[clang] [clang] Fix constant-evaluator crash on array new with no size (PR #207730)

[via cfe-commits]

https://github.com/DaanishD20 updated https://github.com/llvm/llvm-project/pull/207730

>From c7c76f1ed849f707f16f16a56260d79a35fc47e0 Mon Sep 17 00:00:00 2001
From: DaanishD20 <daanish.dhillip at gmail.com>
Date: Mon, 6 Jul 2026 18:37:14 +0530
Subject: [PATCH] [clang] Fix constant-evaluator crash on array new with no
 size

An array new-expression whose bound is neither specified nor deducible
from its initializer (e.g. `new int[]()`) is ill-formed and is diagnosed
by Sema, but the constant evaluator still tried to evaluate the recovery
expression. It treated the array allocation as a scalar one, producing an
array APValue stored under a scalar type, and eventually asserted in
`Type::castAsArrayTypeUnsafe()` while checking the evaluation result.

Detect an array new-expression whose size could not be determined in
`PointerExprEvaluator::VisitCXXNewExpr` and bail out gracefully instead
of crashing.

Fixes #200139.
---
 clang/docs/ReleaseNotes.md                       | 1 +
 clang/lib/AST/ExprConstant.cpp                   | 7 +++++++
 clang/test/SemaCXX/constant-expression-cxx2a.cpp | 6 ++++++
 3 files changed, 14 insertions(+)

diff --git a/clang/docs/ReleaseNotes.md b/clang/docs/ReleaseNotes.md
index b7142ecb072ff..e38b7c3b02caf 100644
--- a/clang/docs/ReleaseNotes.md
+++ b/clang/docs/ReleaseNotes.md
@@ -750,6 +750,7 @@ latest release, please see the [Clang Web Site](https://clang.llvm.org) or the
 - Fixed an assertion where we improperly handled implicit conversions to integral types from an atomic-type with a conversion function. (#GH201770)
 - Fixed assertion failures involving code completion with delayed default arguments and exception specifications. (#GH200879)
 - Fixed a regression where calling a function that takes a class-type parameter by value inside `decltype` of a concept could be incorrectly rejected when used as a non-type template argument. (#GH175831)
+- Fixed a crash in the constant evaluator when an ill-formed array new-expression whose bound could not be determined (e.g. `new int[]()`) was used in a constant expression. (#GH200139)
 
 #### Bug Fixes to Compiler Builtins
 
diff --git a/clang/lib/AST/ExprConstant.cpp b/clang/lib/AST/ExprConstant.cpp
index fb82e0addfdac..bd188cd10f82f 100644
--- a/clang/lib/AST/ExprConstant.cpp
+++ b/clang/lib/AST/ExprConstant.cpp
@@ -10863,6 +10863,13 @@ bool PointerExprEvaluator::VisitCXXNewExpr(const CXXNewExpr *E) {
 
     AllocType = Info.Ctx.getConstantArrayType(AllocType, ArrayBound, nullptr,
                                               ArraySizeModifier::Normal, 0);
+  } else if (E->isArray()) {
+    // We have an array new-expression whose array size could not be
+    // determined, e.g. 'new int[]()', where the bound is neither given nor
+    // deducible from the initializer. This is ill-formed and already
+    // diagnosed, so bail out rather than mis-evaluating a scalar allocation
+    // as an array (which would later crash the evaluator).
+    return false;
   } else {
     assert(!AllocType->isArrayType() &&
            "array allocation with non-array new");
diff --git a/clang/test/SemaCXX/constant-expression-cxx2a.cpp b/clang/test/SemaCXX/constant-expression-cxx2a.cpp
index 396a8df21a3e3..94ecafc081302 100644
--- a/clang/test/SemaCXX/constant-expression-cxx2a.cpp
+++ b/clang/test/SemaCXX/constant-expression-cxx2a.cpp
@@ -898,6 +898,12 @@ namespace dynamic_alloc {
   static_assert(erroneous_array_bound(-1)); // expected-error {{constant expression}} expected-note {{in call}}
   static_assert(erroneous_array_bound(1LL << 62)); // expected-error {{constant expression}} expected-note {{in call}}
 
+  // An array new-expression whose bound is neither given nor deducible from the
+  // initializer is ill-formed; the constant evaluator must reject it gracefully
+  // rather than crash. See GH200139.
+  static_assert((new int[]())[0] == 0); // expected-error {{cannot determine allocated array size from initializer}} \
+                                        // expected-error {{static assertion expression is not an integral constant expression}}
+
   constexpr bool erroneous_array_bound_nothrow(long long n) {
     int *p = new (std::nothrow) int[n];
     bool result = p != 0;