[clang] [clang][bytecode] Diagnose negative AllocCN element counts (PR #202108)

[Timm Baeder via cfe-commits]

https://github.com/tbaederr updated https://github.com/llvm/llvm-project/pull/202108

>From 4a763bd5e7c8a9bc07d062c237525eb2a5ade959 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timm=20B=C3=A4der?= <tbaeder at redhat.com>
Date: Sun, 7 Jun 2026 09:19:13 +0200
Subject: [PATCH] [clang][bytecode] Diagnose negative AllocCN element counts

Just like we do in AllocN.
---
 clang/lib/AST/ByteCode/Interp.h        | 10 +++++++++-
 clang/test/AST/ByteCode/new-delete.cpp | 12 +++++++++---
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/clang/lib/AST/ByteCode/Interp.h b/clang/lib/AST/ByteCode/Interp.h
index fa77e19afce66..d2ca122d0e805 100644
--- a/clang/lib/AST/ByteCode/Interp.h
+++ b/clang/lib/AST/ByteCode/Interp.h
@@ -3894,7 +3894,15 @@ inline bool AllocCN(InterpState &S, CodePtr OpPC, const Descriptor *ElementDesc,
     S.Stk.push<Pointer>(0, ElementDesc);
     return true;
   }
-  assert(NumElements.isPositive());
+  if (NumElements.isNegative()) {
+    if (!IsNoThrow) {
+      S.FFDiag(S.Current->getSource(OpPC), diag::note_constexpr_new_negative)
+          << NumElements.toDiagnosticString(S.getASTContext());
+      return false;
+    }
+    S.Stk.push<Pointer>(0, nullptr);
+    return true;
+  }
 
   if (!CheckArraySize(S, OpPC, static_cast<uint64_t>(NumElements)))
     return false;
diff --git a/clang/test/AST/ByteCode/new-delete.cpp b/clang/test/AST/ByteCode/new-delete.cpp
index f31851c98213c..7481eccd2c03a 100644
--- a/clang/test/AST/ByteCode/new-delete.cpp
+++ b/clang/test/AST/ByteCode/new-delete.cpp
@@ -1101,12 +1101,18 @@ namespace BaseCompare {
 }
 
 
-namespace NegativeArraySize { 
+namespace NegativeArraySize {
   constexpr void f() { // both-error {{constexpr function never produces a constant expression}}
     int x = -1;
-    int *p = new int[x]; //both-note {{cannot allocate array; evaluated array bound -1 is negative}} 
+    int *p = new int[x]; //both-note {{cannot allocate array; evaluated array bound -1 is negative}}
   }
-} // namespace NegativeArraySize
+
+  struct S {};
+  constexpr void f1() { // both-error {{constexpr function never produces a constant expression}}
+    int x = -1;
+    int *p = new int[x]; //both-note {{cannot allocate array; evaluated array bound -1 is negative}}
+  }
+}
 
 namespace NewNegSizeNothrow {
   constexpr int get_neg_size() {