[clang] Assertion `ParamType->isPointerOrReferenceType() || ParamType->isNullPtrType()' failed.

Reproducer:
https://godbolt.org/z/neT5Y9dcx
```cpp
struct S {};

void foo() { int res = s->i; }

static int bar = foo();
template struct SS {};
void baz(SS) {}
```

Backtrace:
```console
clang++: /root/llvm-project/llvm/tools/clang/lib/Sema/SemaTemplate.cpp:7391: clang::ExprResult clang::Sema::CheckTemplateArgument(clang::NamedDecl*, clang::QualType, clang::Expr*, clang::TemplateArgument&, clang::TemplateArgument&, bool, clang::Sema::CheckTemplateArgumentKind): Assertion `ParamType->isPointerOrReferenceType() || ParamType->isNullPtrType()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics
1. :7:10: at annotation token
#0 0x00000000043f3668 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x43f3668)
#1 0x00000000043f0524 llvm::sys::RunSignalHandlers() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x43f0524)
#2 0x00000000043f0b4c llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x43f0b4c)
#3 0x000000000432fb88 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
#4 0x0000757ae6645330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#5 0x0000757ae669eb2c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c)
#6 0x0000757ae664527e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#7 0x0000757ae66288ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#8 0x0000757ae662881b (/lib/x86_64-linux-gnu/libc.so.6+0x2881b)
#9 0x0000757ae663b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#10 0x0000000007737a6a clang::Sema::CheckTemplateArgument(clang::NamedDecl*, clang::QualType, clang::Expr*, clang::TemplateArgument&, clang::TemplateArgument&, bool, clang::Sema::CheckTemplateArgumentKind) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7737a6a)
#11 0x0000000007738485 clang::Sema::CheckTemplateArgument(clang::NamedDecl*, clang::TemplateArgumentLoc&, clang::NamedDecl*, clang::SourceLocation, clang::SourceLocation, unsigned int, clang::Sema::CheckTemplateArgumentInfo&, clang::Sema::CheckTemplateArgumentKind) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7738485)
#12 0x000000000773ddf5 clang::Sema::CheckTemplateArgumentList(clang::TemplateDecl*, clang::TemplateParameterList*, clang::SourceLocation, clang::TemplateArgumentListInfo&, clang::DefaultArguments const&, bool, clang::Sema::CheckTemplateArgumentInfo&, bool, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x773ddf5)
#13 0x00000000077538d7 clang::Sema::CheckTemplateIdType(clang::ElaboratedTypeKeyword, clang::TemplateName, clang::SourceLocation, clang::TemplateArgumentListInfo&, clang::Scope*, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x77538d7)
#14 0x0000000007756981 clang::Sema::ActOnTemplateIdType(clang::Scope*, clang::ElaboratedTypeKeyword, clang::SourceLocation, clang::CXXScopeSpec&, clang::SourceLocation, clang::OpaquePtr, clang::IdentifierInfo const*, clang::SourceLocation, clang::SourceLocation, llvm::MutableArrayRef, clang::SourceLocation, bool, bool, clang::ImplicitTypenameContext) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x7756981)
#15 0x0000000006e1bb12 clang::Parser::AnnotateTemplateIdTokenAsType(clang::CXXScopeSpec&, clang::ImplicitTypenameContext, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6e1bb12)
#16 0x0000000006d06ae0 clang::Parser::TryAnnotateTypeOrScopeTokenAfterScopeSpec(clang::CXXScopeSpec&, bool, clang::ImplicitTypenameContext) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d06ae0)
#17 0x0000000006d06f81 clang::Parser::TryAnnotateTypeOrScopeToken(clang::ImplicitTypenameContext, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d06f81)
#18 0x0000000006e2dbb6 clang::Parser::isCXXDeclarationSpecifier(clang::ImplicitTypenameContext, clang::Parser::TPResult, bool*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6e2dbb6)
#19 0x0000000006e30ec5 clang::Parser::TryParseParameterDeclarationClause(bool*, bool, clang::ImplicitTypenameContext) (.part.0) ParseTentative.cpp:0:0
#20 0x0000000006e314c2 clang::Parser::isCXXFunctionDeclarator(bool*, clang::ImplicitTypenameContext) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6e314c2)
#21 0x0000000006d56751 clang::Parser::ParseDirectDeclarator(clang::Declarator&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d56751)
#22 0x0000000006d3ea6b clang::Parser::ParseDeclaratorInternal(clang::Declarator&, void (clang::Parser::*)(clang::Declarator&)) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d3ea6b)
#23 0x00000000087fec81 clang::StackExhaustionHandler::runWithSufficientStackSpace(clang::SourceLocation, llvm::function_ref) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x87fec81)
#24 0x0000000006d580b7 clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d580b7)
#25 0x0000000006d03dcb clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d03dcb)
#26 0x0000000006d045bf clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d045bf)
#27 0x0000000006d10dd1 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d10dd1)
#28 0x0000000006d11ce5 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d11ce5)
#29 0x0000000006ceebfa clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6ceebfa)
#30 0x0000000004ef1628 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4ef1628)
#31 0x000000000521ccc8 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x521ccc8)
#32 0x00000000051aa16d clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x51aa16d)
#33 0x00000000052f53fd clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x52f53fd)
#34 0x0000000000da6c9c cc1_main(llvm::ArrayRef, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xda6c9c)
#35 0x0000000000d9d8aa ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#36 0x0000000000d9da2d int llvm::function_ref&)>::callback_fn&)>(long, llvm::SmallVectorImpl&) driver.cpp:0:0
#37 0x0000000004f688f9 void llvm::function_ref::callback_fn>, std::__cxx11::basic_string, std::allocator>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#38 0x000000000432ffc4 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x432ffc4)
#39 0x0000000004f69465 clang::driver::CC1Command::Execute(llvm::ArrayRef>, std::__cxx11::basic_string, std::allocator>*, bool*) const (.part.0) Job.cpp:0:0
#40 0x0000000004f21e32 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f21e32)
#41 0x0000000004f26667 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f26667)
#42 0x0000000004f30bc5 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f30bc5)
#43 0x0000000000da318a clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xda318a)
#44 0x0000000000cbef4a main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xcbef4a)
#45 0x0000757ae662a1ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#46 0x0000757ae662a28b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#47 0x0000000000d9d255 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xd9d255)
clang++: error: clang frontend command failed due to signal (use -v to see invocation)
Compiler returned: 134
```

Start with llvm/tools/clang/lib/Sema/SemaTemplate.cpp around CheckTemplateArgument at line 7391, then compile the linked godbolt reproducer with clang++ to reproduce the assertion. Trace how the expression in foo() reaches the template argument check. Done means the reproducer no longer aborts with this assertion.

Written by the indexing model from the issue text.