Created attachment 25049 [details]
The crash reproducer

There is a SIGSEGV (NULL dereference) at DeduceTemplateArgumentsByTypeMatch as soon as FunctionType parameter passed into the function is NULL. See reproducer at the attachment

The possible fix for the problem is

--- a/clang/lib/Sema/SemaTemplateDeduction.cpp
+++ b/clang/lib/Sema/SemaTemplateDeduction.cpp
@@ -4346,7 +4346,7 @@ Sema::TemplateDeductionResult Sema::DeduceTemplateArguments(
     HasDeducedReturnType = true;
   }
 
-  if (!ArgFunctionType.isNull()) {
+  if (!ArgFunctionType.isNull() && !FunctionType.isNull()) {
     unsigned TDF =
         TDF_TopLevelParameterTypeList | TDF_AllowCompatibleFunctionType;
     // Deduce template arguments from the function type.