[Clang] Fix crash on malformed std::partial_ordering static members (llvm#172001)

This fixes a crash (segmentation fault) when the standard library
implementation of comparison categories (like `std::partial_ordering`)
is malformed.

Specifically, if the static members (like `equivalent`) are defined as a
primitive type (e.g., `int`) instead of the comparison category type
itself, the compiler previously attempted to process them incorrectly,
leading to a crash.

This adds strict type checking in
`ComparisonCategoryInfo::lookupValueInfo`. If the found static member
does not match the record type, it is rejected safely, triggering a
diagnostic error instead of a crash.

Fixes llvm#170015
Fixes llvm#56571

Author: code-pankaj

clang/docs/ReleaseNotes.rst

@@ -608,6 +608,7 @@ Bug Fixes to C++ Support
 - Fixed an issue where templates prevented nested anonymous records from checking the deletion of special members. (#GH167217)
 - Fixed spurious diagnoses of certain nested lambda expressions. (#GH149121) (#GH156579)
 - Fix the result of ``__is_pointer_interconvertible_base_of`` when arguments are qualified and passed via template parameters. (#GH135273)
+- Fixed a crash when standard comparison categories (e.g. ``std::partial_ordering``) are defined with incorrect static member types. (#GH170015) (#GH56571)
 
 Bug Fixes to AST Handling
 ^^^^^^^^^^^^^^^^^^^^^^^^^

clang/lib/AST/ComparisonCategories.cpp

@@ -49,7 +49,7 @@ bool ComparisonCategoryInfo::ValueInfo::hasValidIntValue() const {
   // Before we attempt to get the value of the first field, ensure that we
   // actually have one (and only one) field.
   const auto *Record = VD->getType()->getAsCXXRecordDecl();
-  if (Record->getNumFields() != 1 ||
+  if (!Record || Record->getNumFields() != 1 ||
       !Record->field_begin()->getType()->isIntegralOrEnumerationType())
     return false;
 
@@ -83,7 +83,15 @@ ComparisonCategoryInfo::ValueInfo *ComparisonCategoryInfo::lookupValueInfo(
       &Ctx.Idents.get(ComparisonCategories::getResultString(ValueKind)));
   if (Lookup.empty() || !isa<VarDecl>(Lookup.front()))
     return nullptr;
-  Objects.emplace_back(ValueKind, cast<VarDecl>(Lookup.front()));
+  // The static member must have the same type as the comparison category class
+  // itself (e.g., std::partial_ordering::less must be of type
+  // partial_ordering).
+  VarDecl *VD = cast<VarDecl>(Lookup.front());
+  const CXXRecordDecl *VDRecord = VD->getType()->getAsCXXRecordDecl();
+  if (!VDRecord || VDRecord->getCanonicalDecl() != Record->getCanonicalDecl())
+    return nullptr;
+
+  Objects.emplace_back(ValueKind, VD);
   return &Objects.back();
 }
 

clang/test/SemaCXX/PR172001.cpp

@@ -0,0 +1,51 @@
+// RUN: %clang_cc1 -std=c++20 -verify=test1 -DTEST1 %s
+// RUN: %clang_cc1 -std=c++20 -verify=test2 -DTEST2 %s
+// RUN: %clang_cc1 -std=c++20 -verify=test3 -DTEST3 %s
+// RUN: %clang_cc1 -std=c++20 -verify=test4 -DTEST4 %s
+// RUN: %clang_cc1 -std=c++20 -verify=test5 -DTEST5 %s
+
+namespace std {
+#ifdef TEST1
+  // Case 1: Malformed struct (static members are wrong type)
+  // This triggered the original crash (GH170015).
+  struct partial_ordering {
+    static constexpr int equivalent = 0;
+    static constexpr int less = -1;
+    static constexpr int greater = 1;
+    static constexpr int unordered = 2;
+  };
+#elif defined(TEST2)
+  // Case 2: partial_ordering is a typedef to int
+  using partial_ordering = int;
+#elif defined(TEST3)
+  // Case 3: partial_ordering is a forward declaration
+  struct partial_ordering; // test3-note {{forward declaration of 'std::partial_ordering'}}
+#elif defined(TEST4)
+  // Case 4: partial_ordering is a template (Paranoia check)
+  template <class> struct partial_ordering {
+    static const partial_ordering less;
+    static const partial_ordering equivalent;
+    static const partial_ordering greater;
+    static const partial_ordering unordered;
+  };
+#elif defined(TEST5)
+  // Case 5: strong_ordering is a typedef to int (covers GH56571)
+  using strong_ordering = int;
+#endif
+}
+
+void f() {
+#ifdef TEST5
+  int a = 0, b = 0; // int <=> int requires std::strong_ordering
+#else
+  float a = 0.0f, b = 0.0f; // float <=> float requires std::partial_ordering
+#endif
+
+  auto res = a <=> b; 
+
+  // test1-error@-2 {{standard library implementation of 'std::partial_ordering' is not supported; the type does not have the expected form}}
+  // test2-error@-3 {{cannot use builtin operator '<=>' because type 'std::partial_ordering' was not found; include <compare>}}
+  // test3-error@-4 {{incomplete type 'std::partial_ordering' where a complete type is required}}
+  // test4-error@-5 {{cannot use builtin operator '<=>' because type 'std::partial_ordering' was not found; include <compare>}}
+  // test5-error@-6 {{cannot use builtin operator '<=>' because type 'std::strong_ordering' was not found; include <compare>}}
+}