc-isystem" "/usr/include/x86_64-linux-gnu" "-internal-externc-isystem" "/include" "-internal-externc-isystem" "/usr/include" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-o" "/tmp/kOgBgjOYcFUv_surfuzz_24-efbafc.o" "-x" "c" "/root/outputs/experiments-on-metamut/surfuzz,gcc,4/kOgBgjOYcFUv_surfuzz_24.c"
"/root/objects/llvm-project-release.obj/bin/clang-22" "-cc1" "-triple" "x86_64-unknown-linux-gnu" "-O0" "-emit-obj" "-dumpdir" "/dev/null-" "-disable-free" "-clear-ast-before-backend" "-main-file-name" "kOgBgjOYcFUv_surfuzz_24.c" "-mrelocation-model" "pic" "-pic-level" "2" "-pic-is-pie" "-mframe-pointer=all" "-fmath-errno" "-ffp-contract=on" "-fno-rounding-math" "-mconstructor-aliases" "-funwind-tables=2" "-target-cpu" "x86-64" "-tune-cpu" "generic" "-debugger-tuning=gdb" "-fdebug-compilation-dir=/root/data" "-fcoverage-compilation-dir=/root/data" "-ferror-limit" "19" "-fgnuc-version=4.2.1" "-fskip-odr-check-in-gmf" "-faddrsig" "-fdwarf2-cfi-asm" "-x" "c" "kOgBgjOYcFUv_surfuzz_24-9f7375.c"

```

* found via a fuzzer

[kOgBgjOYcFUv_surfuzz_24-9f7375.c](https://github.com/user-attachments/files/29129502/kOgBgjOYcFUv_surfuzz_24-9f7375.c)
[kOgBgjOYcFUv_surfuzz_24-9f7375.sh](https://github.com/user-attachments/files/29129503/kOgBgjOYcFUv_surfuzz_24-9f7375.sh)

Start by running the reduced C reproducer with clang -O0 and inspect CodeGenFunction.cpp:2440, where getVLASize asserts, along with ScalarExprEmitter::VisitUnaryExprOrTypeTraitExpr in CGExprScalar.cpp. Trace why the VLA size is unavailable for this sizeof expression; done means the compiler no longer aborts on the reproducer.

Written by the indexing model from the issue text.